Show HN: Automatic account and SSH access provisioning tool for server admins - <AUTHOR> https://bastio.com/

<comment><USER2> Sorry to be another debbie downer, but this is not a good idea.

1\. It's a huge security no-no. Much better would be having users run a daemon that polls for updates. At least that could _probably_ be done while maintaining _some_ semblance of security.

2\. Admins don't need help with this, not really. Any competent admin will run Puppet (or Chef, or LDAP), which makes this stuff the most trivial thing you do.

I'd recommend a quick pivot (like let people run it themselves against their own servers) or just abort mission and chalk it up as a learning experience.

<comment><AUTHOR> How is what we're doing less secure than, say, provisioning servers through a provider like Linode that gives customers a web-based access panel? (One can use their provisioning tools to create users with root access.) Also, running a daemon may make folks more comfortable, but the reality is that the daemon still has the ability to add users, which in turn can be used to log in. Running things through a daemon certainly makes monitoring and firewall setup more manageable, though, and we're working on it.

LDAP is a bit of a headache to set up for some shops.

<comment><USER2> A daemon could be smart. Only allowing certain operations (e.g. adding non- root users) and it could send email directly to the account holder informing them every time it does so. SSH access doesn't even need to be open for a daemon to poll. Even if a hacker managed to add an account they might not be able to use it.

Whereas your current method requires remote root SSH to be accessible from at least your network. Hacking you means immediate unfettered access to every one of your users.

I'd recommend a daemon and explicitly telling people to firewall off SSH from anywhere that isn't their own network.

<comment><AUTHOR> I think you're right - we should include those instructions for now, and provide a bastion-as-a-service later. The daemon route is clearly preferable for customers, so we'll build that out (we already have manual key-adding confirmation, and we record the IPs of people who attempt to download/upload keys).

I would note, though, that if we're hacked, the attacker doesn't get access to the users. We actually don't store the encryption keys for the deployment keys; the client does. Still, the daemon route is what we need to do. Thanks for the feedback.

</comment></comment></comment></comment><comment><USER3> I personally don't feel comfortable using your service - too much of a security risk giving Databracket LLC unrestricted root access. I guess most other security-minded people would not feel at ease as well.

Having an agent running on the servers would be much better.

First, it will not require unrestricted SSH root access to the servers. Most of the servers don't allow root to login through SSH at all.

Second, an agent restricts the harm that could be done if somebody hacks their servers. This could be achieved with restrictions (specific commands, IP addresses) to the key that is added to root's authorized_key, but there is no mention of that in the FAQ or the other docs.

Third, firewall management - good luck convincing somebody to modify the firewall to allow connections to the SSH service on all of their servers. A restricted agent will be a much easier sell.

<comment><AUTHOR> Thanks, that's a great point that the agent is an easier sell. We're going to add one soon so people won't feel uncomfortable opening up their SSH ports. We've heard this a lot and really appreciate the feedback on this point.

</comment></comment><comment><USER4> The idea is nice but the execution is flawed.

When teaching users new to Unix systems I tell them to guard the root password / anything that gives you root as closely as possible.

When securing systems you generally even want to disable root logins period.

I don't feel comfortable with giving a 3rd party credentials to my servers and I don't recommend others do the same.

A downloadable product is really where you want to be headed with this. I'm okay running putty or winscp where I get to have full control of whatever keys I put in.

</comment><comment><USER5> "We require that you deploy our public key to your root account's authorized_keys file so that we can provision users on your behalf."

That feels like a big requirement. What is the gain of using your UI/service over using puppet in-house and creating your own UI?

<comment><AUTHOR> Well, we talked to server admins (mostly at companies that run servers on behalf of web design or web services clients) and heard that they didn't want us to impose the requirement of adding another package to their deploy scripts. They'd have to keep the version up to date, make sure it's installed on their machines, etc. That's feedback was really the only reason why chose to impose this requirement for the beta.

I'd love to hear more about your use case and if you'd feel more comfortable having a daemon run on your servers (so that our service wouldn't have root login ability).

<comment><USER5> Just about anything would be better than 100% root access and "employed measures to make sure that we never have unattended access to your servers", and there's no reason you can't offer two solutions.

<comment><AUTHOR> You'll have to develop a cryptographic scheme makes sure that when your management service is compromised, it does not affect the servers the management server controls. We've done that work.

Say we have a daemon though - the daemon would require root access in order to create user accounts. If the management service is compromised, the user accounts can be created. That's why we've made it infeasible to access SSH keys even if the management server is compromised.

</comment></comment></comment></comment><comment><USER6> I'm not going to comment on the security of giving somebody an ssh key to your root account... But it's a good idea to look at something like puppet to do this.

Example: <https://github.com/credativ/puppet-ssh-hiera>

</comment><comment><USER7> $4 a month per server for a rsync script I could write myself combined with our existing ldap infrastructure? If it were a nice open sourced tool I would consider it but at hundreds to thousands a month I could never justify it to myself let alone my boss.

</comment><comment><USER8> I can largely do all this with Ansible and it's flexible enough that I could probably get pretty close to being as easy as a good web UI. They devs behind Ansible are also working on Ansible Commander which will provide a UI. The UI will likely be the difference maker, so you should include screenshots so that I don't have to create a new account for yet another service I may never again log into.

The pricing probably doesn't reflect how people would use this. The free plan is basically just a way to see how it works as you wouldn't need something like this for just one server. Maybe you should increase the free plan to a few servers so that I could see how useful it might be.

<comment><AUTHOR> Thanks, we've removed the server limit for the moment and put up a screenshots page. Any feedback you have on the UI and how we could make it more useful to you than Ansible (besides our autogenerated scripts) would be awesome.

</comment></comment><comment><USER9> Hello guys. Founder of <https://commando.io>. Commando.io is a web based interface to execute commands on remote servers over SSH. You can write commands in bash, perl, python, ruby, or even node.js. We seem to share some of the same ideas and vision. When you generate a public key in bastio.com do you also add a password to the key as well? I.E. if somebody were to compromise your server, they would need the SSH key password to SSH into other users servers?

<comment><AUTHOR> If someone were to compromise our server, it is extremely unlikely that they would be able to recover the SSH keys. The keys remain encrypted except when they're needed to perform an action initiated by an authenticated user.

<comment><USER10> Sorry, but this sets off my bullshit detector. If someone compromises your server he also has access to the routines decrypting the ssh keys. How do you encrypt them?

<comment><AUTHOR> Hi - It's not enough to compromise the Bastio servers. Some of the data facets needed to successfully decrypt the SSH keys are stored securely in the browser. This is why we can't deploy OS users or keys if a Bastio user is not logged in and active.

<comment><USER10> That is better but not good enough. If your servers were compromised, that attacker could add JS code to your page that quietly farms that facets that are securly stored in the browser, when the user logs in.

Makes it harder against a targeted attack, but does nothing for the average user.

You can mitigate the problem by having a really good intrusion detection system, but not eliminate it.

<comment><AUTHOR> It's harder than it sounds, as we use HttpOnly cookies and, much more importantly, have little to no XSS attack surface.

