Ask HN: What is the best onboarding experience you have had? - <AUTHOR> Interested to know what is the best onboarding experience you have had when joining a new company. It would help to tell whether it was your first job or you joined as an experienced hire. What made it tick?<p>Background: We are considering defining onboarding processes in our start-up and want to  know the best practices out there. This is particularly important now that we are forced to a do alot of remote onboardings. How can we make it work for the team and our new members? <comment><USER2> When I joined Puppet Labs they had the best process I've come across (I'm a consultant so I've been onboarded several dozen times over the past 20 years).

      Day 1:
      * I wake from a good nights sleep having flown into PDX two days before to allow for Jetlag to clear.
      * A shiny new laptop (It was a MacBook Pro because I didn't think to ask for a ThinkPad).
      * All my accounts and access are already setup.
      * Someone assigned as my buddy to help me navigate, but the whole team made an effort.
      * A wiki article about starting that clearly laid out the expectations for my first day and first two weeks.
      * A puppet repository to setup my MBP for the work I was doing. One command everything installed and ready to go.
      * Met with other new starters and run through HR and other policies.

      First two weeks:
      From the wiki article I knew what I needed to organise including:
      * Meeting key people around the business.
      * Doing a demo to show I understood the product.
      * Staff photo
      * Organising cadence for return to head office for training and team socialising.

<comment><AUTHOR> What role did you join for?

<comment><USER2> I was a technical solutions engineer (pre-sales).

</comment></comment></comment><comment><USER3> I joined a fintech in London (as a contractor) and the first couple of hours were roughly:

1\. A couple of intro meetings with other new contractors or joiners. We were shown around the office and what not. We were told whom to contact in what situation.

2\. I logged into my machine, where everything was already installed and set up. I git pull'ed the code and hit F5 (Run in Visual Studio) and the application started and it just worked, no scripts needed to run, nothing to config. To be fair their products were pretty simple, however they took great care in making sure that you were able to run the code with minimal to no subtle prerequisites. There was a README file there, but I don't think I used it too much because everything was intuitive.

Shortly after I joined a company with exactly the opposite environment. It took me at least two weeks to set up my machine so I could run _most_ of their applications. By the time I left (over one year later) I was still not able to run at least two of their major products. I had given up many months earlier.</comment>


Mario Livio on 25 Years of Hubble - <AUTHOR> http://nautil.us/issue/21/information/mario-livio-on-25-years-of-hubble

<comment><USER2> Has it been 25 years already? Seems like only yesterday that it was 20... _Sigh_ I guess that means I am getting old...

Anyway, happy birthday!

<comment><USER3> Seems like yesterday that we were fighting over whether to build the Hubble or the SSC[1] because we said it was too expensive to build both. It sure would have been great to be able to look back now on the advances of both projects after a couple decades. Well, at least CERN eventually built that smaller collider in Europe.

[1] [http://en.wikipedia.org/wiki/Superconducting_Super_Collider](http://en.wikipedia.org/wiki/Superconducting_Super_Collider)</comment></comment>


How to Buy Bitcoin with PayPal or Credit Card - <AUTHOR> http://btcgeek.com/buy-bitcoin-paypal-credit-cards/ <comment><USER2> I was under the impression that PayPal had banned use of their service for anything Bitcoin related.</comment>


An antique audiotape was a dispatch from D-Day - <AUTHOR> https://www.stripes.com/news/us/the-antique-audiotape-was-a-mystery-then-a-researcher-got-it-to-play-it-was-a-dispatch-from-d-day-1.601363 <comment><USER2> Chilling. To put your life on the line for the people of Europe and the world really takes something special.

</comment><comment><USER3> Terrific story, thanks for sharing here!

</comment><comment><USER4> Thank you for that.</comment>


Pioneer Edition FreedomBox Home Server Launched - <AUTHOR> https://www.cnx-software.com/2019/04/22/pioneer-freedombox-home-server-olimex-a20-olinuxino-lime2-board/ <comment><USER2> How is this different from running a raspberry pi?

<comment><USER3> And what is its purpose? Judging from the screenshot, its purpose seems to be to run a random assortment of open-source software packages, many of which overlap with each other, and many of which don't make sense to run inside a home network.

<comment><USER4> The purpose is to allow anyone to run their own web server, for purposes of web decentralization.

The advantage over a raspberry pi is it comes preconfigured so you don't have to be a computer geek to set it up

[https://www.freedomboxfoundation.org/](https://www.freedomboxfoundation.org/)

<comment><USER3> That doesn't give you "decentralization", though. It gives you a bunch of people running web applications on their home networks. Not the same thing.</comment></comment></comment></comment>


Posterous: A reminder of why you should own your online presence - <AUTHOR> http://dendory.net/blog.php?id=511ecb55

<comment><USER2> Sure... but I want to spend less than 15 minutes a month administering said online presence.

That means not looking to see if there's a 0 day exploit.

That means not even thinking about upgrades.

That means not having to be the one to figure stuff out after an upgrade goes wrong.

That means someone else worrying about if it's being overloaded. (The DDOS of love...)

That means being able to quickly send off an email (a la posterous) or similar to post. Markdown is preferable.

That means, unlike static generators, I don't have to think about re-deploying when I do anything.

I have too much to do with programming and administrations for pay -- a blog is not where I want to have to think after hours. Administration isn't fun anymore. I want to own my service, but I don't want to have to babysit it.

I don't even mind paying for the privilege, though the amount needed to justify it might be more than I'm willing to pay.

What is everyone else doing that fits the above? This seems like dumb duplicated effort.

<comment><USER3> This is why I use GitHub pages. Jekyll is good enough, and with GH pages it's super simple. If GitHub were to ever do something weird with it, I can get any static hosting and do the jekyll stuff myself and still control it.

And a static site is much simpler than, say, a Rails-based site (the other thing I was considering when setting it up). Any hosting will do, and I only have to worry about exploits in the web server, not the framework.

<comment><USER2> That's the route I think of going, but I still don't think that's controlling your presence on the web -- you're losing all your google juice if you ever have to move.

What's the difference between that and any other system that allows you to export your data?

<comment><USER4> You can use your own domain with GitHub Pages, then you don't lose any 'Google juice' if you move to another hosting provider.

</comment></comment></comment></comment><comment><USER5> >Own your domain name. If you want to post content, anything more substantial than cat pictures, things you may want to come back to in the future, you should own your domain name. It's cheap and ensures that your links won't have to change even if you need to move to a new platform.

I have been meaning to get a set of personal (as opposed to project-centered) domains for a while for exactly those reasons. Should I get the .me and the .name along with the .com? What best practices would HN recommend?

<comment><USER6> Buy just one. Any more and all you're paying for is the utter retardedness behind TLDs and domain name system. What are you going to do with the .me and .name? Just redirect them? If someone else comes along and you've not built the domain authority you'll still lose out if they build a better online rep than you, it really doesn't matter if they get the .name or the .org or the .eu or the .xxx or the .arenttldsgreatandnotatotallystupididea.

Preferably not from a really dodgy country.

<comment><USER7> I'd avoid .xxx, some web filters seem to block that indiscriminately.

</comment></comment></comment><comment><USER8> The number of small businesses that have abandoned their web sites and are relying on Facebook as their web presence is frightening.

</comment><comment><USER9> I already mentioned this on another thread today (<https://news.ycombinator.com/item?id=5229643>), but this is what we're trying to solve with Tent (<https://tent.io>).

<comment><USER10> This is very interesting. Can I ask some questions? How is what you are doing different than diaspora? Is it interoperable with it? And what kind of traction have you gotten?

<comment><USER9> Tent is just a protocol that can be used for all sorts of applications. It's easy to make microblogging or traditional social networking apps (think Twitter and Facebook or Diaspora _) on top of Tent, but apps like Dropbox, Evernote, Tumblr, Loopt, etc are also possible.

Diaspora_ is an app with a great UI and its own (unfinished) protocol. We've been working with the Diaspora* team ([http://wiki.diaspora- project.org/wiki/Diaspora,_Powered_by_T...](http://wiki.diaspora- project.org/wiki/Diaspora,_Powered_by_Tent)) to create a port of the Diaspora* UI to Tent (basically take the Diaspora* front end and a standard Tent app back end). That would let the Diaspora* community continue to use the app they love, but take advantage of the other capabilities of Tent and apps in the Tent ecosystem. It's easy to import the old posts from Diaspora as well. The only problem is that the Diaspora* community is currently based on a pod infrastructure (dozens of medium community-run servers (100s-1000s of users/server). Tent assumes that users will either run their own server or use a hosting provider (think wordpress). So far, the only Tent server implementations capable of hosting thousands of users are closed source and belong to the hosting companies. Eventually that may change, but it means there's no drop-in replacement for Diaspora* pod admins. Users would need to either set up their own Tent server (really easy to push to Heroku <https://github.com/tent/tentd-admin>) or use a hosting provider. There aren't any UX or technical complications, the D* community is just used to community run pods. As it stands now they'd need to write a multi-tennant Tent server implementation themselves. Additionally, the idea of part time admins and a giant shared server might work for apps like Diaspora (or even some Wordpress installations), but Tent is intended for highly sensitive personal data as well. I'm not sure that part time administrators should be responsible (technically or legally) for sensitive data (imagine storing your medical and financial records, persistent location data, file backups, etc on a server with a single part-time admin).

