Path gets a pass? Why? - <AUTHOR> http://edwardaten.posterous.com/path-gets-a-pass-why-we-shouldnt-let-them-of

<comment><USER2> In what way did Path "get a pass?" They got a lot of negative press, and it brought attention to this issue (hence blog posts like this one). Sure, people got vocally angry and then quickly forgot about it, but that's just what people do. It even happens with far worse things, like police brutality or even unwise invasions of countries.

What specifically do you want to happen? You say you want "Silicon Valley" to "publicly and vocally [condemn] this type of activity," but what would that actually mean? Last I checked, "Silicon Valley" doesn't exist as some unified entity that can issue public statements. Heck, Hacker News is some approximation of the culture of Silicon Valley, and the front page was filled with rage.

Also, incidentally, I find it interesting that you cite a dictionary definition for a word that in no way corroborates your usage of the word, even though I think I agree with your underlying point. Path didn't "take and carry away" anything, and the contacts on your phone hardly constitute "personal goods or property."

<comment><USER3> Thanks for the question Baddox.

Do a search on Twitter for the top tweets that link to Path's blog apology. Nearly every major figure in tech (99% in "The Valley") just accepted their apology and moved on.

Wouldnt have happened with other companies like Google or Facebook and shouldnt have happened here.

<comment><USER2> What's the alternative to accepting their apology and moving on? Short of organizing a mass exodus from Path, or pushing for legal action (which the author doesn't seem to be proposing), what can be done? The only alternative I can think of is for the community to keep repeating itself over and over again, like "We're still outraged."

> Wouldnt have happened with other companies like Google or Facebook and > shouldnt have happened here.

People move on quickly after Google or Facebook screw up. There have been several times where people were enraged at Facebook's default privacy settings, and I never saw much discussion 24 hours after each story broke. The same goes with Apple: I can't recall any privacy-related issues other than the coordinates being stored on the phone, but a similar issue was all of the weird app rejections and fuzzy rules surrounding the App Store. Each time, people were outraged, and then the discussion cools down. I think this is inevitable, and I don't think it necessarily means that no good came out of the situation.

</comment></comment></comment><comment><USER4> Path's error was not the uploading of your address book, but rather making it not be a user choice. The data was used directly in the functionality of the product. The level of actual usefulness this would be to the user is debatable but it isn't a direct utilization of your data for benefit, the benefit to Path is an indirect one (but then, everything any company does is primarily for their benefit, just indirectly through providing utility to the customers).

If Path was taking your address book and selling it to spammers, and forgot to make that opt-in or out (as many services do), then after being confronted with this apologized and made that optional. That would NOT BE OK. That's what Facebook and Google would have likely done (since that's basically their business model), and likely why you have the impression that they wouldn't be let off the hook as easily.

What Path was actually doing with the address book is crucial here to whether the apology and quick response to amend their ways (FB and G tend to seriously drag their feet on responses) should result in forgiveness and caution towards them in the future, or the harsher response you advocate.

Do not misconstrue this as Path apologism, because I do think what Path did was very wrong--hence the requirement for them to apologize in a way that I thought was sincere and comprehending of the source of the outrage (many similar apologies are tone deaf and come off like "I am sorry you are having a problem" vs. "I'm sorry we caused a problem")--I just think they haven't made a deep ethical mistake, but rather an unfortunate oversight well deserving of castigation that they've begun to atone for.

<comment><USER5> Path may have not sold your personal data to third party advertisers to target you with, but Path wanted and used your address book for the same reason those third party advertisers would have wanted it: to promote their own product to you and your friends.

</comment></comment><comment><USER6> This is sensationalist crap.

</comment><comment><USER7> They spent some social capital, but they're still in the black.

<comment><USER3> Since when did stealing become 'spending social capital'?

Its this type of perspective that encourages our community to condone activities that we would frown upon in other circumstances.

"Did I gain more than I lost?" isn't the type of hacker we should be striving to be.

<comment><USER7> After they took people's contact info without asking, they had to make it up to their customers. They deleted the info immediately, updated the app, and issued a sincere apology. This is the opposite of "condoning" their actions.

</comment></comment></comment><comment><USER8> I wonder what are their usage statistics...

If its in the low numbers, probably not enough people use it to cause a mob riot.

I personally don't use it at all.

<comment><USER9> It's going to be low, because of the app itself. Seriously, if you've never used the app you might want to educate yourself before making such statements.

Limiting the number of possible friends means a smaller network, and a smaller user base.

That you "personally" don't use it means nothing.

</comment></comment><comment><USER10> Maybe because it has earned it?

</comment><comment><USER11> Path is dead in the water and nobody cares. Those who expressed sympathy over their handling of the nerd pressure were doing so more to signal for future times that the correct action was taken by Path's management. It means something to the industry that not everyone is a Curebit or similar, even though what they did was a premeditated act of douchebaggery.

Which brings me to another topic: it's hard out there to be successful and always do the right thing. Sometimes you'll have to cut corners in the attempt to gain an edge, however meaningless an inconsequential to the big picture it may seem at the time, because big strong companies are built on a stream of small, repetitive successes, not big wins.

<comment><USER9> Dead in the water? I sure wish we could make a bet on that.

<comment><USER11> Let me know when they hit the all too critical mass.

</comment></comment></comment><comment><USER12> If Path has violated the UK's Data Protection Act like some stories have mentioned, people from the company should go to jail.

<comment><USER13> Path is a US registered company with an office in San Francisco. Path is hosted by Amazon out of the US.

At what point does UK law have jurisdiction?

<comment><USER14> IANAL - but with the DPA and other EU data/privacy laws: at the point that the data was collected inside but transmitted outside the EU. Its treated somewhat like an export, or a border control. (this is why Apple allow you to preclude your app from certain local markets; enter the market, and you ARE bound by its laws for your actions in that market)

On the other hand; DPA violation doesn't result in prison, just a (potentially large) fine.

On the third hand, its quite possible that Path did not violate the DPA (although its possible they did). The DPA, in short states that you have to gather personal info for a specific, consensual purpose, and not use it for any other, and also store it in a way that protects it from loss/theft/misuse - where misuse includes deciding 6 months down the line to use it for another purpose. It also means that if your 'purpose' for holding that information ceases, you are legally obligated to purge the data - your legal permission to hold ends.

So; was there consent - almost certainly not, hence possible DPA violation. But once it was clear they had no broad public consent - they immediately purged the data, so possibly no _deliberate_ violation, and certainly a demonstration of willingness to correct the situation.</comment></comment></comment>


The Anatomy of a Great Stack Overflow Question (After Analyzing 10,000) - <AUTHOR> http://www.takipioncode.com/2014/02/03/the-anatomy-of-a-great-stack-overflow-question-after-analyzing-10000/

<comment><USER2> This is a very interesting article, however, IMHO it has several major problems:

1\. The author doesn't understand, or is too lazy to recognize, that "correlation does not imply causation". It's hard to read sentences like _it seems like the length of the title has a minor influence on the quality of the question_ and not shudder.

2\. There's no interpretation. At all. It's just queries, and doesn't provide any real insight into how to write better questions, get better answers, or get more upvotes. No hypothesis or model.

3\. It's missing meaningful statistical measures, such as standard deviations, error bars, etc. For example, is this even statistically significant: _The average title length of the top questions was about 5% shorter than that of standard titles (47 characters vs. 50)_ ?

4\. Biased samples.

So my takeaway is that it was fun and interesting to read, but not very meaningful.