As far as injecting JS after server compromise: At that point, an equal concern is really attacker access to application memory, as we protect against the (admittedly edge) case where the attacker replaces the served Javascript but doesn't have access to memory. We've taken steps to reduce the opportunity for memory compromise.

Also, we are actually working on a reaction-oriented intrusion detection system that will take appropriate actions when invariants are tripped. But more importantly, we're moving to the daemon model, where customers have much more control over the security of their systems at the network level.

Many service providers, including DNS and hosting providers, use web-based control panels and must properly secure their systems. It's not a requirement that's unique to us. If you offer SaaS, you have to lock it down.

<comment><USER10> Of course the requirement exists for all SaaS providers. But while a break in on Evernote reveals my notes (which would be bad, but not lethal), a break in at bastio might compromise the servers where I host my SaaS products, triggering a very nasty chain reaction.

So while the risk you face may be the same, the damage that can be done is vastly greater. But I'm sure you're aware of that.

Assuming someone gains root level access to one of the boxes bastio is hosted on, then he could

1a. block all outgoing traffic from the server except for the service (to avoid alarms getting through) or 1b. replay the heartbeat sent by the server 2\. retrieve the database 3\. Sniff on all incoming traffic for the HttpOnly Cookies

The worst thing is you might not even know which customers' keys are compromised.

I'm sure you are thoughtful about security, but of course you are a great target because of the valuable loot (root access lot's of other servers)

A lot of your concerns are considerations for me too as I am thinking of launching a distributed SaaS. Just take it as input to your threat analysis :)

<comment><AUTHOR> Yeah, definitely, it's all an input to the threat analysis. Thanks for the great discussion. It's interesting stuff and fun+important to just think through.

Yes, you're right that someone could intercept the HttpOnly cookies, but as you said, only if they were able to compromise the server, since we use SSL and won't have any XSS surface.

Also agree that alarm or heartbeat-based IDS stuff won't cut it here. We're working on an (agent-based, with signed code deployments) IDS (<https://sentryhq.com/>) that sits on the server and makes decisions to take certain actions not just when an attack matches some probably-out-of-date rule, but when some ever-growing list of invariants change. It's kind of like what banks use, except it responds automatically.

We will eventually be able to overcome all of these concerns (in the daemon- based model, wherein we don't store server keys) by validating OS user key distribution commands with secure emails to the people who requested them + nonces for confirmation. At that point, if we can enforce best practices amongst our customers, we can probably reduce the security problem to the trust problem, which is as solid as can be expected.

Actually, what do you think about such an IDS? Usually the tactic is "let my admins respond," but you are quite correct that that isn't sufficient, as your IDS may pick up the attack but the response may never come. We are thinking that the response isn't usually fast enough either.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm sorry, but LDAP does this on a much larger scale for free. Nice idea, however wrong way to go about it big time.

</comment><comment><USER12> why on earth do you need remote shell access to the machine?!

it seems to me that a self-hosted solution (one-time fee or recurring license fee would be fine with me) would be ideal, otherwise i'd have to worry about security of not only my machines, but also yours. plus, i don't even allow root logins.

perhaps an agent model would provide good middle ground: provide a daemon that runs on the server and waits for account creation requests pushed from your service. these wouldn't be executable commands, but rather JSON or some DSL specifying account username, group, password, initial SSH key, skel, etc. a compromise of your machines wouldn't allow remote commands to be executed on your customers' machines (provided the daemon isn't exploitable).

</comment><comment><USER13> No serious shop will use this. If you release it as an open source project, perhaps someone might find it useful. If they aren't using LDAP/Puppet/Chef/etc . Checkout freeipa.org and <https://oss.gonicus.de/labs/gosa> .

</comment><comment><AUTHOR> Hi, one of the creators here. We build this because we run our own machines and wanted a easier way to manage our OS user accounts and SSH keys across machines. We put together a beta service to do just that, and would love to hear what you think.

<comment><USER14> I can't imaging trusting a 3rd party to provision userId's and SSH keys for my servers. Am I missing something here?

<comment><USER15> I was thinking the same. Perhaps if the setup procedure included a limited- access account that could only run useradd/userdel, I'd consider trying it, but definitely not while root.

<comment><AUTHOR> Thanks for the feedback. For the one-time server enrollment process, would you be more comfortable having us set up a limited account using a script we provide? We were thinking that there's not necessarily a whole lot of difference between a user who has useradd permissions and a user with root permissions.

Also, we set up Bastio so that we don't have unattended access to your servers. We keep everything encrypted until the moment when we need the keys for account provisioning or keypair deployment.

<comment><USER15> I'm not sure I'd even go that far. A set of commands showing how to lock down account permissions would work just as well, while allowing me to remain in control. That is a good point though, as Bastio would be able to create unrestricted administrative users anyway.

Where are your encryption keys stored in relation to our connection data?

<comment><AUTHOR> There are multiple layers of encryption and the keys are distributed in such a way that the client must login and provide the data facet we store in the browser. The combination of this and other data facets provides the combination that unlocks the private key we use to conduct deployments.

</comment></comment></comment></comment></comment></comment><comment><USER16> with a catchy domain like bastio, perhaps you should try pivot into doing something actually more useful like bastion host as a service w/ 2-factor openvpn authentication.

<comment><AUTHOR> We were originally going to create a bastion but got some early feedback that server admins wanted user management, and a bastion as a side feature. We've got two-factor auth right now. Would you use a bastion + user management, or if not, what's your need for the bastion besides the need for a solid, secure, locked-down entry point?

<comment><USER16> to be honest, it'd have to be coupled w/ ec2 or some other cloud providers, that presets proper deployments with firewall/authentications. that'll be then something i'll definitely be interested in.

</comment></comment></comment><comment><USER17> did you write your own valid email address checker regex? It doesn't follow <http://tools.ietf.org/html/rfc5233></comment>


Board game for learning lean startup - <AUTHOR> https://www.kickstarter.com/projects/44846941/playing-lean

<comment><AUTHOR> I would love to know what Eric Ries or Steve Blank would say about this board game.</comment>


Using Great Customer Service as a Differentiator - <AUTHOR> http://www.instigatorblog.com/great-customer-servic/2008/07/09/ <comment><AUTHOR> "Be Faster Than Everyone Else. The simplest way to master great customer support is to be fast. You don't need an army of customer support people to be fast, you need an efficient system with multiple channels for handling inquiries."

This made Coordinatr (now Anyvite) stand out to me. They have a feedback box on every page and they responded to every comment I made within minutes (even late at night or early in the morning. pg must beat that point home, because I've had similar good experiences with the SnapTalents and DropBoxes.

<comment><USER2> When you email Wufoo, they respond before you can hit "send."

<comment><AUTHOR> That's going on the "Has PG ever made a joke online?" list.

<http://news.ycombinator.com/item?id=234582></comment></comment></comment>


Make Your Own Grid Paper - <AUTHOR> http://gridzzly.com/#t

<comment><USER2> [Shameless plug] If you want A4 or US letter gridded paper for sketching a mobile, web or tablet UI, I have a bunch of free ones on my site.