Right now there are a few dozen Tent apps of various types and a handful of server implementations. Some of the reference apps and servers as well as the protocol validator (in development) are available at <https://github.com/tent/>. The first Tent host currently has about 19,000 registered users. A dozen or so users are hosting their own Tent servers (similar to running your own Wordpress) and three other Tent hosts are preparing to launch. There's a lot of big announcements coming in the next few months that should cause an increase in those numbers.

</comment></comment></comment><comment><USER11> The problem isn't necessarily with services providing Open APIs/Data Exports, it's with people themselves and the trust they ensure to the services they use regularly. Pretty much all of this advice most of us should know: along with regular backups and different passwords/password manager for different sites; and I am willing to bet a large proportion of people will know this advice, advise it to others, but not follow it themselves. That is until its too late.

Even when following said advice it is not fool proof. So you own your own domain name. But do you really own it? Not really, you are essentially leasing it from a registrar who probably have terms and conditions for seizure of that domain name for whatever reason.

</comment><comment><USER12> This is why you shouldn't use GeoCities or MySpace. </sarcasm> Just because a single website is shutting down doesn't mean you should spend extra time installing stuff on your own. I disagree with the article.

</comment><comment><USER13> Also see:

<http://indiewebcamp.com/why>

<http://indiewebcamp.com/POSSE>

</comment><comment><USER14> I agree with the sentiment. I just wanted to point out that you could own your own domain and point it at posterous. Not perfect, but still.

</comment><comment><USER15> File this in the category of: making backups, not using GoDaddy and using a password manager. It's easy, everyone knows it, but yet most people don't take the tiny up front effort to do it right.

Just last week, another GoDaddy rant. How quickly are these startups closing? How many startups' products do you use that have no business model other than "attract users and content and figure it out later". Enjoy when the next one that you're "actually using" succumbs to the same fate!</comment>


Have I Been Pwned? Data breach master list with API - <AUTHOR> https://haveibeenpwned.com/ <comment><USER2> This is a great (free) resource run by Troy Hunt, a well-respected Microsoft MVP and security researcher. His blog is full of interesting info: [http://www.troyhunt.com/](http://www.troyhunt.com/)

<comment><USER3> At the risk of coming across like a shill, I loved his "Hack Yourself First" course on Pluralsight. He does a great job of covering the basics of web security that every web developer should know and he makes it interesting by covering it from the attack angle first.

Someday I plan on getting around to subscribing for another month just to go through his newer content.

<comment><USER4> Troy has a good Web Security course up for free at: [https://www.varonis.com/learn/web-security- fundamentals/](https://www.varonis.com/learn/web-security-fundamentals/)

</comment></comment></comment><comment><USER5> It's important to note that in addition to the big breaches, this site also collects database dumps from paste sites such as Pastebin.

Specifically, I've been feeding logs from my twitter bot, @dumpmon, into HIBP to help build their collection of pastes. Troy is a fantastic researcher and has been awesome to work with!

<comment><USER6> I love dumpmon and regularly point it out to colleagues.

</comment></comment><comment><USER7> Guess that explains why my throw away email was getting a ridiculous amount of spam. Why do people send spam nowadays anyway, is that ever effective? Has a sketchy, poorly worded spam email ever prompted someone to _actually_ buy viagra from them?

<comment><USER8> If Spam Nation is accurate, spam is actually quite lucrative. The knock-off medications they're peddling often work just as well as the real thing and at a fraction of the cost.

<comment><USER9> _...work just as well as the real thing..._

There are a few ways to take this, but this reminds me most of the diet aids that supposedly consisted of tapeworm eggs.

</comment></comment></comment><comment><USER10> Maybe you should ask for credit card numbers and passwords to check if they have been compromised.

<comment><USER11> Troy Hunt explained somewhere that he doesn't actually store the password (hashes), nor does he want to.

See the FAQ as well: [https://haveibeenpwned.com/FAQs](https://haveibeenpwned.com/FAQs)

<comment><USER12> Assurances only go so far. Even if he's a perfectly ethical person, if his service provider is compromised then all bets are off.

But, as some replies accurately pointed out, the email addresses are already out there and are not that big a deal anyway.

<comment><USER13> Everything he has in HIBP is taken from public releases. It's already out there, there's not level of 'really out there now.'

<comment><USER14> Yes, not making the email addresses easily searchable is the worst type of security through obscurity. The type where it's only obscure to you the email address owner, but not to those who would like to exploit you.

<comment><USER13> He's not interested in becoming a search engine for finding exploited accounts.

<comment><USER14> I understand, and I believe I was agreeing with you. I was merely noting that while making it searchable takes the difficulty from _slightly inconvenient_ to _easy_ for those who might want to exploit it, it also takes the difficulty from _very hard_ to _easy_ for the average person who may want to defend against it (by determining if they are at risk). I believe that's a net positive.

<comment><USER2> What do you mean it's not easily searchable?

You put your email in and it tells you if it was ever part of a data breach. You can even subscribe for future notices in case it's found in a breach in the future. What more do you need to search for?

<comment><USER14> I was replying to the up-thread position[1] summarized as "providing a searchable interface is dangerous because bad actors can use it against you." The context of the thread[1] apparently makes my meaning (that it's okay that it is searchable) somewhat hard to intuit.

1: The thread no longer appears to imply what I thought it was. I don't know whether that's because some comments were edited or because I was just in a state of mind which made me interpret them differently, but I don't think it really matters. My statements were meant to be general for this type of situation, and apply towards the merits of searchable vs non-searchable email addresses, not to assert that this site did one or the other and apply judgement because of that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Would be great if I could just provide a hash of my e-mail address.

<comment><USER16> Agreed - I use a lot of email aliases (i.e. firstname.lastname@example.com) and I don't really want to upload a list of them to a website to see if any were compromised, I'd feel much better about a hash.

Either that or allow a wildcard "firstname.lastname@example.com" so I can check them all at once, but that probably has privacy issues of its own.

<comment><USER17> Just curious, why do you use a different e-mail account for every merchant? All you need is different passwords, and then maybe label filters if you don't want them ending up in your Inbox.

<comment><USER18> That isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, firstname.lastname@example.com goes to email@example.com.

It's useful for exactly the filtering you are describing - and I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)

<comment><USER19> it's literally security by obscurity since gmail does not allow a genuine + in emails, so:

>I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)

...is Google dropping the ball by doing something insecure. The secure version is to be able to assign a randomized alias, for example I should be able to request an alias and get a high-entropy string like buffaloaerypyrite which is associated with "me+fromDatingSite", which is this great group I heard for meeting singles who are into knitting, my biggest hobby! Then I can give DatingSite the address "firstname.lastname@example.com" and have it go to my inbox and be marked fromDatingSite, just as it does currently. But if escorts start sending me mail to "me+fromDatingSite" I don't have to be able to rely on the _security by obscurity_ that protects me from getting spam that is not marked with that source, if any of them figure out how to remove the + so that they can reach the inbox I read everything in.

It's a simple key-value lookup table and would close a security hole that allows spammers to reach you. It is mandatory for Google to let me give out "buffaloaerypyrite" instead of "me+fromDatingSite". Unfortunately, instead they have a non-scalable solution that doesn't work.

This is why I'm faced with a choice, and can either use an unsecure version and rely on security by obscurity, or use a real throwaway email. I use a real throwaway email anyone can read (mailinator).

Because Google's engineers either don't understand how to secure their solution, or believe that security by obscurity is sufficient.

I've never once in my entire life given out my gmail email address with a + in it, even though I know exactly how this method works and how to use it.

Never once. I'm not stupid enough to use security by obscurity. But it's great that they have it and are a single key-value lookup from having it work properly. Any day one of them will realize the implications and implement the solution, which can be prototyped in 7 minutes in any technical stack and be fully pushed out within a day or two. It's trivial. I have faith they will realize it sooner or later. You can do it, Google. Be better.

<comment><USER20> > literally security by obscurity

You've said that a lot, but there is no obscurity here. Or security. If you actually want to use this for serious spam filtering, you'd discard all emails without a valid + suffix with a whitelist.

<comment><USER19> I simply don't think you're writing in earnest, since your proposal is quite nuanced and does address my issue, proving that you exactly understand it.

But gmail does not support the filter you propose. ("discard all emails without a valid + suffix with a whitelist.")

Also even if you were serious you would know that if I did manage to get gmail to filter all email without a valid + suffix from a whitelist, I would then have a choice: I could give out meaningful suffixes, like me+amazon, me+ebay, me+facebook, or meaningless hihg-entropy suffixes.