</comment><comment><USER3> Hold on --- the article says that the top questions were asked by people with a lot of reputation. Isn't it the case that the top questions bring the asker a lot of reputation points, which means it's not necessarily the case that their question is a "top" question because of their preexisting reputation?

<comment><USER4> Well, there's really something else going on - I'm sure the phenomenon is there but I think they're asking the wrong question.

Stackoverflow tends to get a mix of questions that would require an experienced person to give a great deal of thought to, or things that require specialized knowledge ("good questions") and things that look very much like someones first year CS homework or questions coming out of pure laziness. In the worst cases the posted could have solved these questions by just checking public API docs but didn't bother. Often the worst questions are anonymous or accounts with single-digit reputation, display a fair amount of ignorance, and are syntactically mangled. The posters will generally not bother to take the trouble to upvote, respond, or thank for the replies.

I wonder if this phenomenon would disappear as a trend if they filtered out the "clown" questions (lets say, questions by people who posted less than 3 or 4 questions and no answers, or questions by anyone who had questions downvoted as homework).

</comment></comment><comment><USER5> I'm kind of worried that they checked so many types of things (64) on small outlier samples (top 300):

> We ran eight different queries and sorted the questions according to: [8 > criteria]. Then we compared the top 300 questions in each section to 300 > questions that received an average score on the parameter we focused on.

Would results of that be statistically significant, if you picked the apparently-best 5 resulting from that process, or would they just be noise?

(Isn't ten thousand questions not even two days' worth of questions?)</comment>


Windows 10 Enterprise telemetry network traffic analysis, part 1 - <AUTHOR> https://voat.co/v/technology/comments/835741 <comment><USER2> What I'm concerned about is the following:

> However, before more info is gathered, Microsoft's privacy governance team, > including privacy and other subject matter experts, must approve the > diagnostics request made by a Microsoft engineer. If the request is > approved, Microsoft engineers can use the following capabilities to get the > information:

> Ability to gather user content, such as documents, if they might have been > the trigger for the issue.

This means that Telemetry in Windows 10 is a built in backdoor that allows Microsoft to access your local files. That is disturbing. At minimum, explicit user consent should be required, i.e. a popup asking if you'd like to share a specific file with Microsoft.

Source: [https://technet.microsoft.com/en- us/library/mt577208.aspx?f=...](https://technet.microsoft.com/en- us/library/mt577208.aspx?f=255&MSPPError=-2147217396)

<comment><USER3> That is only the case if you set the telemetry settings to "Full".

<comment><USER2> Full is the default setting. For all intents and purposes, 99 in 100 Win10 PCs are on Full.

<comment><USER4> We're talking about Windows 10 Enterprise here, not regular consumers.

<comment><USER5> Enterprise is the only version that allows you to disable most of this stuff.

It's on by default on all other versions.

<comment><USER6> And if you look in the comments even for enterprise he chose a "customized install" to be presented with 15 pages of telemetry options (all default on even in enterprise). He selected "No" for all telemetry data (in the customized install that even most admins would trust is not necessary from MS rhetoric) and is still getting this activity.

<comment><USER7> The article said _3_ pages, with a total of around 15 options.

<comment><USER6> Thanks for catching that. It is still worrisome that there is activity after disabling the 15 options (3 pages) and maybe more worrisome that you don't get that option in enterprise edition without a custom install. Working in biotech, pharma companies do not take well to external network connections. Although most will have whitelist firewalls, I would have expected the default in enterprise would be to not phone home.

<comment><USER7> I agree that it's far too many, and far too much effort to completely disable.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8>
      > I have configured the DD-WRT router to drop and log all
      > connection attempts via iptables...

I'd be more interested in seeing the result of letting the connections succeed while timing how long they stay open and how many bytes are sent/received. The fact that thousands of connections are opened is likely a result of retry mechanisms after the connections are dropped at the router. Perhaps the first thing Windows 10 does is let Microsoft know "this system has opted out of the following tracking: ..." so that connections to Windows Update, etc. don't end up logging additional information.

I'd also like to see a similar comparison for an average desktop Linux installation, OS X installation, and so on.

<comment> chestnut-tree _" I'd also like to see a similar comparison for an average desktop Linux installation, OS X installation"_

I agree. I'd really like to see an analysis of Android and ChromeOS. I'm glad to see Microsoft in the spotlight over tracking and analytics as this is a subject that gets far too little scrutiny from the tech community.

Tracking practices are widespread in the industry. Take Chromebooks for example, they are now used in many US schools. The kids have no choice in using these laptops, it's the adults who make the decision to deploy them (and Google that heavily promotes their use). The privacy implications of an OS that requires sign-in and then tracks every app and website you use are horrendous. Yet there's barely any scrutiny from the tech community.

We really need to apply this analysis of Windows 10 to other operating systems, especially ones that we know track you by default.

<comment><USER9> Which operating systems other than Win10 do we know track you by default?

<comment><USER10> OP gave an example: ChromeOS

<comment><USER9> Yea I know he mentions Android and ChromeOS, but I'm mostly asking where the info is to support his claim that "we know they're tracked by default". I've never come across anything yet related to ChromeOS that even comes close to the Win10 tracking by default, but it seems presumed for some reason.

<comment><USER10> I'm not very familiar with ChromeOS but I can cite an example in Android:

When you turn on Location in your Android phone, every time there is a disclaimer (unless you turn the notice off). It says that Google will collect your location data. If you decline, your phone's GPS is useless. So, in order to utilize the hardware you bought, you are forced to give up your privacy.

This is the definition of "tracked by default". Is there any hardware feature that Windows does not allow users to access if you turn off all the tracking?

<comment><USER11> I'm pretty familiar with Android and this isn't quite true. It prompts to ask if your phone can report nearby WiFi hotspots to Google and use that information to try to get a more accurate location than GPS provides.

But GPS still works. GPS even works with the WiFi and mobile radios turned off. GPS works without the Google Apps installed, and without the WiFi location being enabled.

<comment><USER10> All the android phones I've used do not let you turn on gps (even the non assisted gps) option without making you agree to data collection. It does work without a data connection but I assume they store the data till the next time you get Internet.

Edit: I read a bit about this. There is something called Google location history. It's on by default and tracks and reports your location to Google. You can turn it off (it's a bit non-obvious but not very much so). The wording is "Places you go with your devices will stop being added to your Location History map". So there, "tracked by default".

<comment><USER12> Not true.

The data collection is active only in 'High accuracy' and 'Battery saving' modes. Both these modes are services, the phone asks Google servers "I see wifi with SSID ABC and MAC 0:1:2:3:4:5, where am I?" or "I see celltower of provider 0123, with id 456, where am I?".

In 'Device only' mode, your location is determined purely by the device hardware. If anyone, it's Qualcomm who knows about you, due to AGPS request.

Then there is a separate service, Location History, that can be turned off.

<comment><USER10> >Then there is a separate service, Location History, that can be turned off.

Yes, exactly as I mentioned. And it is on by default.

<comment><USER12> It's turned on or off based on your choice in OOBE wizard. At least on Nexus and Sony devices, other vendors may do something else.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> From [https://www.reddit.com/r/sysadmin/comments/44i7xk/windows_10...](https://www.reddit.com/r/sysadmin/comments/44i7xk/windows_10_enterprise_still_talks_constantly_to/)

> _The_ only _way to turn Telemetry data full off is to use Local or Group > Policy (and an Enterprise SKU, to be fair), as documented by Microsoft > publicly. You cannot disable telemetry using the UI in Windows._

It's a very good read in general, have a look.