[http://www.interfacesketch.com](http://www.interfacesketch.com)

</comment><comment><USER3> My favorite graph paper: [http://whitelines.se/function/](http://whitelines.se/function/)

<comment><USER4> They have a patent on white lines on slightly greyed paper? Amazing.

<comment><USER5> Maybe not the idea itself but a method to print it?

<comment><USER6> Nope.

Claim 1: white-ish lines on light grey paper.

Claim 2: As above, but more closely matching white and grey.

Claim 3: Either of the above but with a slightly colored paper instead of gray.

</comment></comment></comment></comment><comment><USER7> This is a fun website. I made my own grid paper in undergrad. It started late one night after all the bookstores were closed and I ran out mid-problem in dynamics class. The Professor took off points for not using grid paper so I made my own out of Excel grids(I wrote on the flip side). I didn't lose any points and continued for the remainder of the semester. At the time, the university printer computer labs did not have a printer quota.

</comment><comment><USER6> I still buy preprinted grid paper and staff paper. It is extraordinarily difficult to force a printer to use the exact same width on each line. There are just too many layers of abstraction between the browser/document and the hardware.

<comment><USER8> Most of the time the 'smart' printer software is to blame. But I think if you stick to world units and print at 100% you will be fine.

Remember that dpi only controls print quality not print measurements. One cm printed at 300dpi will have the same length as one cm at 72dpi.

<comment><USER6> The problem comes in the thin lines. If they don't fall exactly on the hardware pixel boundaries they will vary in weight. If you can get the printer to think in monochrome instead of some larger dithering cell you have a chance.

<comment><USER9> There's also that pesky bugaboo about being permitted to own a genuinely accurate printer, and whether or not you'd use it to counterfeit money.

</comment></comment></comment></comment><comment><USER10> I'm surprised it doesn't have a feature for intermittent breakpoints, like every 5th or 10th interval. I find that very useful for small size grid-lined paper.

Still, this is very nice, it's easy to see the potential for other features.

<comment><USER11> Or greenbar.

</comment></comment><comment><USER12> My canon mx860 can actually do this straight from its menu haha. There's a few options for college ruled, wide ruled, and grid paper. This web app has more choices, but the printer makes some amazing paper as is :D

</comment><comment><USER13> Oh wow. I love this idea (edit: AND execution!).. I guess it's a minor bummer that I assume my printer won't print full-bleed but still... Things I'd love even more: Indications of exact sizing and the ability to choose what shade of gray/black to be printed.

<comment><USER14> This one has some of the options your are looking for such as spacing, color, and page border: [http://incompetech.com/graphpaper/](http://incompetech.com/graphpaper/)

<comment><USER15> Gridzzly (and why is this not gridzz.ly?) is nice and all, but the Incompetech generator is in fact much better. Still, we're startup fanboys, we're not that bothered about substance if there's some nice style on offer.

</comment></comment></comment><comment><USER16> I'm assuming OP is the author:

very nice idea, very nice execution. Few things that imho need to be fixed (probably fast fixes): 1) Ensure that the print settings are correct. i.e. the pattern get splitted on two pages, for no reason. 2) resizing the browser window stretches/squeezes the picture. You shoud probably listen to the resize events and re-trigger the generation, change the patterns to some css, or simply set the generated image as cover. 3) translate the code in english. In softwares, having standards is a good thing.

</comment><comment><USER17> This is a doddle in PostScript. [http://www.jasonpratt.org/software/graphpaper/](http://www.jasonpratt.org/software/graphpaper/)

</comment><comment><USER18> [http://gridzzly.com/getGrid.php?bunka=sit1&rozestup=3&width=...](http://gridzzly.com/getGrid.php?bunka=sit1&rozestup=3&width=100000&height=100000) seems to crash any browser I throw at it. Granted you are trying to load a very large image, but still was surprised. It may 500 Internal Server Error I'm guessing if server runs out of memory while trying to make these large images.

</comment><comment><USER19> I'd like to be able to add my own pattern - because few of somewhat useful are missing and for other reasons.

</comment><comment><USER20> looks fun! being able to input specific dimensions would be nice, e.g. 5mm or .25" grid

<comment><USER21> I agree, the only thing this is missing is actual units (both metric and imperial).

</comment></comment><comment><USER22> On a related note, for grid paper for practising Chinese (or Japanese) characters, check out my site: [http://www.hanzigrids.com/](http://www.hanzigrids.com/)

</comment><comment><USER23> How about fancier graphing paper: Gaussian, log-normal with specified parameters, ...

</comment><comment><USER11> Seems like something TeX or LaTeX could do.

</comment><comment><USER24> Thank you.</comment>


Providing Equitable Access to Computing Education - <AUTHOR> https://cacm.acm.org/magazines/2018/8/229757-providing-equitable-access-to-computing-education/fulltext <comment><USER2> > CS departments have an ethical obligation to ensure access to these > opportunities is equitable.

Seems easier to make this sentence false than to attempt all the acrobatics that - according to this article - follow from it being true. So why don't we?</comment>


Design is Expensive - <AUTHOR> http://prog21.dadgum.com/199.html

<comment><USER2> An interesting thought I ran across once, is that there is no such thing as "no design":

> Questions about whether design is necessary or affordable are quite beside > the point: design is inevitable. The alternative to good design is bad > design, not no design at all. -- Douglas Martin

<comment><USER3> There are plenty of ways to get random, emergent and simply chaotic outcomes when building a system without thought or care. I wouldn't call those things 'designed'.

<comment><USER4> They aren't designed in the traditional sense that someone arranged those things with intent or clarity.

But the lack of care, on purpose or as oversight, also makes a statement–it means something, and definitely signals a point of view (even that of lack).

</comment></comment></comment><comment><USER5> As the author notes, taking the time to design anything (including a video game) yields better results than a simple combination of concepts.

His example of sounds while displaying graphics shows that even if graphics are decomposable, sounds are linear, and as such, require a different modality of planning and design.

</comment><comment><USER6> It is not often I find an article written about true design. Great read/conclusion.</comment>


Fear and Loathing in APL (2015) - <AUTHOR> http://theburningmonk.com/2015/06/fear-and-loathing-with-apl/ <comment><USER2> I got 500 error. Here is cache: [http://webcache.googleusercontent.com/search?q=cache:9IikFjT...](http://webcache.googleusercontent.com/search?q=cache:9IikFjTvgXsJ:theburningmonk.com/2015/06/fear- and-loathing-with-apl/+&cd=1&hl=en&ct=clnk&gl=jp)

</comment><comment><USER3> I'm seeing a lot more APL-related submissions in the past few months. What's going on?

<comment><USER4> One APL-related submission reminds people on HN of the existence of the language. Others begin reading about it, some even try it, and a few of them post subsequent links on HN. Repeat.

</comment></comment><comment><USER5> I was much confused by this example:

> AND and OR semantics are represented by ∧ and ∨ respectively.