But if I give out meaningful suffixes, then spammers can just try the email address I give out, replacing the portion after + that identifies them, with likely candidates instead. They are unlikely to succeed, but this is still security by obscurity.

If we move to true security, picking high-entropy strings to white-list, that means I now need to manually track the relationship between the strings and the party they identify. Google should track that relationship, not me. It's a single key-value store. That's it. Associate me+ebay with squirehamboard so that I can give ebay "email@example.com" and have it behave exactly as though I gave ebay "email@example.com" today.

I think you're better than this. Be better. I have faith in you. You understand the issue. If you were working for Google you could solve it within 7 minutes (proof of concept). It's a single key-value store.

I think you know very well the definition of security by obscurity. Be better than this. Be better!

<comment><USER21> How would I solve it without parking n number of aliases which are now forever unavailable for anyone else to use?

You could do what I do and just create a separate google email address (mine literally has the word spam in it) that feeds into your primary Gmail but goes straight to all mail and is marked as read by default.

It is funny when some websites reject my email address because the word spam in the address. Perhaps Google could make this process simpler by allowing autogenerated email addresses that feed into the real primary email without the user having to create a second email address. I think this would benefit Google as the user data isn't scattered around in multiple Google accounts.

So for example I can request a new alias and Google would make one like ezJVoWkJFBPvMm98xhOUsi7X52l06RNblLXhhCFse3nwdkpCW7VUkIO7zgJqQDd at gmail Dot com and forward that to my real email address. If I ever respond to any email that came to that address, make it look like my email address is that string above.

Now since it is just a random 63 (or longest allowed by Google) char alias that the user didn't choose, it is unlikely that it will be anything someone wants as their email address.

Is this along the lines of what you were thinking?

<comment><USER19> You think extremely similar to me!!! For the sites that reject mailinator and its aliases, I give them a gmail address that literally has the word spam in it, just as yours does. But I just check it for any registration I need to confirm, I don't forward it to my main account. But it literally has the word spam in it, just like your spam gmail :) Interestingly, I've never once had any site reject that due to having the word spam in it - but maybe because it's my second-tier possibility only for use on sites that reject mailinator. I thought it would be likely that some sites would reject it for that reason, but I just haven't had that issue.

What you've written:

>Perhaps Google could make this process simpler by allowing autogenerated email addresses that feed into the real primary email without the user having to create a second email address.

Is precisely what I suggest. Specifically, all of the current firstname.lastname@example.com (which feeds this email address to the firstname.lastname@example.com email address, marking it with your comment)should be kept, it's just that instead of giving Bob's Spam Factory the email address "firstname.lastname@example.com" I first request a high-entropy version of "me+bobspam", and get something similar to your suggestion:

>firstname.lastname@example.com

and give Bob's Spam Factory that address instead. Then Bob's Spam Factory can't just take out the part after the + to get my primary email address.

However, you do not need 63 random characters in order not to worry about taking possibilities from someone!!! (Not even close).

Given a dictionary of 100,000 words, 3 random words have 100,000 * 100,000 * 100,000 = 1,000,000,000,000,000 or 1 quadrillion possibilities. It's vanishingly unlikely that anyone would ever pick the same strings. This is what I meant by "entropy" which is a technical term. To see this in action, consider that I came up with the "high-entropy" string squirehamboard for my example. I haven't checked yet, but it is _extremely_ likely (99.99%) that I'm the first person to have ever written the words squireharmboard one after the other, and that if I hadn't written it, nobody would write it in the next thousand years (except exhaustively listing all possibilities, but I mean actually picking it or writing it by hand).

Let's check. Let's google squirehamboard: [https://www.google.com/search?q=squirehamboard](https://www.google.com/search?q=squirehamboard) \- as you can see, nobody in the history of the Internet has written that short phrase except me.

It's not the only example I had. I also listed in my original comment buffaloaerypyrite - again, it is extremely likely that I'm the only person to have ever written buffaloaerypyrite in the history of the Internet (I used a high-entropy free association method to come up with these words), and that if I hadn't written it, nobody would in the next thousand years. Let's check: [https://www.google.com/search?q=buffaloaerypyrite](https://www.google.com/search?q=buffaloaerypyrite)

Again, I'm the only person to have ever used the string buffaloaerypyrite on the entire Internet in any context. (Of course, some web server could decide to exhaustively list all three-word possibilities, since my personal mental dictionary that I free-associated through to get the terms Buffalo, Aery, Pyrite, as well as Squire, Ham and Board, from does not have 100,000 words in it - I know more like a few thousand words personally.

It's possible for someone to list buffaloaerypyrite in a huge (multi-multi- terabyte) collection of passwords. But I don't quite require Google's handles to be as strong as passwords. They should just be long enough not to step on anyone's toes who are making real, normal email addresses.

In practice 3 random words from a huge dictionary is more than enough. In practice you will never have any conflict with any real email address anyone chooses.

But yeah, you get the basic idea. You just go overkill on the length of password that you think needs to be chosen :) 3 random words given by Google are more than enough...

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> This would be more useful for non-hacker types if their website's name had "compromised" instead of "pwned" (and really, "pwnd" is the preferred nomenclature)

<comment><USER22> And less cringey for everyone.

</comment></comment><comment><USER23> Two questions as a non-security guy...

1\. My two main email addresses were both flagged across the Bitcoin Security Gmail dump, the Gawker Gnosis hit, and then two game DB breaches (D&D Online, Heroes of Newerth). If I've changed my gmail passwords since then with a very strong 1Password PW, is that pretty much all I should be doing at this point?

2\. I was never notified by any of these places that my email and password had been compromised. I'm particularly concerned by the two games. Do these companies have any legal obligation to disclose what happened? In the case of D&D Online they have "Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity." So I'm curious what recourse I have.

I have to say that the irony in all of this is that my two personal email accounts were both caught up in multiple lists, but none of my family members (who are all considerably less tech-savvy than I am) show up at all.

<comment><USER24> > is that pretty much all I should be doing at this point?

Google also offers two-factor authentication; if you're willing to bear the extra inconvenience, it's one of the biggest possible security wins.

[https://www.google.com/landing/2step/](https://www.google.com/landing/2step/)

<comment><USER25> To add to this, it isn't too bad of an inconvenience. You can remember a device for 30 days, so you take an extra 20 seconds 12 times per year.

<comment><USER26> I complete a Google 2FA much less than once a month. I think the 2FA cookie must live for a month, but my login cookie lasts for much more than that.

On a new device, I do of course need the 2FA token.

</comment></comment></comment></comment><comment><USER27> Searching by domain name is great - I use a catch-all on a domain I own and create new accounts for everything I sign up for - being able to see which ones were compromised is pretty nice (and relieving to see only one, on a throw away account).

</comment><comment><USER28> Is there really anything I can do other than update passwords regularly if my email address has been compromised? Apparently I was hit by the Adobe and Bitcoin forum dump. I (think) I create new passwords and change old account passwords often enough and I think literally the only time I've gotten "hacked" was an old XBOX Live account and Origin, and most accounts I care about nowadays also feature 2-Factor Authentication.

So while I'd be more pleased if Adobe hadn't leaked my email, I'm not really at risk continuing use of the email address as long as I'm on top of my passwords, right?

<comment><USER29> When the Adobe leak hit, I was already using Keepass to generate random passwords for each service I use.

So, I changed the password on the Adobe account. I've never had an adverse event based on that leak.

Lots of people know your email address. It's your job to make your email address useless, combined with a data breach, to guess a valuable password. If you use passwords like "mysecret-hackernews", "mysecret-github", and "mysecret-paypal" then you're in serious jeopardy if your "mysecret-adobe" gets out. But if you use a bunch of random gibberish for each password, you're relatively safe, at least from that particular attack.

<comment><USER28> Sorry for the late reply, but thanks for the feedback. While I believe I have a decently strong variety between my passwords, I'm looking at Keepass now and it looks like the exact password manager tool I've wanted for a while now so I'll be giving it a try.

</comment></comment></comment><comment><USER30> After reading recent coverage on this guy and his HIBP site, I think it's an absolute disgrace and to be honest I can't seriously be the only one! He gets away with having all these stolen database dumps which is illegal anyway but gets to build a whole site housed around this stolen data and further more benefits from it?! How is this guy any different to one of the people that built an Ashley Madison email search site (ones that didn't display PII) or another search site that allows for the searching through these data dumps? Why is he above the law, the FBI etc have turned a blind eye to what this guy is doing yet will happily see these other site owners prosecuted to the full extent of the law! It's actually quite disgusting that there is one rule for Troy Hunt but another rule for others. The fact of the matter is that in plain simple terms what this guy is doing is actually against the law and illegal. Someone needs to bring a class action lawsuit against this guy and get HIBP shut down! Oh yeah and he claims that haveibeenpwned.org is nothing to do with him as well, I say that is a load of BS!