</comment><comment><USER14> Strangely, I decided to lock down my Win10 Pro machines earlier today after seeing telemetry traffic reported by GlassWire.

I ended up using O&O ShutUp10, a free app with a simple on/off interface for a bunch of Windows privacy-related settings, including telemetry.

There are other apps, and ways to block specific domains and IP to prevent Windows from calling home. It's staggering to see just how many part of the OS actually report information.

Some references:

[http://answers.microsoft.com/en- us/insider/forum/insider_win...](http://answers.microsoft.com/en- us/insider/forum/insider_wintp-insider_security/how-to-block-spying-telemetry- services/0f104191-c329-4bd4-83d7-60390f2aa5eb?auth=1)

[http://superuser.com/questions/972501/how-to-stop- microsoft-...](http://superuser.com/questions/972501/how-to-stop-microsoft- from-gathering-telemetry-data-from-windows-7-8-and-8-1)

[http://www.majorgeeks.com/files/details/destroy_windows_10_s...](http://www.majorgeeks.com/files/details/destroy_windows_10_spying.html)

[https://www.oo-software.com/en/shutup10](https://www.oo- software.com/en/shutup10)

</comment><comment><USER15> Would be interesting to see which process tried to open the connection as well. Does he have Skype installed? Is MSN Live tile enabled?

Some of these could be Windows checking if it is connected to the internet, NTP, malware filters, certificate revocations, windows update, ...

You can't really expect to install a computer switch off one setting and expect it to not connect to anything in 2016.

<comment><USER16> You can do this in Windows firewall by enabling logging for all allowed connections.

<comment><USER17> Yes, but isn't that basically letting the fox guard the hen house? If you already don't trust Microsoft based on articles like this, depending on Microsoft's firewall is not really a logical choice.

For what it's worth, I have Windows 10 Home and Pro as well as Windows 7 on several machines, and according to my router Windows 10 is only slightly more talkative than 7. I think that is mostly the Windows Store and Cortana stuff. The dreaded telemetry from 10 has already been backported to 7 and 8/8.1, so it's better to say "Windows tracks you" rather than "Windows 10 tracks you".

<comment><USER12> With Windows 7/8 you can opt to not install telemetry updates.

With Windows 10, you cannot avoid that.

It even highlights separate issue, that automatic forced updates are a bad thing.

<comment><USER17> > _With Windows 7 /8 you can opt to not install telemetry updates._

For now, yes. In the future that may change, just as it did when the Windows 10 update changed from "optional" to "recommended" and the installation began without user interaction.

When you combine that with Microsoft's truncated support life cycle for 7 and 8.1, you end up feeling forced to move to 10 one way or another. I'm not saying that Windows 10 is a bad OS (indeed, I enjoy it on my gaming PC and my Stream 7 tablet, and it has been a huge performance boost to my wife's PC and laptop). I'm just saying that any pretense of "Microsoft would never say one thing and do another" is null and void at this point.

<comment><USER12> That's the danger of automatic updates.

I used to have strictly manual updates set up. Yes, past time. One day I've had to hide KB3035583 one time too much, so now I'm getting used to El- Capitan.

</comment></comment></comment></comment></comment></comment><comment><USER18> As a comparison, it would be interesting to see what kind of traffic a clean install of Windows 7 or Windows 8 generates.

<comment><USER19> Data from OSX and some popular Linux distros would be good to see as well.

<comment><USER20> I block all outbound traffic on several of my CentOS 7 boxes and have logging rules just before the reject rules. I get zero hits.

This includes 2 workstations. In fairness, my /etc/resolv.conf points to recursive cache servers on my vpn, but I do log all my DNS queries. The only log entries are for things I ask for and Firefox trying to dial home.

</comment></comment></comment><comment><USER21> This is pretty weaksauce. You can get all the open sockets in like 10 seconds. Besides, all of these IPs have been out there ever since W10 came out. How about an actual analysis of what data is being gathered, what data is sent, and what settings affect it?

</comment><comment><USER22> It would be overwhelmingly more interesting to see the contents of these 'telemetry' packets. Has anyone sorted out how to do that yet?

A side-effect of being able to view the 'telemetry' packets is that one could also modify the packets on the way out.

<comment><USER23> I'd bet a lot of it is encrypted. The flip-side of having security. Remember the "smart" TV spying a few years ago that was discovered only because it was doing it in plaintext?

[http://arstechnica.com/security/2013/11/smart-tv-from-lg- pho...](http://arstechnica.com/security/2013/11/smart-tv-from-lg-phones-home- with-users-viewing-habits-usb-file-names/)

With encrypted connections, you won't know what data it's sending, and if MS's treatment of security in other areas in previous versions of Windows is any indicator, the certificates will also be hardcoded so it's very difficult to MITM. Good for stopping everyone else from spying on you, but really bad when it stops you from knowing what data your own machine is sending.

<comment><USER24> Did anyone tried to MITM a Windows 10 install e.g. with adding his own cert to the certstore?

Edit: Found this: [https://systemoverlord.com/blog/so-is-windows-10-spying- on-y...](https://systemoverlord.com/blog/so-is-windows-10-spying-on-you/)

</comment></comment></comment><comment><USER25> I can't see an _analysis_ of this, just a huge list of IP addresses? We need to know what the actual content is and from what Windows components it's being sent.

</comment><comment><USER16> AFAIK setting Windows firewall to deny all outgoing and then manually whitelisting apps you use cuts all(') logging. Microsoft would be crazy to punch backdoor holes in its own firewall, it would probably kill enterprise market.

' maybe almost all, you need DNS. I dont know any way of letting applications use DNS selectively, its all or nothing :(. This forces you to let svchost.exe talk outgoing 53 udp.

<comment><USER26> That is putting a lot of faith in both Microsoft and the windows firewall, which has historically been very weak. Microsoft has also indicated that they're not adverse to bypassing users' obvious attempts to protect themselves from spying, for example: bypassing hosts file entries for telemetric data exfiltration. So while the firewall might work today, there is absolutely nothing preventing a future update from silently changing the rules of the game.

<comment><USER27> I think if that is your level of concern, you have to not use Windows, not try to patch over their control of the firewall.

<comment><USER28> Presumably Microsoft are worrying by now that corporate customers with knowledgeable IT departments will reach exactly that conclusion.

<comment><USER27> Wouldn't those users tend to have a hardware perimeter that they could use to verify the behavior of Windows?

Also, I think if Microsoft is actually worried about losing those users, it would choose not to subvert the firewall.

<comment><USER28> I suspect the problem will be if they have independent security tools near their network edge that MITM their own traffic, as discussed elsewhere on HN recently. If Microsoft are hard-coding addresses and certificate details for its online services within Windows itself, the security tools won't be able to inspect that traffic, and will probably be set to block it by default.

I suspect the kinds of organisations operating these tools would consider that "working as intended" in most cases, but if it interferes with the enterprise- grade configuration and update management tools then that could be an issue for them.

<comment><USER27> My point was that they will be able to detect if Microsoft is subverting the Windows Firewall, trivially. So it would be incompetent for Microsoft to subvert the firewall and expect those users not to notice and incredibly foolish for Microsoft to do it if they think those users will object by moving away from Windows.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> It might not be so difficult to just patch this stuff out, but the biggest problem is the automatic updates which could replace your changes. If someone eventually finds a way to allow updates and automatically merge them in with the local changes, that would be very highly appreciated for all those who are forced to use Win10 for other reasons but do not want this behaviour.