> (1 3 5 > 6 2 4) ∧ (1 3 5 = 6 3 1)

> => 1 0 1

This is an error in the article. If you type the expression in TryAPL.org, it produces 0 1 0 - as logically expected.

</comment><comment><USER6> While it's interesting (pretty funny) that this language exists, it looks downright _awful_ to program in. Has anyone ever programmed anything sizable in it?

<comment><USER7> Kdb+ [0], a very high-performance and very expensive proprietary time-series database, was written in a dialect of APL.

I've seen demos of Kdb+ and it is very impressive. It is the top ranking non- GPU database in this benchmark [1].

It is however not the easiest of databases to use -- it uses Q (another APL dialect) as a query language. There was an HN discussion a while back about its maintainability and long-term prospects. [2]

[0] [https://en.wikipedia.org/wiki/Kdb%2B](https://en.wikipedia.org/wiki/Kdb%2B)

[1] [http://tech.marksblogg.com/benchmarks.html](http://tech.marksblogg.com/benchmarks.html)

[2] [https://news.ycombinator.com/item?id=11561573](https://news.ycombinator.com/item?id=11561573)

<comment><USER8> I wouldn't trust Marksblogg's tests. They focus on single-table "NYC Taxi" rides which don't represent most database use-cases.

He also claims he takes the fastest runtime of the queries over several runs, which is not how real tests are performed.

<comment><USER9> "He also claims he takes the fastest runtime of the queries over several runs, which is not how real tests are performed."

It isn't, but it should be. For any non-randomized run of the exact same work [1], by definition of non-randomized, any noise that appears in the results of multiple test runs can only be due to factors unrelated to the test being run, such as the OS decisions and such. Taking the minimum is the most honest way to factor those out. A possible exception for the first run, before CPU caches are warmed up.

[1]: Ponder that closely; a lot of the knee-jerk reactions to what I just said is handled by that; e.g., if the second time something is cached by the algorithm itself that was not cached the first time around, that's not the same work. Conceptually you can imagine that I'm shooting for the exact same sequence of CPU instructions being run on the exact same data values, though in practice that can be a tall bar to leap even before considering concurrency; as with almost everything in life if you look closely enough the boundaries get fuzzy.</comment></comment></comment></comment>


The Unbearable Lightness of Tweeting - <AUTHOR> http://theatlantic.com/business/archive/2015/02/the-unbearable-lightness-of-tweeting/385484/?single_page=true

<comment><USER2> Twitter has always been almost useless as a driver of traffic for me, but it has been a good medium for connecting with people I wouldn't have otherwise on the network itself. It simply doesn't bleed into the outside world all that much.

As a networking tool however, it's been way more effective than Facebook, LinkedIn, or any of the others I've used, and I fall very much into the casual/occassional user camp.

<comment><USER3> How? And what kind of people? Do you cold-call on reporters through it? Investors? People in your field? For me Twitter has always been a disappointment: cumbersome interface and a write-only mode where anything I say goes unanswered.

<comment><USER2> I've used it mainly on project-specific things, for example reaching out to musicians, indie labels, and festivals about a music-related service. Or reaching out to other developers/startups.

It helps to follow and get to know them a bit first, too. On Twitter, you can engaging in mini conversations with just about anyone, and once you're familiar with someone you can tweet at or DM them without coming off like a cold-call. Basically, just be yourself and it works wonders.

That said, I still tend to shy away from a lot of online interactions (just look at my stunted comment history on here for example ;). Yet when I do put myself out there, I tend to be surprised at the positive response.</comment></comment></comment>


Tune into DNA-Radio - <AUTHOR> http://www.dna-rainbow.org/dna-radio.html

<comment><USER2> The rendered images of the chromosomes are amazing...</comment>


Subscriptions are the New Black - <AUTHOR> http://500hats.typepad.com/500blogs/2010/02/subscriptions-are-the-new-black.html

<comment><USER2> Subscriptions have been 'the new black' and a mainstay of my income since 2000 or so, but subscriptions do not lend themselves to all kinds of content.

Advertising has always been a way to make otherwise losing propositions profitable, and as long as there are companies marketing products there will be advertising. It would be wasteful not to tap in to those dollars.

As Patio11 elsewhere already pointed out adsense is a form of micropayments, and micropayments are the 'pay-as-you-go' of subscriptions.

The only problem with that is that adsense is not transparent and it doesn't allow you to set your own price. In fact, you don't even know how much your inventory is really worth.

So if your site does not have a very tight coupling between the users and the sites, one that you expect to last for many months or years advertising is actually a very good solution, but adsense in particular may not be the best you can do.

Another problem with adsense is the fact that clickfraud benefits both google _and_ the fraudsters, so for advertisers it is very difficult to track whether they're spending their money correctly or not.

I wished someone would start to give google some serious competition in this space.

<comment><USER3> _Advertising has always been a way to make otherwise losing propositions profitable_

Or you could, you know, be the guy paying for the AdWords. I sell a product to consumers over the Internet. Stop the presses, I know. I have many competitors who do free versions essentially the same product, monetized by ads. My ads, since if Google polled the entire world saying "Hey who of you would pay cash money to speak to an elementary school English teacher currently making Reading Rainbow bingo cards?" I'd be up in the front row shouting "OOH OOH PICK ME!"

Since I know what Google charges me and I can estimate what Google keeps, I can ballpark estimate the CPMs for their sites. Its in the $2 a month range. The effective CPM for my site is more than twenty times higher than that.

Ads also have a pernicious effect on your product design. A core skill for B2C products is optimizing them so that the user gets through the workflow successfully. We optimize for success, because successful users pay us money. If you have CPC ads on your site, you have to _optimize for failure_ : the ad has to be more enticing than your application/content or _you don't get paid_.

Granted, there are some audiences who don't pay money for anything (why hello, students) and some applications whose users will not pay money for them (why hello, URL shorteners/social networkers/anything starting with the letters Tw), but _you don't have to make these_. There is literally infinite need for solutions to problems, even in B2C (C stands for consumer, i.e., one who _buys products_ ), that you could deliver profitably. And then spend a portion of those profits tossing nickels to sites without business sense so you can steal their users and charge them dollars.

<comment><USER2> > If you have CPC ads on your site, you have to optimize for failure: the ad > has to be more enticing than your application/content or you don't get paid.

I've been saying that for years, nobody believes it.

But it is definitely true, if you're a destination site and your clickthrough is lousy then you are in a good spot to do subscriptions. It means your product is better than that ads.

<comment><USER4>
       If you have CPC ads on your site, you have to optimize
       for failure: the ad has to be more enticing than your
      application/content or you don't get paid

If either of you ever come back to this conversation, would you please point me to a detailed description of this point?

I'm having trouble getting my head around it.

</comment></comment></comment></comment><comment><USER5> I personally enjoyed the articles bombastic formatting and snarky tone, but I'm not sure the author says much of anything. The fact is, Dave's second assertion (that e-commerce/subscriptions is the new default startup business model) isn't based on more than speculation. He makes this second assertion with great conviction ("Get Dem Bitches to _PAY_ You, G.") and I almost want to believe him--until I remember that most of both the media and content industries are still fumbling with whether or not selling subscriptions /digital content is a worthwhile business endeavor.