<comment><USER31> How do you think he is violating the law?

He's storing email addresses that have _already_ been leaked, and providing a free service for those who are concerned they may have been compromised.

</comment></comment><comment><USER32> One of my e-mails was in three breaches: Adobe, Money Bookers, vBulletin, and my Gmail was in only one breach: Boxee forums.

I have been receiving a lot of spam lately on my Gmail, and it's not listed anywhere online. So it must have come through a breach somewhere.

</comment><comment><USER33> Does anyone store fake unique email addresses to see if they've been compromised? I assume you'd need to seed it with new ones occasionally or on some kind of schedule.

<comment><USER34> Lots of people will create a single address for each company that wants one, so that if it gets compromised it can be shut off without affecting any other incoming emails. And identify the offending firm. I have created an email account for a store that wanted an address while I was out in their parking lot (the ones that had plausible future value to me).

So far, none have been sold to marketing lists. Which says either that I'm a pretty good judge of firms, or that no one is interested in me. ;)

<comment><USER35> If you use gmail, you can insert random periods or append `+word' to your email address and it'll be delivered to the same address as one without periods and the `+word' portion. So, an email to `email@example.com' will be delivered to `email@example.com'.

<comment> james-skemp Sadly a number of sites get hung up on the '+', despite being valid. One thing to keep in mind if relying upon this.

<comment><USER9> If they don't know how to email, they probably don't know how to security.

<comment><USER34> To be fair, checking that an email address is formatted correctly and valid is a challenge. You can't just use a regex.

<comment><USER9> Modern browsers use this one [0]:

      /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/

That certainly accepts plus signs. I'm sure there are theoretically valid addresses it wouldn't accept (IDNs spring to mind), but HTML5 is willing to be "practically", rather than theoretically, correct. Anyway, there are email validation modules in every popular language. A good technique, which seems very common, is just to make the user type their email twice. Invalidity is not the most important reason why an address could cause problems.

[0] [https://www.w3.org/TR/html- markup/input.email.html](https://www.w3.org/TR/html-markup/input.email.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Great resource. Even more useful for checking family members' email addresses. I use strong passwords, change them frequently, and use 2FA wherever possible... My family (probably) doesn't, nor do they know to check a site like this.

</comment><comment><USER37> Why should I trust this site with my email?

<comment><USER38> [http://www.troyhunt.com/2015/11/im-sorry-but-your-email- addr...](http://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is- not.html)

</comment></comment><comment><USER39> Didn't hey use to ask you to verify first before? Great way to snoop on who else has logged on where.

</comment><comment><USER40> Finally a service that catches one of the 5+ pwnages I'm aware of!

</comment><comment><USER41> Wuh oh. All the Mailinator accounts I tried were pwned.

</comment><comment><USER42> email@example.com Pwned on 48 breached sites and found 650 pastes.

Ouch.

<comment><USER43> On the other hand, if you own that email you have access to most IT systems of the world. Let me look up your account with my firstname.lastname@example.com account ;)

</comment></comment><comment><USER44> This is uh, a great way to get email addresses.

<comment><USER45> You can usually access all the same dumps they use at your favorite shady website. The smaller ones are on pastebin too.

</comment></comment><comment><USER46> RIP firstname.lastname@example.com

<comment><USER47> Surprised by how many people use my bs email email@example.com (my name is Mark)

<comment><USER48> Carelessly did the same with firstname.lastname@example.com (my name is Kevin) until one day firstname.lastname@example.com sent me an understandably angry reply!

<comment><USER47> Ha. How did he track you down? Mark(@mark.com) is probably furious with me.

<comment><USER48> I'm sure the reply-to address forwarded to me while I was testing.

</comment></comment></comment></comment></comment><comment><USER49> Thanks Adobe.</comment>


Ask HN: Who's using Clojure, and to do what? - <AUTHOR>

The previous conversation was almost 3 years ago:
http://news.ycombinator.com/item?id=1453259
I am curious how things have changed.
Who is using Clojure now, and for what? <comment><USER2> I use it for my cooking recipe web site <http://cookingspace.com>. I do a lot of non-trivial calculations for adjusting recipes for ingredients on hand, etc. and the functional style of programming coupled with using maps for in- memory recipe and nutrition data makes it easy to experiment with new code and ideas. I use Compojure+Noir so I tweak UI or back end code, refresh the browser, and see my changes immediately. I also keep a repl open on the same code. In all, a very agile setup.

I also use Clojure for my natural language processing as a web service project (<http://kbsportal.com>). Both of these sites are 100% Clojure code.

After a long and satisfying career, I (more or less) retired at the beginning of this year and I am working on "side projects" full time :-) Clojure is a great language to use, and except for still occasionally helping old customers, I don't really use Ruby, Java, Scala, or Common Lisp anymore.

<comment><AUTHOR> I am curious, how do you deploy your apps? What webserver do you use? Do you bundle these up with "lein uberwar" or "lein uberjar" or something else?

<comment><USER2> Good question. I have experimented with making WAR files and deploying to Tomcat, but I now use an easy alternative of using an embedded server: I have (in each project) a shell script to rsync the entire project to whatever server I am using for deploying the project. If I am running in production mode, I kill the old process on the server (I use beefy VPS's for my own stuff, AWS for customer work) and manually run:

nohup lein trampoline run prod > out.log &

Using trampoline is nice because it uses the same process for lein and your web app. This process takes me about 30 seconds of manual effort, and I really should completely automate it. I use IntelliJ with the Clojure plugin for most editing and IntelliJ has has some deployment tools that run internally in the IDE - I might settle on that, or use capistrano or something similar. That said, "devops" is such a tiny overhead for me on my own projects that my motivation is not so great to optimize my deployment process.

</comment></comment></comment><comment><USER3> It was used for my site gbedu.fm. In retrospect, it was a HUGE blunder.

Why?

You have such a limited pool of people to continue work on it.

<comment><USER4> Did you consider only the local, or also the global 'remote' talent pool?

<comment><USER3> both.

Very limited</comment></comment></comment>


Which books for TOEFL can you recommend? - <AUTHOR>

I'm going to pass TOEFL but there are a lot of student books. Can you advice something really good? <comment><USER2> What kind of TOEFL exam you will take? IBT? ITP? Those exams have different target and different type of tests. In my local, there are two types: IBT and ITP. The ITP is the easiest one, but it is no more recommended (since most graduate school need TOEFL IBT).

But for grammar (although it is not directly test you, but it might help), i really recommend Azar's Book on Grammar [1]. [http://www.amazon.com/Understanding-Using-English-Grammar- Az...](http://www.amazon.com/Understanding-Using-English-Grammar- Azar/dp/0139436146)

</comment><comment><USER3> No books. Download a shit ton of movies/tv series in english and with english subtitle and go through as many as you can.

That's how I got a 980 on my TOEIC. Being actually fluent is more important as you will be able to pass any test out there (so no wasting money on retries).</comment>


Whats the right way to handle your finances? - <AUTHOR>

I've listened to Dave Ramsey and I've read his book, The Total Money Makeover. He believes basically that you don't need to worship a credit score, or have credit cards, and the only loan you take is a mortgage from the bank with 20% down on the house. You always keep an emergency fund and you work to use the "Debt Snowball" to destroy all your debt (credit cards, student loans, etc.) and get rid of it once and for all. And with the lack of empty payments, you can now invest and save your income.
Robert Kiyosaki, Author of Rich Dad Poor Dad , seems to use credit to build wealth. I haven't studied his ways nearly as much.
I've been out of college and working for about a year, and I pay all my bills, including my student loans.
But I'm hung up on the thought of taking a small loan to buy a vehicle that I'd love driving. (Because I love driving, its not just point a-b, its the adventure in between, the experience).
Now of course this comes down to my conscience, and my own choice. I just want to hear what you think.
(the psychoanalysis of this will go : "You're just looking for someone else's opinion to verify that what you want is okay to do, thereby shifting the blame if something goes wrong and not leaving you with responsibility in your mind".) Actually I'm looking for a plan of action to get what I desire.
Also, lets touch on personal gratification. How do you judge if you deserve something or not?
Thanks a lot for your time and attention. <comment><USER2> There is no universal answer, and I think the criteria change somewhat on where you are in your life and your current and short-term expected income brackets.

Generally speaking, a car is never an investment. It's a rapidly depreciating utility assest. However, for some of us a car is also an entertainment item, and we get a large amount of pleasure from owning and driving a vehicle that makes the drive fun.

Some of my rules of thumb (and these sort of have to be adjusted for your location, and inflation over time).

A "basic" salary, meaning you can eek out a not-intolerable living, is equal to 1x your current age. At this income level you can mostly survive without a lot of frills.

A "good" salary is 2x your income level. Here you can often look at buying a modest house and maybe a new or 1 year old reliable middle-class car. At much less than this amount it is probably unwise for you to take on any significant debt.