<comment><USER29> The Tron project (reddit.com/r/TronScript) has integrated Telemetry removal and disabling, seems to work pretty well.

<comment><USER30> Uhh that script is horrifying. It is from the same Cargo cult technical support personnel that run stuff like CCleaner, BleachBit, and memory cleaners. Just go look at the script itself and the supporting scripts, if nothing else they make a lot of assumptions about what the end user does or does not want, and it reconfigures the machine in such a way to disable legitimately useful functionality.

<comment><USER23> _if nothing else they make a lot of assumptions about what the end user does or does not want_

If anything, _Windows 10_ makes "a lot of assumptions about what the end user does or does not want"... and that script is just a _different_ set of assumptions, perhaps ones that users would agree more with.

You could argue that _anything_ is "legitimately useful functionality", while someone else would say it's privacy-invading spyware.

<comment><USER31> Which one would you rather debug, as an end-user or support technician? The options set by Microsoft, or the options set by an opaque tool from some third party? There will be a lot more community support for fixing those issues caused by Microsoft. The issues caused by the third party tool are way more likely to harder to find discussion on and solutions of

<comment><USER29> Definitely not an opaque 3rd-party tool. Tron's not opaque at all though, it's open-source on Github under the MIT license.

</comment></comment></comment></comment></comment></comment><comment><USER32> Very interesting. I too have been struggling to find decent analysis on W10's telemetry features. While not everything on his list is specifically telemetry, it certainly shows you the shift from "give the user full control" to "be convenient at the cost of privacy" (to put it nicely).

</comment><comment><USER33> Would results differ much between local and MS account ?

</comment><comment><USER34> Slightly off topic: How is voat .co able to copy reddits design almost 1:1 without being buried under a mountain of expensive lawsuits?

<comment><USER35> Wow, I didn't notice I wasn't on Reddit. The only thing I noticed was that it loaded more posts after scrolling to the end.

<comment><USER36> Interestingly, on mobile it's about 10x better than than viewing reddit on the same device.

</comment></comment></comment><comment><USER37> > For this analysis, I wanted to simply analyse the network traffic of Windows > 10 on a clean install, and just let it sit and run without using it.

Ha. So if Windows 10 was designed by a VW engineer you could expect it to behave perfectly reasonably.</comment>


Start up now...not - <AUTHOR> http://www.madeisgood.com/blog/?p=27

<comment><USER2> Timing is interesting. Assuming things are cyclical, you're coming out of your startup phase of business into a growing / booming economy on the upswing. So the companies that survive the recession period during their infancy have an awesome economy to grow into.</comment>


This CEO is democratically elected – his staff can fire him once every year - <AUTHOR> http://uk.businessinsider.com/haufe-usa-democratic-workplace-ceo-fired-2016-8?r=DE&IR=T <comment><AUTHOR> Does anyone know or been part of any other company that has run like this (maybe instead of CEO, it's the VP of Product or some other position that is democratically elected)? Thought this was fascinating and prompts the question of why aren't companies more democratic in nature (note, this is for late- stage companies where business risk has been reduced, not your early-stage startup).

I wasn't in love with the one-year term limit and think it should be a lot longer (like 3-5 years). There is also the risk of losing a very long vision (think 10+ years) because of this process, but perhaps you can mitigate that by having candidates address it explicitly while "campaigning". I would even introduce elements such as having debates and town halls.

Interesting to think about regardless!

</comment><comment><USER2> All CEOs are democratically elected. Shareholders vote on Board Members, and then Board Members vote on CEOs.</comment>


Fundraising Advice for YC Companies - <AUTHOR> https://blog.ycombinator.com/fundraising-advice-for-yc-companies <comment><USER2> One thing I think might be important to distinguish is how different companies coming out of YC (and not in YC) are in different stages. No matter how many times the partners told our batch to not compete over valuations, it still happened. Personally I felt like without a competitive price tag, we wouldn't be looked at as a promising company even though we had less traction than other companies. We had a (rightfully) pretty lame raise after YC. I think one thing that might help is to be explicit with the companies, give them some idea of what their perceived stage is and what valuation range would be a good place for them to start.

<comment><USER3> what's a "competitive price tag" for a "pretty lame raise" mean in valuation for you? I was shocked to see the article say:

>I'd close the first, say, $200k from the first reasonably good investors that offer it on reasonable terms--say a $5 million pre-money valuation or higher. This removes some uncertainty and pressure, gives you capital to execute with while raising the rest of your round, puts you in a stronger position, etc. _It 's worth a discount for all of this._ (Emphasis added.)

Which means that a $5M seed-stage is a 'dicount'! (The true price would be at a higher valuation.) That is a shocking phrase to use, when selling a company for $5M outright is a pretty good outcome for 95% of people who create a company in the tech space.

<comment><USER4> An investor buying $200K preferred equity at 5 million pre is not implying that investor would buy the entire company for 5 million cash. The preferred equity makes high valuations possible as the first $200K goes back to the investor.

<comment><USER5> it's kind of a nuance, but an early stage investment is a bet on the founders/core team as much as it is on the idea. so you want the founders to retain significant equity (i.e. not purchase outright) to align the incentives.

</comment></comment></comment></comment><comment><USER6> > It's important to articulate why the company will eventually be in a > strategically valuable position (i.e. a monopoly).

Is it possible to ever answer this in a meaningful way, besides "we're going to be the best and get mindshare and beat everyone out of the market"? Anyone have examples, or care to imagine what the answer would have looked like for those few companies that DID go on to dominate a market?

I guess if your product has vendor lock-in or network/virual effects then you're in a better place to answer it well (?).

<comment><USER7> Imagine Slack's answer to this, which is "network effects within teams and, more subtly, between teams. Slack will be proposed by your engineering team because their OSS projects use Slavk, their conferences use Slack, their last client used Slack, etc. Then after your entire corporate brain uses Slack for its synapses we, not to put too fine a point on it, own your soul."

<comment><USER6> Ok, but slack is just like campfire/hipchat/yammer/etc and none of those have come close to the outcome you're proposing. So what does "your" product, Slack, plan to do to actually achieve this, besides just being better than the rest?

<comment><USER8> How is "just being better than the rest" not a good enough answer? Better marketing, better features, better marketing, better _marketing_ (!!!). Better than the rest, but what more do you need to be better at than convincing more people to use it? That's what makes a monopoly.

<comment><USER6> Obviously if you can pull it off then you're golden.

But we're discussing the early pitch here. It's not enough to say We'll do the same as product X but BETTER. That's totally generic and not a plan.

So there has to be SOME insight at least on what might constitute "better," and then how to translate that into market dominance.

</comment></comment></comment></comment></comment><comment><USER9> I really appreciate that a document like this is public. It would be very easy to send this out via private email list or internal wiki. Cheers for sharing!

</comment><comment><USER10> I know this is probably covered in day-to-day conversations with founders at YC, and this email is about raising funds... but, I'm astounded there is not a single word in here about building a business to be profitable, or to "polish up the business plan" ready for investors to review.

Or put another way - with all the issues documented (and probably over-blown) in the media regarding the current fund raising climate, is it truly good advice to just give a suggestion to "3) You should raise enough money to get to your next significant milestone.".