Also, the idea that a service's success hinges on a user's ability to remember a password is preposterous. Seems as if it could be somewhat of an obstacle when a service is first launched (Dave's early Paypal), but come on. Passwords have become commonplace, and for the most part--especially when money's involved--people don't seem to forget them. They may have when e-commerce was in its absolute infancy, but with the rise of ebay, Paypal, online banking services the password has garnered undeniable legitimacy among the majority of people. I have no data to back this up, but this isn't too outrageous a claim. Right?

Maybe I'm looking at this from the wrong angle.

<comment><USER6> >> Paypal, online banking services the password has garnered undeniable legitimacy among the majority of people. >>I have no data to back this up, but this isn't too outrageous a claim. Right?

nope, sorry you're wrong & yes you have no data to back this up. even with "100's of millions of account", it's likely PayPal has never been used by a large % of internet users -- perhaps even a majority -- and it's certainly not used frequently (ie, >1x / month) by more than tens of millions of users. even without me being there for 5 years i'm pretty sure any recent eBay quarterly stmt will back me up on that (note: accts != users != frequent users).

trust me: "the forgotten password problem" is STILL a huge issue for PayPal today, as it is with almost every large site... even one as frequent as PayPal (or Amazon).

if you think i'm mistaken, i suggest you talk to any major tech blog site that has switched to using Facebook Connect or Twitter oAuth for comment authentication, and the subsequent increase in comment activity.

it's not too much of an extrapolation to draw a similar conclusion around 3rd- party auth integrated with payments (which is what PayPal has been doing for 10 years).

</comment></comment><comment><USER7> McClure gets close to a good point but fails to convert.

Here's his solution to password friction: "Make a brain-dead simple, frequent- use product. If users login a lot, then they don't forget their password." He then lists the following examples that solve this better than PayPal: Social Networks, Email, IM, Games, Music, Entertainment.

I can't recall the last time I needed to use my password to login to Facebook, Skype, gmail, etc. The cookies are set to let me in. If I were a low-tech user, the password friction problem still exists as it always has. Amazon has me logged in; I can add books to my wish list without retyping my password. But to make a purchase, I have to type my password. The password friction problem does not go away.

<comment><USER8> I think he's implying that your site won't have a password. You'll instead use one of these services for both auth and payment.

<comment><USER7> I understand what he's implying. His case is thin. PayPal is huge and can easily afford the customer service required by noobs forgetting their password. Can you think of another way to operate such a business? His solution implies that google, yahoo, facebook should be the next PayPal in this regard. OK, so now those organizations have to handle this type of support.

<comment><USER6> >>PayPal is huge and can easily afford the customer service required by noobs forgetting their password

nope, wrong again. ARPUs for PayPal users are probably only around $5-25 per year (excluding the minority of fanatic eBay regulars), and you can easily eat up all of that cost or more in telephone customer support.

<comment><USER3> To elaborate on Dave's point here, the ARPU for Paypal is low because Paypal's revenue is just a cut of the transaction value that they facilitate. For example, I pay them about ~$1.19 or so out of every $30 purchase.

US-based customer services reps cannot complete a phone call for less than $7 fully loaded. You really, realllllly do not want to have a CS infrastructure taking multiple calls to resolve Mrs. Smith's inability to successfully use her computer when Mrs. Smith is probably going to be worth less than a buck fifty to you and will likely need more handholding next time, too.

<comment><USER7> I understand the math. Every business since the world's first has prioritized customer support relative to the value of the customer; this is hardly a secret exclusive to PayPal. Dave's proposition that other sites may alleviate some of these costs seen by PayPal is interesting, but unproven.

A more likely case than relying on "maybe users will remember their passwords better" is that Facebook could capture a larger part of transactions (say 30% as App Store does) which enables them to better cover support and fraud.

</comment></comment></comment></comment></comment></comment><comment><USER9> People don't want to subscribe to stuff. They only do it when there is no other choice. If your site only offers subscriptions, I'll make a site with a one-time payment thing, store the users payment information and sell them new 'innovations' and 'features' that will be as easy as clicking a button to get, and that will bring me more money that your subscriptions.

If I have someone using my site all the time, it's easy to sell him something new.

<comment><AUTHOR> I agree that people prefer a sense of ownership rather than renting, even if renting is in their best interest.

However, the problem with a one-time payment is that the vendor loses incentive to continue supporting the buyer after the transaction. The primary way to generate additional revenues from that customer is, as you say "sell new innovations and features".

This adding of new features can increase complexity which eventually impacts the ease of use and increases the learning curve. These two side effects can have a negative impact on new user signups.

I'm optimistic of the web app user model after having developed desktop software for the past 10 years. Each version has to "work just like the previous, but better". You can only do that for so many versions :)

<comment><USER10> I honestly prefer fee-per-month software. It is MUCH cheaper than the equivalent valued software would be for the first 4-5 months, and most software is used infrequently, so I usually save money with the starting and stopping of subscriptions.

<comment><USER7> I like SaaS subscriptions as well. Most that hold my data as opposed to just providing a cool tool do not allow you to turn off your subscription for a few months without losing your data.

</comment></comment></comment></comment><comment><USER11> I'm curious if the password problem is really as big as he says or if he's just biased because of his experience at PayPal. I don't always remember my password, but I've never encountered a site that didn't offer one of the following:

      1) Password retrieval/reset by email
      2) Password retrieval/reset by secret questions

Also, don't most browsers these days ask you if you want it to save your password? Then there is password plugins. I thought most people use the same or an easy password anyway.

<comment><USER10> Yes, I'm with you. "The password problem" is a non-starter for me.

<comment><USER12> for me, remembering what username or email I used is the problem. It's further compounded by the fact that password retrieval sends it to the email I don't know I used, and that they usually don't have an obvious username retrieval method.

</comment></comment></comment><comment><USER13> Making your site a frequently used one is not solving the password problem; it's sidestepping it.

<comment><USER14> I guess he forgot to add this corollary:

If you can't make your product a frequent-use product, use somebody else's sign-on system (Google, Facebook Connect...).

<comment><USER6> yes, that was the conclusion I was not-very-subtly suggesting.

</comment></comment></comment><comment><USER15> It sure took the author a long time to get to his main points–I almost gave up.

Maybe reading Williams Zinsser should be the new black ...

<comment><USER6> sorry, i'm sure with less insanity and a better editor i could have gotten there much quicker...

but between sleepless redeye blogging and my usual retardedness, "i didn't have time to write a short letter"

my apologies, and thanks for hanging in there if you got to the end. my condolences if you didn't

<comment><USER15> No problem—and BTW I wouldn't have said anything if I didn't think your main points were worth reading (they were).

</comment></comment></comment><comment><USER16> I couldn't even get through that due to formatting issues. Good lord I've never seen a site more in need a little web typography restraint.

I'll just leave this here: <http://lab.arc90.com/experiments/readability/>

<comment><USER17> I think Dave's unique formatting is an essential part of the experience of reading his posts. Filtering it through the Readability tool is similar to listening to MIDI file versions of your favourite songs.