A salary of 3x your age will generally put you into the upper 5-10% income bracket, and if you manage your funds with a little bit of logic you should be able to make significant contributions to a retirement fund, a savings slush fund, own a decent house and have a luxury(ish) type of car.

For most of us in tech jobs, making a salary of 3x your age isn't difficult or unheard of at all.

If you're going to carry a traditional mortgage, you can probably afford a house that is about 5x your current income level. This is one place, IMO, where if you have a semi-predictable career growth potential you can go to 8x, especially if you're younger and expect your income increases to significantly outpace inflation for the next few years (again, not uncommon in the early stages of a tech career).

If you plan to keep your car for 5-6 years, then .6x-1x your income is usually manageable in terms of a vehicle purchase price, scaling towards the higher end as your salary increases.

As an example:

25 years old, make 50K. That would be about 30K after taxes, or $2500/mo. A .7x car would be a 35000 vehicle. 0 down financing would be 686/mo over 5 years with an average interest rate. A 5x house would be $250,000 (yes, not a lot in some places), which on a 30 year loan with 20% down and taxes/etc. rolled in to the monthly payment puts you right around $1100/mo. So your car and home eat up 1800 of your 2500/mo. Another 250 for utilities and 300 for food, and you're bumping up at about 2350/mo. The other 150 would be for a small amount of savings and incidentals. It's obviously very tight, but the idea is that your salary is also going to be increasing over short time while your major expenses (car, home) stay mostly fixed. Buying a cheaper vehicle (a .6x or $30000 car)(or financing a lesser amount) would be a wise thing to do at that stage if you weren't confident about future job opportunities.

Again, these rules of thumb might not work in San Francisco, or if your career is going to be in the dog grooming industry. But for most non-outrageous cost of living places for someone who has good career potential it is, IME, a good beginning estimation point.</comment>


Resume: 30 seconds to impress - <AUTHOR> http://www.randsinrepose.com/archives/2007/02/25/a_glimpse_and_a_hook.html

<comment><USER2> As someone who has been at the same software company for 8+ years, reading articles about how you need to have a professional presence / a dossier on the web (blog, LinkedIn) frankly freaks me out. I went to a presentation by a recruiter (for graphic design) who echoed the fact that if you don't have a viable LinkedIn presence - you're not really a candidate. Blogging about personal & software development and learning Wordpress are high on my choose- to-do short list for 2008.</comment>


Apple Is Now Accepting iPad Apps - <AUTHOR>

Just got the email in my inbox - submit by March 27th to make the launch . . . <comment><USER2> I still don't see how this is going to work. Are we really supposed to test our apps in a buggy pre-release simulator and just hope it works on a real device when people purchase it on the App Store?

<comment><USER3> I don't know about you, but I fully intend on submitting my app so that it's approved by Apple and ready for release on launch day. However, I will set an availability date in the future.

Then first thing April 3rd I'll be in line at the local Apple Store waiting to get my hands on a physical unit. I'll take it home, do as much testing as I feel necessary, and if I'm happy, I'll flip the availability date to April 3rd.

That way I get the best of both worlds. I can be in the iPad App Store on Day 1 and also have pretested my application.</comment></comment>


Apple's Safari: Lingers on as Second Rate Browser - <AUTHOR> http://www.macobserver.com/tmo/article/apples_safari_lingers_on_as_second_rate_browser/ <comment><USER2> Not the best of logic, IMO.

1) Market share decline does not imply "second rate browser". It could just mean that Safari caters better, but for a smaller part of the market now, or that there simply are more options to choose from nowadays, or that (I do not believe that, but it _could_) more nerds are harassing their friends to install a browser where those nerds can configure a zillion things.

2) The evidence given for problems with Safari market share is, IMO, very weak. That same graph also 'shows' that "IE market share dropped in the past, but now has reached a plateau".</comment>


Supernova-propelled white dwarf found zooming through Milky Way at 5 million mph - <AUTHOR> http://www.astronomy.com/news/2018/05/snapshot-second-gaia-release-results-so-far <comment><USER2> The shared link immediately redirected me to a fake malware page upon loading for the first time.

[https://i.imgur.com/wOJ0b67.png](https://i.imgur.com/wOJ0b67.png)

Please blacklist astronomy.com links from being shared on this site.

Also, perhaps consider shadowbanning clayt6 because judging from his account history he's apparently only here to spam astronomy.com links.

</comment><comment><USER3> That speed (5 million mph = 2,235,200 m/s) is not quite 1% of the speed of light (299,792,458 m/s).

The article is about a large Gaia data release [1] not just the speed of one astronomical object. Maybe change the title (currently "Supernova-propelled white dwarf found zooming through Milky Way at 5 million mph ").

[1] [https://www.cosmos.esa.int/web/gaia/dr2](https://www.cosmos.esa.int/web/gaia/dr2)

<comment><USER4> But is it the speed of dark?

</comment></comment><comment><USER5> And I used to worry about asteroids..

Looking forward to the Hollywood movie in which heroes have to stop a STAR from hitting Earth.

<comment><USER6> Armageddon 2: Starmageddon. Bruce Willis has to land on the surface of a star, drill down into it and release a hydrogen bomb. The fusion reaction will cause the star to blow up even though it's already full of fusion. He'll wear a suit made out of diamonds and have a spaceship made of diamonds, and an Aerosmith rendition of twinkle twinkle little star will play as the star explodes and diamonds rain from the sky. Now seeking story credit for this script.

<comment><USER7> Your script is missing how Bruce managed to escape exploding asteroid.

<comment><USER8> Or how he managed to get to it. Any start exploding close enough for non-FTL technology to be a reasonable mode of transportation would also turn the Earth into dust or a molten ball of rock.

<comment><USER9> No problem... it turns out we reverse engineered a primitive FTL drive from the debris at Area 51, so we stick it onto a Space Shuttle, but it also turns out to be the only thing powerful enough to blow up the star, so it has to be detonated, sacrificing the ship.

However,the explosion also creates a wormhole that Bruce Willis bounces back into after blowing the star up, which lets him land safely back on Earth in a cool pose like Iron Man at the end.

</comment></comment></comment></comment></comment><comment><USER10> My intuition is having trouble coming to grips with the notion of accelerating a fluid object to that velocity via an explosion.

<comment><USER11> Since white dwarfs have around the mass of the sun in a size comparable to the Earth, the matter in them is quite exotic. Astronomer's have speculated that these hypervelocity stars (moving at a few tenths of a percent the speed of light in the referenced studies case[1]) are shot out like a slingshot. The original system is a binary, so they are already under extreme circular gravitational acceleration in their orbit. When the companion explodes in a core-collapse supernova, it loses that source of acceleration and moves in a straight line like a slingshot. The Gaia satellite is able to measure the velocity vector of the star very well, and show that it points back to an old supernova remnant. The scenario isn't controversial, but it does give quite a good example that this is how they come about.

<comment><USER12> This makes me wonder about the nature of gravity. How much of the gravitational pull from the companion would disappear? How fast? It seems like a reduction in gravity would be immediately followed by a massive energy release. It's impressive that the remaining star is moving away fast enough to avoid being destroyed in the resulting blast.

<comment><USER13> The reduction in gravity isn't due to anything special, the matter in the "anchor" star is just leaving to go somewhere else. (In all directions.)

<comment><USER12> That makes it seem like gravitationally, the anchor star would just be expanding. My intuition thinks the remaining star gets slammed by debris before the direction and strength of the anchor dissipates enough to launch it away, though my confidence in my stellar intuition is low.

<comment><USER13> Your intuition contains some truth: according to Gauss's law, the gravitation of the expanding nova shell _shouldn 't change at all_ until it passes by its surviving companion. The matter expanding away from the companion will gravitate less, but that will be canceled out by the increased attraction to the matter expanding towards the companion. Really, we're just assuming the hot, dense, and small dwarf can sustain the licking it gets when the remnant hits it. The smallness helps it get hit by less material, moreso if it's far away. It's gravitationally bound so it won't shatter - the most you could do to disassemble it would be to boil off its matter by raising it all to escape velocity. It takes a _lot_ of energy to do that.

</comment></comment></comment></comment></comment></comment><comment><USER14> When things really get going with outer space civilizations, the idea of weaponry and conflict is going to take some surprising and horrifying turns.

We bicker about islands and aircraft carriers, nuclear arsenals and orbital ballistics, and something like this would rend the entire planet limb from limb in the blink of an eye, without breaking a sweat.

<comment><USER15> Manipulating a white dwarf to kill a planet is like using a hydrogen bomb to kill an ant.

<comment><USER14> Given that a typical white dwarf is thought to occupy a volume comparable to the volume of earth-like planets, it strikes me as precisely the sort of object one might select to destroy a planet like earth in a single stroke.

From wikipedia:

      The estimated radii of observed white dwarfs
      are typically between 0.8% and 2% of the
      radius of the Sun; this is comparable to the
      Earth's radius of approximately 0.9% solar
      radius.