Surely developing the business case and reaching profitability should rate a mention somewhere when it comes to giving out fund raising advice, particularly when this is being released publicly for budding entrepreneurs not part of YC? And even more importantly because investors will be motivated to use this current climate as an excuse to negotiate harder than usual and get more stock for less money?

<comment><USER11> YC is still YC. Investor's come to YC to win, and win big. They want to see companies shooting for the moon, not worried about profitability 12 weeks in.

<comment><USER12> Can't you do both?

<comment><USER13> 12 weeks in validates a market.. and proves you're easily displaced

<comment><USER14> May not matter if there's cash to make off with. Plenty of folks don't care about long-haul world domination or owning a market; if being a Significant Player for 3 years will earn them enough to retire, why not?

<comment><USER13> That's fine for you and many others. However, it's an anti-pitch for a YC company: demo day is really auction day. They're selling a chunk of themselves to an institutional investor sifting for disproportionate returns.

</comment></comment></comment></comment></comment></comment><comment><USER15> > I'd close the first, say, $200k from the first reasonably good investors > that offer it on reasonable terms--say a $5 million pre-money valuation or > higher. This removes some uncertainty and pressure, gives you capital to > execute with while raising the rest of your round, puts you in a stronger > position, etc. It's worth a discount for all of this.

Wow 5MM pre-money for seed is considered reasonable (and considered a discount) nowadays? Or have I misinterpreted?

<comment><USER16> [https://angel.co/valuations](https://angel.co/valuations) shows $6.5m average for YC, $6–8M 25 th / 75 th (does not include valuations over $10m).

</comment></comment><comment><AUTHOR> > It's important to articulate why the company will eventually be in a > strategically valuable position (i.e. a monopoly).

I find it interesting, and disconcerting, that articulating a defensible competitive advantage is no longer sufficient advice. Now it's, "can you be a monopoly? no? go home". I realize this is a good way to maximize value for investors, but is this a healthy way to grow new companies and build a better society?

<comment><USER17> I think they're using the Peter Thiel version of the word, not the traditional economics version of the word.

For example, while Facebook, Apple, Google, and present-day Microsoft all are not strictly speaking monopolies (they have viable competitors) -- they each have various features that make switching difficult (but not impossible).

<comment><USER18> > I think they're using the Peter Thiel version of the word, not the > traditional economics version of the word.

Which is a poor way to communicate a point when the widely considered definition of one of your words doesn't match the one you're articulating. It assumes everyone has read Peter Thiel's book (ps - everyone has not).

It's the same with the word "startup". For a majority of the world a startup is business that has just started, but for YC (well, pg specifically[0]), the definition is "A startup is a company designed to grow fast" and more specifically notes "Being newly founded does not in itself make a company a startup". The definitions are not only considered inconsistent but they're explicitly inconsistent.

Communication is important and this is one of those instances where I think many people might scoff at the notion that YC is building monopolies and that's "bad".

[0] - [http://www.paulgraham.com/growth.html](http://www.paulgraham.com/growth.html)

<comment><USER19> Maybe a clarification is in order. BUT, this is YC's attempt to make their advice available to the broader community. If you're interested in YC and listen to their advice, you will likely have heard about Peter Thiel's monopoly (see Sam Altman's "How to Start a Startup" series w/ Peter Thiel otherwise).

I'm just happy they're making this advice available.

EDIT: Here ya go [https://www.youtube.com/watch?v=-oKjLVECMKA](https://www.youtube.com/watch?v=-oKjLVECMKA)

</comment></comment></comment></comment><comment><USER20> > "so far we haven't seen nearly as much of an effect on early-stage > fundraising as the level of press coverage would seem to indicate"

This is pretty interesting to me. I wonder if the press is just blowing things out of proportion, or if there's some Big Money™ behind this so that investors can convince companies to agree to worse terms.

<comment><USER21> It's the unicorn crash. It's mostly affecting later stages of hugely valued companies. So far the impact in the seed and A markets and more reasonably valued companies is minimal.

Whether that changes depends on a bunch of factors. The two biggest are the overall health of the economy and how economically incestuous high-tech has become. If write-downs and possibly failures among the unicorns trickles down a _lot_ to smaller ventures and investors, it will get worse. Otherwise it will be mostly isolated to that segment of the market.

Edit: check the other response to the parent-- looks like we might indeed be seeing a pullback in angel/seed.

</comment></comment><comment><USER22> This seems like the same advice YC has been giving for years minus the fact that the market seems to restricting based on the unicorn mess happening which is ultimately probably a good thing in the long term to avoid a bubble and a later collapse. Maybe I've missed the difference between this and the message they had been saying for years now. Though this does seem very solid and something not just YC companies should aim to do. Picking good investors is much more valuable than having a lot of money. Bad investors will give you a lot of money to spend on whatever they tell you spend it on, sometimes good sometimes bad, whereas good investors will give you a little less money and give you the freedom as the founder who may know best to spend it on what you think is best in the long run with some guidance.

</comment><comment><USER23> Question for Sam -- How do you raise the first 200K at a different valuation without significant extra cost and hassle? I'm guessing it would be a SAFE or convertible note, in order to avoid issuing such a small amount of equity.

<comment><USER24> Yes, the SAFE is designed to make seed funding very cheap, easy, and fast (and it has proven very successful at doing so).

<comment><USER23> And the 5MM valuation refers to the cap?

<comment><USER24> Yes

</comment></comment></comment></comment><comment><USER25> I love this article, but would love to see some Marketing advice for YC companies....

<comment><USER26> Probably the single best essay on startup advice that has ever been written: Jessica Livingston: Why Startups Need to Focus on Sales, Not Marketing

[http://blogs.wsj.com/accelerators/2014/06/03/jessica- livings...](http://blogs.wsj.com/accelerators/2014/06/03/jessica-livingston- why-startups-need-to-focus-on-sales-not-marketing/)

<comment><USER25> thanks

</comment></comment></comment><comment><USER27> Missing from all of this...

Hey, you may not be ready to take investor money and that's completely fine. Maybe you've realized you'd rather have a bootstrapped business instead of a unicorn. Cool, actually think about what taking investor money means. Figure out what's best for you and your team.

<comment><USER28> To be fair, this letter was targeted at companies in the current YC batch. They've already explicitly opted-in to going the venture route, at least in some capacity.

Bootstrapped businesses can be awesome; I've built a couple myself. But the time to be asking these sorts of existential questions would be before you take VC money, not after.

<comment><USER27> For a group that focuses primarily on young, inexperienced founders and is so founder focused, I think it would be reasonable to expect them to allow for founders to take the exit ramp if they decided the VC route didn't make sense for their business based on their YC experience.

</comment></comment></comment><comment><USER29> As an employee how can you get these details? and how should you act once you have the information?

<comment><USER30> As an employee, you probably aren't the one fundraising.

<comment><USER29> Yes, what I was implying is - based on the result of the fundraising what point of action should an employee at an early stage start-up take considering the current climate. Or what questions should you ask the founders.

<comment><USER31> Just ask the founders what you want to know. No need to play mind games or whatever, tiptoeing around what you actually want to know.

If you're at an early stage startup and you don't get a satisfactory answer, you need to leave.

</comment></comment></comment></comment><comment><USER32> This post tell us how undervalued Swedish startups are. We created the term `Swedish series A` a while back, which is around ~$1m - $3m. Interesting that this a seed round elsewhere. High tax and all.. :)</comment>


Is Silicon Valley Doomed to Become the Next Detroit? - <AUTHOR> https://www.fastcompany.com/90201098/is-silicon-valley-doomed-to-become-the-next-detroit <comment><USER2> No. SV has gone through many a boom-bust cycle.