<comment><USER18> Or you could just not bother. I just skipped to the summary:

"This has been a complete ramble and i don't have time to edit this shit, so i'm leaving it as it is."

</comment></comment></comment><comment><USER19> This jumped out at me: "Unless MSFT develops Xbox into a widespread payment system..."

After a couple years of being down on MSFT, I've gotta say that xbox360 is a pretty brilliant product. Xbox live Gold can be purchased as a 5.99/month subscription, or 45/year one time payment. (like itunes cards, you'll find these in places like target and walmart).

</comment><comment><USER6> just to clarify: the post was trying to highlight both subscriptions _AND_ transactions, not vs. each other... they aren't mutually exclusive.

in fact, most likely a common model would be: 1) free for most users 2) low- cost txn for first paid use 3) convert initial txn users into frequent use / regular subscription later, but continue txnl model as well.

perhaps in mid-rant I failed to explain this clearly; possibly due to lack of sleep, or the cocaine-heroin speedball I shot up before getting on the redeye to NYC.

then again, maybe you guys just need to read that little part where I say "AND" between subscriptions & transactions, not just draw your conclusion from the headline... but I digress.

<comment><USER7> If your point was that businesses need to start charging for their services/content, ok fine, no argument there. But much of your rant is in finding a solution for password friction by pointing out what a major cost it is to PayPal. You make no case as to how google/yahoo/facebook will solve password friction better than PayPal other than to say that users log into these sites more frequently and therefore remember those passwords better than they do a PayPal password. While users "use" these sites more frequently, they do not type their passwords much. This does not solve the password friction problem since transactions (with the exception of some types of micro- transactions) will still need a password at the point of committing to the transaction.

<comment><USER6> a) people certainly use social networks (Facebook) and email and game / entertainment sites more than they use E-Commerce sites -- one is daily (or hourly!), the other is weekly or monthly

b) even if they don't type their passwords in "much", they certainly do so relatively much more frequently.

whether or not my post was a rant, this is a fairly simple point based on simple frequency of use.

</comment></comment></comment><comment><USER20> I would have preferred if he just worked on his presentation.

</comment><comment><USER21> > In 2015 the default login & payment method(s) on the web will be facebook > Connect, Google Gmail, or Apple iTunes.

Why not openid?

<comment><USER22> Regular users would need to:

a) care about managing their online identity

b) remember a valid URI

What do you think the odds are?</comment></comment>


Umbral: a cryptosystem for private data sharing in public consensus networks - <AUTHOR> https://blog.nucypher.com/unveiling-umbral-3d9d4423cd71 <comment><USER2> Hey HN friends. I too have worked on (and will probably keep working on) this project. It's pretty wild! There are two things about it that I think you'll like:

1) (the obvious) - it allows a user to share a secret with a third party (the "proxy") who, without being able to read it, can then share it with another person. For the purposes of narrating this, we expand "Alice - Bob" to "Alice - Ursula - Bob". Kinda cool.

2) We have introduced a couple of interesting turns of phrase. For example, we "encapsulate" a key (a very common practice), but in so doing, we say that the key in inside a "Capsule". I've never seen this object called a Capsule before, but it makes a good deal of sense - Bob brings a Capsule to Ursula and asks for her help "opening" (ie, decapsulating) it.

I think that we've made some interesting if modest motions forward in the modeling and naming that is required for distributed proxy re-encryption, and I'm curious to know if y'all think so too.

</comment><comment><USER3> The foundation for a great crypto project. Few are making products that push the development of the ecosystem. Excited for the launch on testnet.

</comment><comment><USER4> Hey, folks! I'm a cryptographic engineer at NuCypher and this is a pretty big release for us. I'm happy to answer any questions about this!</comment>


Last.fm Overheats, Goes Offline - <AUTHOR> http://www.techcrunch.com/2009/05/31/lastfm-overheats-goes-offline/?awesm=tcrn.ch_2tl&utm_campaign=techcrunch&utm_content=techcrunch-autopost&utm_medium=tcrn.ch-twitter&utm_source=direct-tcrn.ch <comment><USER2> It has been hot as hell in the UK today :)

EDIT: heh, lastFM tweeted this May 20th "The server with the longest uptime at Last.fm: 1244 days (3.4 years!) Can anyone beat that? <http://bit.ly/I3M7B>

hehe</comment>


Turkish police reportedly demanding people unlock phones, show WhatsApp logs - <AUTHOR> https://twitter.com/DidymaWorks/status/755147973827305473 <comment><USER2> Turkey had one last chance this decade to restore sanity. That chance is now gone and the US and Europe were on the wrong side of history.</comment>


Press Conference in Brazil to Announce Discovery in Outer Solar System - <AUTHOR> http://www.eso.org/public/announcements/ann14021/ <comment><USER2> Early leak of press announcement:

"Brazlian researchers discover asteroid with rings"

"The European Southern Observatory announced this week the discovery of rings around an asteroid 1.4 billion miles from Earth. Chariklo is the largest of the class of asteroids orbiting the sun between Saturn and Uranus known as Centaurs."

Google cache before it was thaken down: [http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...](http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fwww.wral.com%2Fdiscovery- an-asteroid-with-rings%2F13510966%2F)

[http://www.wral.com/discovery-an-asteroid-with- rings/1351096...](http://www.wral.com/discovery-an-asteroid-with- rings/13510966/)

<comment><USER3> Whoa! I guess the big news here is that rings around such a gravitationally weak body would be a rare occurrence in nature... indicating a high possibility of an artificially designed / constructed structure.

Edit: Not sure if I am being downvoted for stating the obvious or the incredulous :)

<comment><USER4> You're exactly right. A race of beings sprung up out of the mud of their home world, discovered science, space travel, faster than light travel, decided to visit a solar system and place an artificial ring around a rock in the distant outer reaches of a solar system, and then... profit?

<comment><USER5> Actually ceramic materials make the best protection against missiles like bullets or meteorites. So an advanced race of star travelers would not use metal-skinned ships, they would coat their vessels with a thick layer of porous rock. All we can see is that outer protective skin. Inside the star travelers live generation after generation patiently waiting until they find a habitable planet to take over.

<comment><USER4> And then they immediately die because life is designed for a planet, not the other way around, unless by habitable you mean a planet that is uninhabitable, artificially made habitable.

</comment></comment></comment></comment></comment><comment><USER6> [http://aerospace.firetrench.com/2014/03/20-seconds-that- chan...](http://aerospace.firetrench.com/2014/03/20-seconds-that-changed-our- understanding-of-the-solar-system-surprise-discovery-of-double-ring-system- around-asteroid-like-body/)

This was published yesterday, hasn't been taken down yet. The DOI is 10.1038/nature13155.

<comment><USER7> I think the importance goes up a lot if the rings are made of water as conjectured in parent. Getting access to water in space without dragging it out of a gravity well would make asteroid mining much easier. There's water in comets but their availability is not nearly as reliable.