[https://en.wikipedia.org/wiki/White_dwarf](https://en.wikipedia.org/wiki/White_dwarf)

Catapults, naval cannons, carpet bombing cities to hit one obscure factory. War is littered with stories of absurd mismatches in economies of scale.

<comment><USER15> The problem is while it has a volume comparable to Earth, its mass is comparable to Sol! It would take an unbelievable amount of energy to move something so massive from its original position to a collision course with another body. With a fraction of that energy you could pummel a planet with a swarm of tens of thousands of giant asteroids for _years_.

</comment></comment></comment></comment><comment> Black-Plaid The article also talks about a black hole accreting at a rate of 1% every million years that is 'currently' 20 billion solar masses.

It is 12 billion ly away, which means, if it really does continue getting 1% larger every million years it's actually ... 143,719,397,330,047,128,616,744,826,647,657,321,145,325,176,127,225,856 billion solar masses at this moment. (if the compound interest calculator is to be believed)

I really hope that's not true.

</comment><comment><USER16> This reminds me of black hole merger recoil, in which a merger emits a gravitational wave with net linear momentum, sending the resulting black hole in the opposite direction at comparable speeds to this.

[https://en.wikipedia.org/wiki/Binary_black_hole#Black- hole_m...](https://en.wikipedia.org/wiki/Binary_black_hole#Black- hole_merger_recoil)

<comment><USER17> It's like the machine at a batting cage that shoots the baseballs.

</comment></comment><comment><USER18> When they say 5 million mph, is that relative to the center of the Milky Way?

</comment><comment><USER19> 5,000,000 MPH = 8,046,720 km/h = 0.007455824656 in light speed

</comment><comment><USER20> > ...the Gaia satellite – which precisely measured the positions, motions, > colors, and luminosities of over a billion Milky Way stars ...

Can any physicists here explain how the coordinate system is constructed here?

</comment><comment><USER21> I occasionally wonder about whether there are any objects out there traveling at a measurable fraction of c, could something even get through the atmosphere without disintegrating near those speeds?

<comment><USER9> Would something moving that quickly and carrying that much energy be more likely to disintegrate in the atmosphere, or to disintegrate the atmosphere?

<comment><USER22> Both, I suspect. At that speed, there's no point in talking about "flow" around it, it would simply compress all the atmosphere hit into a disc of plasma. The object would be disintegrated, but all the momentum has to transfer to the plasma disc instead. It would produce an impressive crater.

</comment></comment></comment><comment><USER23> I wish people would put high speeds in terms of miles/sec or km/s, because I know what light speed is in both, and I have a vague idea of orbital/escape speeds as well.

<comment><USER24> 5,000,000 / 3,600 = 5,000 / 3.6 ~= 1,000 miles/sec.

<comment><USER23> 5000 / 3.6 = 2500 / 1.8 = 1250 / 0.9 ~= 1,250 miles/sec

</comment></comment></comment><comment><USER25> Could this have planets?

Well not planets, but my question is more general - could a star moving this quickly have a planetary system - obviously this one would not if it got shot out of a supernova.

<comment><USER17> Anything it passed that had a delta-v of less than the escape velocity of the white dwarf will get hoovered up.

But most of what it passed would just scatter like bowling pins.

</comment></comment><comment><USER26> That's 972 km/s. Escape velocity from the milky way is 537 km/s. That star is leaving the milky way.

<comment><USER27> 2235.2 km/s</comment></comment>


IndieHackers.com acquired by Stripe - <AUTHOR> https://www.indiehackers.com/blog/acquired-by-stripe <comment><USER2> Patrick from Stripe here. I wanted to quickly chime in to emphasize that our goal in acquiring Indie Hackers is to simply ensure that the site becomes as successful as possible. The Stripe upside we're hoping for is that _more companies get started and that they 're more successful_. We already see a very large fraction of new internet companies choose Stripe; we're mainly hoping that Indie Hackers can help us grow the overall number rather than to grow our fraction. (Our product has to do the latter part.)

Also: congrats to Courtland on building an awesome site! I've been enjoying the interviews on it since it launched. It's very refreshing to hear from so many people who are quietly building real businesses with real revenues.

<comment><USER3> You can help us help you by a) becoming available in more countries b) Atlas LLC

<comment><USER4> With that LLC thought, does that still mean US based?

Atlas sounded interesting to me (doing product dev atm), however it's based on incorporating in the US.

The US seems like it's gone in a seriously bad direction for non-US citizens (I'm Australian, living in the UK), with no positive end to that in sight. So incorporation in the US isn't really a goer (personally speaking).

<comment><USER5> Isn't UK incorporating a breeze? I'm sure I heard it can be all done online.

<comment><USER6> From my experience you can do everything online + post, except for the bank account. However the reality might have changed in the 3 years which have elapsed. There might be some new bank that lets you get away with it online.

However, the UK is moving in a strange direction as well. For a decent EU option, look at Estonia. Get a digital ID card from one of their embassies and you can use that with your computer to open a company and manage everything digitally.

<comment><USER7> >There might be some new bank that lets you get away with it online.

Yep, [https://www.tide.co](https://www.tide.co) (even MetroBank which I used was all online and only took a few days.

</comment></comment></comment></comment></comment></comment><comment><USER8> While going from a blog-to-acquisition in less than a year is an impressive feat, there have been suspicious circumstances around IndieHackers submissions to Hacker News including clickbait titles that are frequently fixed by HN mods, and in one case, explicit voting manipulation with an attempt to bypass the voting ring detector via linking to /newest: [http://i.imgur.com/08pAFOw.jpg](http://i.imgur.com/08pAFOw.jpg)

This acquisition sends a disappointing message that growth hacking _works_.

<comment><USER9> I am glad to see that I wasn't the only one who felt that IH were gaming the system and was treating their stories as spam.

It does make me suspicious as to if HN admins treat YC alumni more equal than others.

<comment><USER10> Moderation on HN is very strict. If Indie Hackers were 'gaming' the system, they'd be banned. That hasn't happened. The posts consistently end up on the front page because people like the site...

<comment><USER9> > Moderation on HN is very strict. If Indie Hackers were 'gaming' the system, > they'd be banned.

If the voting data were available, one of us could prove the other wrong. As they are not, it is my opinion vs yours.

<comment><USER10> It's HN's opinion vs yours.

</comment></comment></comment></comment></comment><comment><AUTHOR> First of all, congrats to csallen, I have been following your journey from the day you launched on HN and it was fascinating to follow along. If you haven't read his month in review posts, highly recommended.

I hope it's not taboo to speculate on the acquisition price, so here's my take :

* extrapolating a $5k/month revenue to a year = $60k/year

* acquisition price is roughly 2-4x yearly revenue so $120k to $240k

* Plus a full time salary at roughly $120k/year

Really cool stuff man, congrats again!

One of the things I dislike about advertising on IH was that it was distracting. I see multiple adverts while reading an interview along with links to tweet pull quotes, not a fan of both those aspects. Glad to know that the advertisements will be removed.

Can't wait to see how IndieHackers grows, especially the community.

<comment><USER11> Your numbers are low. They didn't buy a suburban lawn care business. I'd ballpark >$1m up front and >$250k annual comp with upside going forward, in some mix of cash and stock. Great move by Stripe. Congrats to Courtland for the exit and what seems like a win-win for both parties.

<comment><USER12> I'm not so sure. I haven't seen the higher big ticket multiples scale down to smaller businesses very well (only in the small biz media negotiations I've been involved in or tipped off about - so I am no expert!). I'd certainly take a 16x revenue multiple _any_ day of the week though :-D

<comment><USER11> 16x mature revenue, sure. But if revenue is growing 20% month over month, then what?

I see pure talent acquisitions (no tech, no site, no brand) once a month for >$500k/head. Here the founder is a course 6 (CS) MIT grad, obviously smart and talented, able to act as an evangelist to broader communities, with a pre- built launchpad in place. There's real value to that.

If the stock component vests over some period of years, it could easily run into the millions, and still be a steal by Stripe. I'll echo another comment downstream: it's interesting to think about whether, in the spirit of the site, they will (or should) reveal the economics of the deal.

</comment></comment></comment></comment><comment><USER13> Isn't it ironic the details of the acquisition isn't being transparently shared?

From Indie Hackers site:

"Anyone with a business or side project that's generating at least $300/mo in revenue. There's no upper limit. Of course, you have to be willing to share your revenue — the point of this site is transparency!" Source: [https://www.indiehackers.com/submit](https://www.indiehackers.com/submit)

I think we have the "right" to know what the transaction entailed; how much the owner was exactly paid, that is.

<comment><USER14> Why do you think you have that right? Honestly curious.

<comment><USER13> The product took off thanks to the HN community. Hence the "right". He is simply a hypocrite if he doesn't share that.

</comment></comment></comment><comment><USER15> So in the spirit of what IH actually is, will the financial details be shared?