From chip companies to dot-coms, from infrastructure software (Cisco etc) to the app economy. If there's one thing going for SV, it's the constant reinvention of itself and the markets</comment>


Ask HN: Need an attorney for my startup - <AUTHOR>

I just incorporated my startup and I'm looking for an attorney to help with corporate-related issues such as:<p>- issuing stock - making sure my corporation is in order (tiny as it may be at this point) - patent searches - corporate taxes/state sales tax - terms of service<p>I don't have any idea where to start other than google. Thanks for any recommendations.<p>(edit; I am in the US, in the rural Midwest, and it's fine to deal with someone out of state. The business is incorporated in DE and is physically in OH.) <comment><USER2> I have worked with HN user grellas ( [https://news.ycombinator.com/user?id=grellas](https://news.ycombinator.com/user?id=grellas) ) on a professional basis for a startup acquisition and I recommend him. He is based in the Bay Area, but I was not, and things worked fine with him and his team over phone and email.

<comment><AUTHOR> Looks very promising - I will check him out.

</comment></comment><comment><USER3> not sure if it helps, but have you try lawdingo?

<comment><AUTHOR> I will check them out - thanks.</comment></comment>


Dynamic URL shortener with rule based traffic routing - <AUTHOR> https://linkredirector.com

<comment><USER2> Can be used to direct link apps in multiple app stores.</comment>


Step-by-step JSON client/server tutorial in Rust - <AUTHOR> https://github.com/brson/httptest

<comment><USER2> Not a knock against Rust or the lib or the example but I've always hated the technique of naming a function with a verb but that function only constructs an object. For example, one would think that get() "gets something" but it appears to construct an http request object that you call send() on.

        let mut res = client.get("http://localhost:3000/").send().unwrap();

Unless you have some experience with creating routes, you can't immediately tell what the following does:

        router.get("/", hello_world);
        router.post("/set", set_greeting);</comment>


The New Hacker Hobby That Will Change the World - <AUTHOR> http://www.technewsworld.com/story/70314.html?wlc=1278133428 <comment><USER2> Ex-bio engineer here. I do not think the DIY bio community exists or will ever gain traction. For one, I don't understand how someone could do labwork in their garage. Two I don't understand how people could afford mandatory tools like PCR machines. Three, the results from your labor don't seem tangible or exciting. At least with the computer hacking movement in the 60s and 70s you could hold a computer in your hand, you could see improvements in speed and performance as you tinkered. When programming, the output of your code would be realized relatively quickly. Bio is too complicated, too tedious, and too expensive to ever be fun or support a hacker community.

<comment><USER3> Ex-plugboard operator here. I do not think the DIY computer community exists or will ever gain traction. For one, I don't understand how one could build a computer in their garage. Two, I don't understand how people could afford mandatory tools like hard vacuum pumps and tungsten furnaces. Three, the results from your labor don't seem tangible or exciting. At least with the car hacking movement in the '20s and '30s you could go for a drive around the town, you could see improvements in speed and performance as your tinkered. When doing mechanical work, the change in the sound of the engine would be realized as soon as you released the choke. Computers are too complicated to wire, too tedious to replace dead tubes and too expensive to ever be fun or support a hacker community.

<comment><USER3> Ex-engine mechanic here. I do not think the DIY car community exists or will ever gain traction. For one, I don't understand how anyone could build a car in their garage. Two, I don't understand how people could afford mandatory tools like a boiler welder or a metal lathe of required tolerance. Three, the results from your labor don't seem useful or safe. At least the the electric light movement in the '90s and '00s you could replace a dangerous and unreliable flame with a modern Edison Lamp. Why, you realize the benefits as quickly as you can toggle the switch lever. Steam engines are too complicated to tool, too dangerous to operate and too expensive to ever be fun or support a hacker community.

<comment><USER2> The difference between BioE is scale. Both cars and computers were built from large objects you could hold in your hand. BioE is at the nano and micro scale. Bio work requires a sterile environment, expensive hard to obtain chemicals, and fancy machines like atomic microscopes. In my mind Biohacking is as far fetched as nano-engineering and time travel.

Full disclosure: I have an undergraduate degree in bioengineering from 2008. I did a lot of lab work, but never worked in industry. I've went straight into web apps after graduating.

<comment><USER3> Everything becomes more convenient and cheaper with time (barring cataclysm). And just because something is a "large object" does not mean there is a huge amount of precision work involved.

I'll give another example. A telescope is big. But good luck grinding the mirror. You can do this by hand, by the way. To within a tenth of a micron. The really good guys actually do the final "grinding" with their bare thumb.

At one point, being an amateur astronomer required building your own telescope, entirely by hand. I have books that go through everything from grinding your own 6" mirror to making an equatorial mount. Then in the mid 1950s, companies started making decent small astronomy scopes. Oddly enough, a 6" scope today has the same price as a 6" scope in 1955 ($450), but that inflates to $3600 today.

Not too long ago I picked up a shoddy 4" scope for $10 at a yard sale. This would have been the worlds largest telescope, if you went back in time to 1800. How is that for progress?

The paraphernalia required to do professional work is always getting cheaper and easier to operate. Bio seems to be in a similar state as astronomy in 1930. The pros are using their huge 100" scopes on mountaintops. The amateurs are using homebrew 6" scopes. You've used the real deal, but that does not mean there isn't a lot of virgin territory within the reach of an amateur.

</comment></comment></comment></comment></comment><comment><USER4> Paraphrasing Feynman: "I believe that a hacker looking at nonhackerish problems is just as dumb as the next guy." The level of ignorance revealed in most comments on this post so far is somewhat shocking. Michael Nielsen once mentioned that HN'ers could be incredibly arrogant when treading outside of their area of expertise, and this is all the proof one needs. Either that, or Biology gets all the HN simpletons out of the closet.

<comment><USER5> Yeah, I haven't wanted to reach through the internet and smack so many people since the last time I read the comments for a YouTube video.

I suppose they deserve to know why they're wrong though. For starters the article isn't saying anything beyond the fact that there are people who buy used PCR machines and run reactions in their basement. Now, I think that's pretty cool, but nothing meaningful is going to come of it. There are a few reasons for this:

1) Biological Research Is Expensive - Setting up a real lab so you can do the basic stuff like running gels and western blots is going to cost somewhere around $100,000. Note that this isn't like buying a computer where once you pay for it you're set. Actually performing an experiment can cost hundreds of dollars for reagents alone.

2) Biological Research Requires Oversight - If you're going to work with radioisotopes, or toxic chemicals, or animals you need permits that are not offered outside of an academic or industrial setting. Two of the basic techniques of molecular biology, northern blots and southern blots, use radioactive reagents. I'll grant that there are alternatives that use fluorescence, but they're expensive, and aren't widely used.

3) Biological Research Is Tedious and Slow - I think part of the reason computers took off so quickly is that you can run a program and get quick feedback on whether or not it worked. Most of biological research is not like that. In graduate school I worked on genetic modifications that hypothetically extended the life spans of fruit flies. In order to see if a modification worked, I had to assay their life span over a hundred days. I'd normally be incredibly excited about getting the result on day one, but by day forty my interest was mostly exhausted. Biology doesn't give you the instant thrill of knowing a piece of code worked, which is one of the reasons it's not going to take off like personal computers did.

I'm not going to single anyone out, but if you've been making comments in this thread there's a high probability you have no idea what you're talking about.