<comment><USER8> Not really. At those distances, beyond the frost line [1] pretty much _everything_ solid is bound to be mostly water. Ice is plentiful even in the main belt asteroids and in this case we're talking about the Centaurs that lie much farther away - of course, their distance also makes them ineligible for any short-term mining endeavors.

[1] [http://en.wikipedia.org/wiki/Frost_line_%28astrophysics%29](http://en.wikipedia.org/wiki/Frost_line_%28astrophysics%29)

</comment></comment></comment><comment><USER9> Shame it's not broadcast, nowadays it should be a given, in my opinion. Why keep it closed to "members of the media", particularly when we all know how often they screw up these stories?

<comment><USER10> Embargos are designed to give every news outlet sufficient time to write up their stories and do their background reasearch without having to worry to rush to print to beat their competitors. In practice it's questionably useful.

</comment></comment><comment><USER11> Http redirects to https, which is awesome. Except they don't support any 'new' ciphers. So I can't connect.

Site only supports

          TLS_RSA_WITH_RC4_128_MD5 (0x4)
          TLS_RSA_WITH_RC4_128_SHA (0x5)

<comment><USER12> > Http redirects to https, which is awesome.

Huh..? Here it's doing the opposite (but will check again once I get home if it's just at work..)..

Or weren't you talking about the eso.org website?

</comment></comment><comment><USER13> Some recent papers by the team's leader, Felipe Braga-Ribas, are at [1]. I'm not any astronomer, but they mainly seem to concern studies of the atmospheres of the outer planets and mintor planets using observations of stellar occultations.

Maybe the announcement is about Pluto's atmosphere, or detection of atmosphere around an asteroid or one of the Centaurs?

[1] [http://www.researchgate.net/profile/Felipe_Braga- Ribas/publi...](http://www.researchgate.net/profile/Felipe_Braga- Ribas/publications/)

</comment><comment><USER14> > Each of the outer planets: Jupiter, Uranus, Neptune and of course Saturn > have rings.

What? Really?

* [http://en.wikipedia.org/wiki/Rings_of_Jupiter](http://en.wikipedia.org/wiki/Rings_of_Jupiter)

OK, so there are things I don't know, and more importantly there is water in fairly easily accessible places dotted around our Solar System.

<comment><USER15> When you have kids, your internal Wikipedia gets an update. :-) I had no idea about the rings until I read a book about planets to my kid. Then he started telling me that there were other dwarf planets besides Pluto. I told him that he was wrong. Then I went to a new book, and had to explain that "Even Papai makes mistakes."

Getting current on science is one of the great perks of having kids.

<comment><USER16> > _Then I went to a new book, and had to explain that "Even Papai makes > mistakes."_

Probably the most important thing for your kid to learn.

<comment><USER15> And oh boy he likes to remind me of this lesson. :-)

</comment></comment></comment></comment><comment><USER17> Science through press conferences. Exactly how you're not supposed to do it.

</comment><comment><USER18> Hot on the heels of the discovery of Big Bang's gravitational waves there's now news that for the first time ever alien live has been witnessed, in the form of Silver Surfer ridin' dat wave.

</comment><comment><USER19> This is very cool, I'm anxious to see the full announcement and see what is said. I want to hear what others in the field see and have to say as well because I would never think a body with a diameter of just 250 km could actually have enough gravitational power to maintain rings.

<comment> T-hawk Read up on the Hill sphere: [http://en.wikipedia.org/wiki/Hill_sphere](http://en.wikipedia.org/wiki/Hill_sphere)

How much mass you need to retain rings isn't an absolute quantity. It depends on distance and size of other masses. A 250km body in Earth orbit couldn't retain its own rings because Earth's gravity would dominate the system. But a 250km body in deep space with no competition could.

Neptune can actually maintain satellites at a greater distance than Jupiter can, despite Jupiter having over 10x the mass. This is because Jupiter has closer competition from the Sun and Saturn, while Neptune has enormous amounts of space to itself.

</comment></comment><comment><USER15> I have to admit that this excites me a lot more than Oculus and Facebook, even if the latter will have a more immediate impact on my life.

<comment><USER20> Virtual worlds or space. That is the dilema.

<comment><USER21> If the universe is holographic, wouldn't it be kind of the same thing?

</comment></comment></comment><comment><USER22> I wonder if it's better to just wait until the discovery is announced before submitting and upvoting? The speculation's fun, but, y'know. The announcement is in just a few hours.

</comment><comment><USER23> "We have found the inventor of Bitcoin. At 15 AU, harassing him will be extremely expensive, however we hope NASA will do the right thing and repurpose their 2025 europa lander"

</comment><comment><USER24> Planet X???

:)

[http://en.wikipedia.org/wiki/Planets_beyond_Neptune](http://en.wikipedia.org/wiki/Planets_beyond_Neptune)

</comment><comment><USER25> Come on, Reapers. Or even Reavers.

</comment><comment><USER26> It has to be Nibiru (or better known as Planet X)!

[http://en.wikipedia.org/wiki/Nibiru_cataclysm#Planet_X](http://en.wikipedia.org/wiki/Nibiru_cataclysm#Planet_X)

</comment><comment><USER21> Big alien motherships on their way to acquire Facebook?

<comment><AUTHOR> I think you mean "Facebook to acquire big alien mothership" ;)

<comment><USER21> Oops, what the heck was I thinking? Of course.

</comment></comment></comment><comment><USER27> I guess Zecharia Sitchin was right. They be a comin' for our gold, dontcha know.

</comment><comment><USER28> The beginning of The Fifth Element ..

</comment><comment><USER29> Breaking news: From some undisclosed confirmed sources, it appears they discovered a new planet after Pluto. Could this be planet Nibiru?

<comment><USER29> I don't understand why this was voted down. The sources were trusted and the news was accurate.

</comment></comment><comment><USER30> It's the Klingons.

<comment><USER21> They want their beer back :) [http://www.theguardian.com/film/2014/mar/25/star-trek- warnog...](http://www.theguardian.com/film/2014/mar/25/star-trek-warnog- official-klingon-beer)

</comment></comment><comment><USER31> Event Horizon has returned.</comment>


People liked my idea and execution but few signed up. How do I solve this? - <AUTHOR> Our first reddit post had like 80 upvotes and more than 200 people visited our site but only 1 person signed up. We made an update post and we told our friends. While we got a few more users out of this, none of them are active users.
At first, we thought that the reason why people don't continue to use our app was because maybe the idea was good but the product was not. But when we asked our friends and our users for feedback they said that while 1 or 2 little things needed to be changed(which we did), the app was really nice. So, now we have no clue what to improve on while trying to look for product market fit.
Also people don't even sign up to my app even though they say they are interested let alone use it on a daily basis.
We are out of ideas right now on how to grow. So how did you get your first users and how did you make them stay? What platforms can you use to get users? So far, we have only used reddit and asked our friends. None of which worked well.So any advice is appreciated.Thank you <comment><USER2> > Our first reddit post...

There's your problem. Reddit is great for traffic, but terrible for conversions. Much as I dislike Facebook for everything else, I got the most conversions from participating in discussions on Facebook, getting known by the groups, and sharing updates there.