<comment><USER16> As much as I would personally love to share, there are of course other employees working at Stripe and other acquisitions that Stripe will make in the future, which complicates things. What I _will_ do is try to be as transparent as I possibly can about what's going on behind-the-scenes, traffic numbers, product and growth strategy, etc. I've always thought it was cool that I got to talk about growing Indie Hackers itself at the same time that I've been talking to other entrepreneurs.

<comment><USER17> Why do those factors prevent you from sharing? Transparency is difficult, but isn't that the whole point of Indie Hackers?

<comment><USER18> The logical assumption would be that they gave IH a _very_ sweet deal, much sweeter than they'd generally offer an acquisition target with similar financials. So if they release the details, future acquisition targets will expect similarly sweet deals, which Stripe has no interest in seeing.

<comment><USER19> Or made OP feel that way...

</comment></comment></comment></comment></comment><comment><USER20> Congratulations, Courtland! Your work has challenged silicon valley attitudes that success is measured by funding. It's refreshing to read about how achievable a profitable, lifestyle-supporting business can be. Good luck at Stripe!

</comment><comment><USER21> Does this mean IndieHackers become the propaganda arm for Stripe's customers? Or is this a goodwill purchase? Maybe it's cheaper than a national ad buy targeted directly at potential new customers?

<comment><USER16> There's a lot of alignment between what I want to see (personally) and encourage (via Indie Hackers) and what Stripe's mission is: more people _starting companies_ and _finding success_. It goes much further than simply advertising. If Indie Hackers and other efforts to inspire + educate + empower entrepreneurs can grow to have sufficient impact, then it will materially improve Stripe's bottom line. And of course, Indie Hackers stands to have a much higher chance of accomplishing this with some actual support from Stripe.

<comment><USER21> Congrats on building something real and I hope the acquisition works out well for you and the company in the long run. I've enjoyed, and been inspired by, a number of IH articles.

</comment></comment></comment><comment><USER22> Congrats to the involved parties, great job, etc.

IH is/was, unfortunately, full of unsubstantiated stories and made up numbers, presented by owners trying to upsell their business, without any verification or "hard questions" by the site owner.

As we see, this worked.

I'm not sure what's the lesson here. Fact-checking is for losers maybe?

<comment><USER23> > _full of unsubstantiated stories and made up numbers_

Possibly, but how would you know?

And what would some good hard questions be?

Edit: Okay maybe because of this one [https://news.ycombinator.com/item?id=13591182](https://news.ycombinator.com/item?id=13591182)

</comment></comment><comment><USER24> One of my favorite sites that provided real value. I guess IndieHackers did a lot of things right which created such fast growth with a quick exit.

1) Great design. Really professional feel (even though it just a wordpress blog)

2) Regular updated content to keep visitors coming back.

3) Highly targeted to hacker community / product creators - no wonder it was featured over and over again on the front page

4) In built SEO and traffic. People who are featured on it link back to it. People link to it for inspiration (great social signals).

What else? Anyone else wanna chime in?

<comment><USER25> I'm not sure it's wordpress, from the source code it looks like a custom Ember app but I might be wrong.

<comment><USER24> You are right. I checked the source code and found "Wordpress" a bunch of times but it looks like it's because "Kanban for WordPress" featured on the homepage. Regardless their design is really slick (especially the sorting and filtering on top) which definitely helps increase the site interaction and usability.

</comment></comment></comment><comment><USER26> I bet the total acquisition price is less than Stripe would wind up paying a content agency for fees, placement, etc. over a couple of fiscal years for similar exposure.

And they're getting all the goodwill & talent alongside of it as the cherry on top.

Brilliant move @stripe and congrats to the founders.

<comment><USER27> Wouldnt that imply not so brilliant move for the founders? The way you've worded it, it sounds like the founders could have got a lot more?

<comment><USER11> Could the site have continued to grow massively month over month for the next few years? If so, the founder probably would have earned more money independently. The HN audience is large, but it's not infinite, so growth could have stalled at some point. That's risk and reward; who knows? And who knows if maximizing profit was even his sole goal. Perhaps it was exposure, or building a real community to help folks start new businesses. Wherever the site was headed independently, I'm willing to bet Stripe can accelerate the process significantly, and that counts for a lot.

</comment></comment></comment><comment><USER28> Maybe I'm too cynical. This just seems like corporate largesse on Stripe's part, which is kind of neat, except for what happens to things like IndieHackers when that largesse runs out.

I guess nice to know Stripe's doing so well they can fund random stuff… ?

</comment><comment><USER29> Now indie hackers should be interviewed on indie hackers :O

<comment><USER16> Check out the timeline! I've written quite a lot about Indie Hackers from the beginning: [https://www.indiehackers.com/timeline](https://www.indiehackers.com/timeline). The meat of the content is in the monthly review posts.

</comment></comment><comment><USER30> Courtland, this is absolutely fantastic. Congrats man!

I'm wondering how this works out for you as an entrepreneur. Obviously now you're working for a larger corporation, but does your long-term vision align? For example, is your deal structured in a way that growing indie hackers also personally grows your income? Or is it now just a strict employee-employer relationship with a bonus (acquisition offer) upfront?

<comment><USER31> Correct me if I'm wrong, I think the deal benefits stripe as it acquires a good (and growing) user base.

</comment></comment><comment><USER32> Awesome, Looking forward to seeing what the deal was worth! Would be a real shame if this was hidden behind an NDA or what not.

<comment><USER33> I hope it is hidden. The site owner shouldn't have his/her finances broadcast on the internet. Friends come from the woodwork when they find out you just made $x million (not speaking from experience unfortunately).

</comment></comment><comment><USER34> Transparency is what makes IH great. I don't see this sell as a good move, if Stripe cannot appreciate that, and allow you to disclose how much you get from the deal.

</comment><comment><USER35> didn't see this one coming! major congrats to Courtland.

just a thought on the power of Hacker News to get noticed by 'players'. surely Patrick Collison heard of Courtland/Indiehackers and Patrick McKenzie through browsing Hacker News? so it's not all procrastination posting here

<comment><USER36> It's definitely not procrastination posting. I've formed valuable relationships from people who have reached out after a comment I wrote. Aside from that, commenting on HN is a great way to practice my writing skills, which I rarely get to use since my day-to-day work consists largely of programming. The community here is invaluable in that it provides an audience for your writing, so long as you are willing to fit your arguments into an intellectually rigorous framework and provide sources when necessary. It's much easier to hone your writing ability when you have an audience, and I am very grateful to HN for providing one. I hope the community can avoid a "eternal September" problem and continue providing a valuable service.

<comment><USER35> Yeah, i hope it doesn't turn out like wickedfire!

</comment></comment></comment><comment><USER37> Congrats to csallen.

This makes me ... feel weird. Not sure what it is exactly. Let me explain.

I'm an aspiring indie hacker. Currently soaking in the relaxation of a much needed sabbatical following my previous 8 year long employment (what a ride that was). When I'm ready, I'm going switch gears and devote myself to starting a bunch of small "indie hacker" type projects. I've been on HN for quite awhile now and I always enjoy reading about startups and being engrossed in the YCombinator community. My previous job was a startup, but I was purely in technical roles. I think it's time to get my feet wet on the business side.

So I've followed IndieHackers.com intently. I went so far as to read almost all their interviews and breakdown my analysis in a blog post ([https://hackernoon.com/indie-startups-the-ingredients-of- suc...](https://hackernoon.com/indie-startups-the-ingredients-of- success-74531fe3a019)).

After awhile I really started to dig the whole "indie hacker movement". The idea that SV type startups aren't the only game in town. You don't have to build a rocket ship. You can built a fighter jet. You may not make it into space, but fighter jets a cool too.

I didn't start digging it just because it sounded cool, though. The idea that these kinds of one or few developer teams could start consuming the lower hanging fruit that SV startups won't touch because they aren't explosive growth opportunities? It just makes sense. Yeah, in some way it's just small business reinvented. But Courtland said something that stuck in my mind. The vast explosion of developer tools, libraries, SaaS, cloud computer, APIS, etc over the past few years has laid the foundation for single person teams to tackle problems they never could have managed alone in the past. It reeks of opportunity.

So, with all that background, this acquisition makes me feel weird. On the one hand, I'm totally happy for csallen. What a great thing to happen. I don't mean to down play that at all. On the other ... it's sad to see his indie business die. Perhaps he doesn't see it that way; dying I mean. Obviously this is a great opportunity for him and his brother to focus on what's important for the site. That's a good thing. But it does mean IndieHackers.com is no longer an indie hacker business itself. That's why I feel weird about it.

I'm of course concerned about Stripe's intentions. IndieHackers is a great resource, and it'd be a shame to see it consumed by typical corporate greed and manipulations. I don't mean to imply that's Stripe's MO. But I think I'm not the only one afraid of that, founded or unfounded. Plenty of people here are already calling foul on IndieHackers for their past behavior.