</comment></comment><comment><USER6> Wow - I'm really surprised at the polarization of the comments here. Seemingly, there are only Drexlerians with replicator futurism or old guard skeptics. This truth certainly lies somewhere in between.

For instance, is cloud-based synth/analytics really that far fetched / impractical? For example, have you seen the automation we're seeing with microfluidics?

<http://microfluidics.ee.duke.edu/>

Are you saying that hackers can't order biological systems the way we order custom circuit boards today? The means of production are comparatively high - yet it's very cheap to make them.

Techno skeptics love to say "why would". Futurists like to say "what if". The correct response is probably "how can".

</comment><comment><USER7> My prediction: as soon as "DYI Bio" begins to have any real-world impact (or gets enough publicity), it will be banned/heavily regulated, at least within the US. It is too easy to come up with alarming scenarios if an accident happens or if the technology gets misused (which fits in very well with the current anti-terrorism rhetoric). Also, many corporations will not welcome the lack of control over some of the technology that a successful DYI Bio movement would bring, so they will lobby for "protection".

</comment><comment><USER8> It is a bit sad to think that the first thing people think of is how impractical or malicious these ideas can be. How about instead of pure biology, it turns out to be a mesh of several fields? Photosynthesis + energy breakthroughs (custom designer plants for home decoration? grow your own furniture?), biological computing, or biomechanical machines...

</comment><comment><USER9> Hobbyists making homebrew viruses. What could possibly go wrong?

</comment><comment><USER10> I created a thread <http://news.ycombinator.com/item?id=1483783> to try and get a list of synthetic bio startups. If you know one/work at one, would be great to hear about it!

</comment><comment><USER11> The real question is: what will biology be able to do that computers arn't able to?

Back then the real alure was that computers could compute things amazingly quickly, and later, that through the internet, we could organize information on computer networks. And that everything could scale really quickly.

We may be entering an era of basement labs, but that doesn't mean that these breakthroughs will necessarily be life changing.

IT is working on the problems of organizing people and information. This will likely produce many more people working on solving human maladies. But all these things being done in basements without any regulation or standards may lead to some health risks for first movers.

<comment><USER12> I estimate the demand to be about one or two microbes world wide.

<comment><USER13> This kind of answer distracts from the honest and interesting question that thefool poses:

      The real question is: what will biology be able to do that
      computers aren't able to?

If you asked that question about carbon nanotubes ten years ago, I could have answered that question and I think many people would have been interested in the answers, as the ideas and speculations on the subject wouldn't yet be widely known. In the same way, I would really like it if someone knowledgeable answered this question: what actual things are thought to be feasible through tailoring micro-organisms?

<comment><USER14> This chap's fairly knowledgable... <http://www.youtube.com/watch?v=hHL7Drfj0B0>

</comment></comment></comment></comment><comment><USER15> Ok, interesting... So where are the links to these online communities of thinkerers? We heard about this many times over the last few years but I'd be curious to see what exactly is done.

<comment><USER16> <http://diybio.org/>

<http://groups.google.com/group/diybio>

</comment></comment><comment><USER17> Wetware is a much more dangerous game that's why doing any kind of biological research involves working in some big lab with tons of cash flow and management personnel that have connections to health organizations and various government oversight committees. A runaway biological virus is much more dangerous than a runaway _computer_ virus so I'm not expecting an emergence of the biological valley any time soon.

<comment><USER18> It is far, far more easy for a malicious person to intentionally create something "bad" than for a good person to do it by accident. That said, a malicious person would not be able to create something "bad" without a tremendously large amount of funding and manpower.

So lets imagine a malicious person with funding and manpower turns up: Sure, totally synthesised genomes will turn up and you will be able to email some guy who generates your operon to stick into whatever, so the barriers of entry for a bio-terrorist will be lowered somewhat; but even then the knowledge of how to create a killer virus will be scarce.

And after 20+ years of gained knowledge, once a billionaire Bond-villain with a fortress of henchmen* has made a killer virus, it is tricky to imagine it out-competing any virus created by nature's hands - she had several million years worth of head-start and a hell of a lot more funding.

So, yes, it is very unlikely, but still possible. However, if you were going to go to all that work to spread some virus, I would strongly recommend that you just learn to make nukes instead. They are much more reliable, predictable, and will have less fallout for you to worry about.

*Although a Government could much more probably fill this role.

</comment></comment><comment><USER19> 'lack of standardization of bioparts...'

Heh... I wonder what will play the same role as SCSI this time around...

<comment><USER4> <http://en.wikipedia.org/wiki/BioBrick>

<comment><USER20> My understanding from talking with people in the field is that BioBrick parts aren't nearly as turn-key as could be hoped. I'm sure that over the next decade or so, they'll get much better, just as computer technology did, but they aren't there yet.

<comment><USER18> Frequently bricks aren't compatible or affect the expression of other bricks in a totally unpredictable manner. The only way of guaranteeing a working biobrick made of many biobricks is to combine as many combinations of biobricks-which-do-the-same-thing as you can find, and use the ones generating the best gene expressions. Even then you might want to take the best 3 or 4 as they will behave differently when combined with other bricks.

</comment></comment></comment></comment><comment><USER21> Very cool, but a little scary to ponder what could happen when Fluffy Bunny gets ahold of a DIY genetic engineering kit.

</comment><comment><USER22> For those who understand German: Podcast about biohacking: <http://chaosradio.ccc.de/cre143.html>

</comment><comment><USER23> I bet 90% of thes "basement labs" are just covers for manufacturing meth. Biology is too expensive, and if you want to pursue synthetic biology you can get well funded to do so by the NIH. You don't need a big corporate lab, you just need to go to grad school.</comment>


Show HN: Micro web framework for low-resource systems – live example on ESP8266 - <AUTHOR> http://www.ureq.solusipse.net <comment><USER2> Whoa nelly! This web site is running entirely on an 8266, responds instantly, and is handling the kiss of death associated with HN linking with no problem. That is _amazing._

<comment><USER3> this kind of thing gives me hope that Google could be replicated on a low budget

<comment><USER4> I guess, when they come out with microengineers.

<comment><USER3> I was thinking mainly of infrastructure...

</comment></comment></comment></comment><comment><USER5> this is indeed probably the best low-cost wifi chip out there, most of the esp8266 modules are still acting as an add-on module for other host-cpus(e.g. arduino) though, wish it can run something like freertos or contik on its own so it can be a IoT sensor standalone(maybe it's there already, had not checked it in the last few months).

TI had similar products but it's too expensive, in that sense IoT hardware has to be 'made-in-china'

<comment><USER6> There is a firmware to run lua directly on the esp8266: [https://github.com/nodemcu/nodemcu- firmware](https://github.com/nodemcu/nodemcu-firmware)

<comment><USER7> I have been messing with nodemcu on an ESP8266 ebay board for the last few weeks. It was initially really weird to have a REPL on an embedded system but I'm already missing it when I go back to other platforms.

</comment></comment></comment><comment><USER8> i am continuously impressed by the esp8266. i have been building things on and off with them for the last couple of months, and bought enough of them to give out.

at less than $2 each, they really are amazing.

<comment><USER9> I bought one as well although I didn't do anything yet, would you mind share what you did/recommend doing? I was thinking to make a temperature sensor monitoring device, as I have an arduino that is doing the job now

<comment><USER8> a temperature sensor was actually my first use of it (and i will continue to build a couple as remote sensors) - basically, i've been adding more and more sensors just to see how much it could take.

now, i'm having to build out PCB's to support everything (including the voltage regulators to 3.3v and 5v), as i've outgrown breadboards.