At the end of the day I'll get over the fact that IndieHackers is no longer an indie hacker. But I really do truly hope that it stays true to its core mission: to provide a platform for us to share our stories, unfiltered and transparent.

Congrats, and thank you csallen.

<comment><USER38> the word is "betrayed". And you are not alone in feeling in such way. IH outright lost its essence and what gave sense to it.

<comment><USER37> I don't feel betrayed, no. There are plenty of companies interviewed on IndieHackers.com that started as small shops and eventually got acquired. I've got nothing against that, obviously. It's a great opportunity to cash out and do something else fun.

It's just weird to have IndieHackers.com, which I sort of viewed as a bastion of the movement, suddenly no longer part of it.

At the end of the day ... I'd probably do the same thing as csallen, if I were in the same position. He talked several times about how time consuming it was to find sponsors for the site and podcast. As a consumer of the site, I started noticing more and more ads showing up and interrupting the content. Hopefully Stripe will help reduce that. It wasn't clear from the OP if they intend to do away with all sponsorship. That would be really nice!

<comment><USER16> Thanks fpgaminer for following along and being one of the few crazy people (including myself) to have read so many interviews!

Totally understand your view about the acquisition... but I wouldn't say Indie Hackers is no longer part of the movement. I'm not cashing out and doing something else. Rather, I'm going back to spending all of my time improving the site itself and trying to make it more useful to more people. Yes, Stripe is helping me do away with all sponsorships!

<comment><USER39> > I'm not cashing out and doing something else.

I get that the cash infusion from Stripe allows you to not have to worry about sponsorships but if you are not "cashing out" in some way, why go the acquisition route?

I think parent is right. Indie Hackers is now Stripe's baby and it is normal that after a few years, you'll get bored and move on to more exciting things.

Anyway, I hope the timely release of the weekly podcasts is now a forgone conclusion.

Congratulations on the acquisition Courtland!

</comment></comment></comment></comment></comment><comment><USER40> w00t w00t, congrats Courtland, this is awesome!

Indiehackers has tons of great content that can seriously help companies using Stripe Atlas. Together, IH+Stripe could helps companies go all the way from incorporation to profitability ;)

</comment><comment><USER41> Wow, 6k in ad revenue per month sounds a lot. How many page hits are required to get this kind of ad revenue?

<comment><USER16> Not as many as you might think. It's more about having a specific and valuable audience and doing sales. I've written about it a bit in some of my monthly review posts: [https://www.indiehackers.com/timeline](https://www.indiehackers.com/timeline)

<comment><USER41> Oh, thanks for the link. This is quite incredible.

Where are the ads btw? I don't see a single ad on your website :-) Or did you remove them post-acquisition?

</comment></comment></comment><comment><USER42> And yet here is what is wrong with the tech world, people start speculating on acquisition price and how much other people made even though news are about an awesome product and community joining another awesome product to make even more amazing stuff.

Btw. the best growth hacking is building an amazing product which sells itself. Click-bait articles, well ok you need some eyeballs but interviewes always reflected my expectations unlike BuzzFeed stuff.

Big congrats!

</comment><comment><USER43> Wow! Congratulations Courtland! I've followed IH from day zero and it's been such a great learning experience. Really happy for you man!

All the best at Stripe!

</comment><comment><USER44> Will you change the name to mainstreamhackers.com?

</comment><comment><USER45> This is dope. Salute to Courtland and Stripe.

</comment><comment><USER46> I know it is a useless comment for HN, just wanted to say _congrats_ because I think it is really well-deserved.

</comment><comment><USER47> Just wanted to say congratulations to Courtland! I've seen you share the progress of your business since it was introduced, and to see it grow and become so successful is very inspiring. You earned this! Hopefully it motivates others as well. I think it might have motivated me.

</comment><comment><USER48> IndieHackers is an awesome sight, and with Stripe Atlas, I see a good vertical developing. IndieHacker is an inspiring high quality source. Definitely, agree with Patrick of Stripe, the execution was stellar.

</comment><comment><USER49> That was fast

<comment><USER50> Indeed, more like an acquihire at this stage.

</comment></comment><comment><USER51> Didn't see this one coming! Congrats @csallen on the acquisition and congrats to Stripe for recognizing the great value IH has been providing since launch!

</comment><comment><USER52> This is really amazing! Very helpful site and a wonderful thing that makes me confident in the reasons why I use Stripe for my payment processing needs! :)

</comment><comment><USER53> That's a really unexpected announcement, but congratulations! Hope this changes the site for the better, not the worse.

<comment><USER54> Take heart: it means we'll spend less time managing ads and experimenting with business models, and more time cultivating the community and improving the interviews and podcast!

</comment></comment><comment><USER55> Wow, congrats!

</comment><comment><USER56> Congrats to getting acquired for such a simple site and idea that provides great value. Inspiring

</comment><comment><USER57> Nice to see your hard work paid off!

</comment><comment><USER58> Congratulations, Courtland! Really happy to hear this! Keep up the awesome work!

</comment><comment><USER59> Congrats! I have always loved and been inspired by the stories at IndieHackers.

</comment><comment><USER60> What a brilliant site, definitely an inspiration! Congrats!

</comment><comment><USER61> Awesome! See, sometimes good things happen to good people.

</comment><comment><USER62> Congrats to Courtland!

Happy to be one of your interviewees!

</comment><comment><USER63> That's incredible. Congratulations!

</comment><comment><USER64> Guess we need one post about IH on IH.

</comment><comment><USER65> Congrats to csallen – I have recommended IndieHackers to many a fellow developer, it's a great project!

</comment><comment><USER66> Congrats, Courtland! If I were to be acquired by any company, I'd want it to be Stripe!

</comment><comment><USER67> Congratulations on a wonderful and inspirational site!

</comment><comment><USER68> Kudos!

</comment><comment><USER69> Super cool & congratulations.

</comment><comment><USER70> congratulations, that is a great new.

</comment><comment><USER71> I've been reading HN for 5 or 6 years and this feels very strange to me. From the comments in here by the principles it kind of seems like Stripe is doing IH a favor. A few things that stick in my craw:

1\. This seems like it would be damaging to IH's brand image (since it will now be perceived as a PR arm of Stripe, and it's all about independence)

2\. Stripe's stated goal here is simply to ensure the success of IH in order to drive more people to start companies. That's not exactly compelling on it's own, and with (1), even less so.

3\. IH was apparently very big on financial transparency, yet the principles are being decidedly opaque about financials in this thread.

Are these types of deals common? Does Stripe own any other media companies?

[note: these are just my thoughts. i don't think i'm entitled to any further explanation nor do i think anything nefarious is going on.]

<comment><USER72> >IH was apparently very big on financial transparency, yet the principles are being decidedly opaque about financials in this thread.

Financial transparency about profit from a bootstrapped startup is a different from financial transparency about a contract between two parties. Secrecy around the latter is a little more understandable.

<comment><USER17> Why?

<comment><USER73> Well, it was Courtland's right to publish his financials when he was the sole proprietor of IH. Now he's a Stripe employee and therefore is governed by their policy on the matter, I assume.

</comment></comment></comment></comment><comment><USER74> IH is a refreshing flip side to the VC/YC narrative that's become canonical in the startup world! As againsit VC valuations, and pressure of growth at all costs (mostly profitability), IH companies prioritize organic, sustainable growth without loss of founder control. Many of them end up financially successful, which is inspiring to aspiring entrepreneurs.

Well done Courtland Allen! Without IH, this flip-side view of startups wouldn't have a platform.

</comment><comment><USER75> 2 months ago, HN was ripping apart IH:

[https://news.ycombinator.com/item?id=13591182](https://news.ycombinator.com/item?id=13591182)

But at HN, it seems we have short memories and money triumphs morality.

<comment><USER76> The thread you link to is about a story which was published on IH. Sure, publishing this story wasn't a highlight for IH, but starting two swing the morality hammer is a bit much.

<comment><USER75> read it again, they were ripping IH for letting dubious submissions through without proper vetting.

2017 Feb: "I'm never using IH again"

2017 April: "I love IH"

<comment><USER77> It's almost as if HN is made of a community of different people with different personalities and motivations.

</comment></comment></comment></comment><comment><USER78> Hacker: "a person who uses computers to gain unauthorized access to data."

This word is not a good connotation, and a company that's an online/mobile payment gateway buying a company with "hacker" in its name that doesn't seem to understand the definition of the word "hacker" doesn't look good.

It wouldn't matter to me what IndieHackers did, I would have passed them up just because they use a nefarious word in their name without understanding how it's used.

<comment><USER79> You do realize you are posting this comment on a site called Hacker News?

[https://www.merriam-webster.com/dictionary/hacker](https://www.merriam- webster.com/dictionary/hacker)

Also just to be thorough there is the dictionary definition of hacker. Your definition came in at 4th place.</comment></comment>