<comment><USER9> Thanks, that is my plan too, add as many sensor as I could! For the moment I have a microphone, a water level and a couple of temperature sensors waiting for a microcontroller.

Could you link a couple of links to resources you found useful? I haven't look at it properly but when I try to search I was a bit confused and not sure on where to start

<comment><USER8> [http://www.esp8266.com](http://www.esp8266.com)

[https://github.com/esp8266/Arduino](https://github.com/esp8266/Arduino)

[https://github.com/cesanta/smart.js/tree/master](https://github.com/cesanta/smart.js/tree/master)

using the arduino environment, i had a circuit up reporting temperature in less than 5 minutes.

<comment><USER10> Hey @jerrysievert, this is Omer from Cesanta. Great to hear that Smart.js worked for you. Would you mind sharing a bit more on your project? I can be reached at omer at cesanta.com Thanks and best of luck!

</comment></comment></comment></comment></comment></comment><comment><USER11> For someone wanting to tinker but not being great at electronics project, what is the easiest way to: \- Play with the chip (testing interfaces, deploying code etc) \- "Deploy" it (ie. connect it to ground power, via 230v-USB connector or similar?

<comment><USER8> buy a huzzah from adafruit, it breaks everything out, and is much more tolerant than the board itself.

couple it with a small breadboard and an mb102, and you're good to go.

<comment><USER11> Thanks!

</comment></comment></comment><comment><USER12> >running at 80Mhz

160MHz [http://www.esp8266.com/viewtopic.php?p=8107#p8107](http://www.esp8266.com/viewtopic.php?p=8107#p8107)

also "Rebooting every 400 users" doesnt sound all that stable :)

<comment><AUTHOR> This reboot is forced, we had over 3k requests with no hanging of whatsoever. It just helps when traffic is huge. This particular chip (serving linked website) is running at 80Mhz.

</comment></comment><comment><USER13> Plus, running micropython this board rocks. Imagine a repl on the USB serial interface. My branch is rock solid posting millions of messages from python to a webserver.

</comment><comment><USER14> Awesome work! Looks like there's a great community growing around the esp8266. I'll need to check it out myself sometime.

</comment><comment><USER15> This is very impressive.

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER16> Wasn't this posted yesterday? I swear I saw it in the RSS feed.

edit: Yeah, [https://news.ycombinator.com/item?id=10369608](https://news.ycombinator.com/item?id=10369608) Weird, what's a repost invite?

<comment><USER17> We've been running a series of experiments to try to mitigate the randomness of what achieves liftoff from /newest. We started working on this because many users complained that good stories were getting ignored, and we looked closely and found that this was true. Below are links to a few comments I've posted about this over the last year, if anyone's interested. The next experiment will probably be to add a profile setting that people can turn on to let the software repost their story at a good time, rather than having to get an email invitation—although to judge from the feedback we've been getting, people seem to like the emails.

[https://news.ycombinator.com/item?id=9828818](https://news.ycombinator.com/item?id=9828818)

[https://news.ycombinator.com/item?id=8790134](https://news.ycombinator.com/item?id=8790134)

[https://news.ycombinator.com/item?id=9866140](https://news.ycombinator.com/item?id=9866140)

<comment><USER16> Cool! Thanks for working on making interesting stories more visible.

<comment><USER17> What would be awesome is if by doing this the community system gradually trains itself to post more interesting stories in the first place.</comment></comment></comment></comment>


Ask HN: How do you recover an account on Coinbase? - <AUTHOR> I registered an account on Coinbase over 2 years ago against an email from a company that used to exist. Since then, I lost the email address, because the company does not exist anymore.
For the last 12 months I have been ringing Coinbase monthly and submitting support tickets, only to be completely ignored because nobody gets back to me at all.
My estimate is the account probably has about $300 in it.
I have looked online and noticed hundreds of people with the same kind of experience - i.e. losing their 2FA or GA keys and getting locked out and ignored in a similar fashion.
Surely Coinbase is a ponzi scheme. Has anyone had any experiences where they actually managed to get a response from Coinbase support? Of course, what interest do they have in actually getting back to me. I don't think there's actually any law against ignoring me to steal my magic money. <comment><USER2> Let me get this straight:

You created an account with a company's details and now there is no trace of said company?

What information does Coinbase have to verify you have an account with them without company and email information?

<comment><AUTHOR> I created it with my own details.

But I was using some email address like email@example.com and then somecompany fizzled and we stopped renewing the expensive domain.

When you create an account, you verify your identity with your drivers license. I can just produce 100 points of said ID. This would be trivial if they would actually respond to any of my support tickets or international calls.

</comment></comment><comment><USER3> Register the domain for xx bucks and recreate your address?</comment>


Show HN: Trackingco.de, a fast, simple and cheap web analytics service - <AUTHOR> https://trackingco.de/ <comment><USER2> Is there really that big of a market for people who want web analytics but find Google Analytics too complex? GA has gotten pretty danm simple to use these days, the depth is there but they have gotten good and making it accessible.</comment>


Should Paraguay invest its energy wealth in Bitcoin mining or fighting poverty? - <AUTHOR> https://www.theguardian.com/global-development/2018/nov/05/should-paraguay-invest-its-energy-wealth-in-bitcoin-mining-or-fighting-poverty <comment><USER2> The article assumes that mining Bitcoins and fighting poverty are incompatible.

They have an excess of cheap electricity, and they don't know what to do with it. (And a bad electric grid.)

A good trick is to build a aluminum smelter because it use a lot of electricity. [In Argentina we have Aluar [https://en.wikipedia.org/wiki/Aluar](https://en.wikipedia.org/wiki/Aluar) They essentially have their own hydroelectric dam.] But for an aluminum smelter you need a lot of inversion, it uses some toxic material, and you need good fluvial communication (they probably have this part). It's not easy to build an aluminum smelter.

Another possibility is to mine Bitcoins. It needs a lower amount of inversion, and it has less logistic problems because you don't need a giant port to receive the bauxite and send the refined aluminum.

What is the difference between Aluminum and Bitcoins? You don't care is someone is willing to pay for it! (If you are a cryptoskeptic (like me), you can think that the Aluminium will be valuable for a longer time than the Bitcoins. But it is not important if you sell the production now.)

The solution for the poverty is to raise the prize of he electricity and use the additional money to diversify the industry in case Bitcoins implodes. (I doubt that the government plans are the best way to invest the money, anyway.) You can add some tax to the mined bitcoins, but it's almost imposible to check. So everyone will just not pay the tax. It's easier to raise the price of the electricity and perhaps add a discount for family houses small industries or whatever you like.</comment>


Speeding up Zsh and Oh-My-Zsh - <AUTHOR> https://blog.jonlu.ca/posts/speeding-up-zsh <comment><AUTHOR> If there's anything I've missed or if anyone has any tips on how to get it faster I'd love to hear them! I'm also considering switching to Prezto, but for now ~.4 seconds is good enough.

Anyone have experiences improving their shell?</comment>


Let's Learn About Waveforms - <AUTHOR> https://pudding.cool/2018/02/waveforms/ <comment><USER2> [https://news.ycombinator.com/item?id=16378458](https://news.ycombinator.com/item?id=16378458)

</comment><comment><USER3> It's very hard to read with a big wiggling waveform fixed to the top left.</comment>