I'm not saying you'll have the same experience. Each product will find its own niche for marketing. A product I spent years on got many of its conversion through radio. Everything is worth trying. Keep trying different channels and figure out for yourself where your audience is responsive.

</comment><comment><USER3> Check out [https://cortes.design](https://cortes.design)

Messaging is key, who are your target customers? Where are they?

Definitely join YC Startup School, link at the bottom every HN page.

Can you post a link?

</comment><comment><USER4> Your friends and family don't want to offend you. You need people who dont care if they make you feel bad.

First step is being more forward about it; understood you don't want to be self promoting here just asking for help on the meta-problem of how to promote: still appropriate to have your one or two sentences of "This is why we're better than sex and everyone who doesn't use us shouldn't bother procreating." with a link to show what you're talking about.

</comment><comment><USER5> You are falling into the "build it and they will buy" trap. Supply-side marketing only when the product is disruptive, like an IPad, or smart phone.

Otherwise, you need very compelling reasons than just liking to create customers. This is because when people say they "like" something, they are mostly not sure exactly why. It could be an emergent effect from various causes.

If they use it but don't convert to buyers, the problem maybe that they don't think your product is valuable enough to warrant money expenditure. Either your marketing message is weak, or there are too many rivals offering similar value; or in a less likely case, your product doesn't solve the problem it was designed to solve.

It is hard to know what to do next given limited information in your question, but a general solution would be survey your customers for what would make them pay for it...and if not, why. You could also keep reaching audiences and hodl while improving and tinkering. Sometimes these things take time.

</comment><comment><USER6> What type of app/product?

You need to let users know why the app will be useful to them, what they can use the app for, and why your app is better/easier/faster/cheaper than their current solution. Infographics, Youtube videos, examples, reviews and customer stories can help here.

Maybe add referral bonus (referrers earn a percentage of sale profits, entry in giveaway, or app credits/coupons per active referred user)?

If there is any community/forum/social network for your app's market (e.g. Bitcointalk for crypto) you can advertise there. Likewise you could ask your market what type of platform/app would help them, then add those features to your app.</comment>


How a Cable Modem Works - <AUTHOR> https://support.usr.com/support/6000/6000-ug/two.html <comment> non-entity I was really bored one night, curious if I could hack into my cable modem. After finding some gaping security holes in the UI, i ended up down a rabbit whole reading about people who had broken in to their cable modems, DOCSIS versions, etc. and was shocked to find that a prominent hacker in the area had caught federal charges for it</comment>


State of Voice Coding – 2017 - <AUTHOR> https://medium.com/bambuu/state-of-voice-coding-2017-3d2ff41c5015 <comment><AUTHOR> I wrote this after having suffered from some pretty severe RSI a few years back and dabbling with coding by voice. In general I think the landscape is a little hard to comprehend, so I'm hoping this might help someone who's interested in trying it out.

</comment><comment><USER2> I have a list of programming by voice resources on Github:

[https://github.com/melling/ErgonomicNotes/blob/master/progra...](https://github.com/melling/ErgonomicNotes/blob/master/programming_by_voice.org)

There's a section on RSI too:

[https://github.com/melling/ErgonomicNotes/blob/master/README...](https://github.com/melling/ErgonomicNotes/blob/master/README.org)

<comment><AUTHOR> That is a very comprehensive RSI article list - what's your story?

<comment><USER2> The short answer is that I wanted to crowd source other people's stories in one place to give others a head start.

I've had my own issues and I've been reading stories like yours for decades. The creator of Tcl, for example, goes back to the 1990's:

[https://web.stanford.edu/~ouster/cgi- bin/wrist.php](https://web.stanford.edu/~ouster/cgi-bin/wrist.php)

Programmers without issues will rant about how they can't imagine ever not using a keyboard, so progress on voice coding is slow.

Try reposting your story at different times. You almost got enough upvotes. This story once went to #1:

[http://www.looknohands.me](http://www.looknohands.me)

<comment><AUTHOR> Yeah that makes sense. And then once you do suffer from RSI, you can't do much work to create voice-coding ;)

I think I'll try that. Perhaps it was a little early for the US to post it.

<comment><USER2> Also, I'd recommend an iPad with cheap styluses to reduce computer typing. e.g email, surfing, HN responses, etc

[https://www.amazon.com/Stylus-LIBERRWAY-Universal- Capacitive...](https://www.amazon.com/Stylus-LIBERRWAY-Universal-Capacitive- Samsung/dp/B01IHBVGOM/)

Unless the Mind Body Approach works, I don't see many people cured of RSI (i.e it can easily return).

Simply remove the physical keyboard whenever possible.

My feeling is that voice as a user interface might arrive soon:

[https://h4labs.wordpress.com/2017/12/13/voice-as-a-user- inte...](https://h4labs.wordpress.com/2017/12/13/voice-as-a-user-interface-is- almost-here/)

Once people accept it, phones, tablets, and computers will get a better voice interface.

</comment></comment></comment></comment></comment><comment><USER3> Thanks for this, was searching for something similar the other day, an overview is really missing in this field.

</comment><comment><USER4> Nicely done, I had no idea that so many where working on this stuff!</comment>


Don't Let the Computer Bully You - <AUTHOR> http://www.oualline.com/practical.programmer/bully.html

<comment><USER2> I stumbled upon oualline via a typo in the browser address bar. The hacks in this article are great, "All right everybody, only one person per table."

I wonder what year this was authored? The wayback has a 28 Apr 09 copy of it.

Only, after did I notice some of the great books the OP authored.

Who has recent stories of not letting computers and their users bully them?

</comment><comment><USER3> I didn't file my previous company's IRS Form 940 because I didn't pay myself that quarter, and so had no withholding tax. Eventually the IRS sent me a letter in which it demanded that quarter's 940.

So I neatly printed my quarterly return, with "0.00" in all the fields. The IRS of course responded - after a long wait - by demanding my 940 yet again.

I was able to bring the problem to a halt by including a cover letter with my second filing, to explain that I had already filed and that all the entries were 0.00 because I had no payroll for that quarter.</comment>


Keepod: Can a $7 stick provide billions computer access? - <AUTHOR> http://m.bbc.co.uk/news/technology-27346567 <comment><USER3> So this time it's based on Android? That seems like a bad choice if you wanted to provide the people with access to true general purpose computing.

<comment><USER4> The desktop reminds me of Chrome OS. Maybe they should have gone with Chromium OS.

<comment><USER5> That's a network-centric OS? But won't they typically be used in bandwidth- constrained places?

I was going to worry about how much memory was required, but it looks like Android 4.4 can work with 512 meg of RAM.

<comment><USER4> Well, Android is similarly network-centric.

</comment></comment></comment></comment><comment><USER6> > will allow old, discarded and potentially non-functional PCs to be revived,

While this feels like a good idea it's often terrible. Have a look at the agbogoshie e-waste dump in Accra, Ghana, for an example. ([https://news.ycombinator.com/item?id=5552994](https://news.ycombinator.com/item?id=5552994))

[http://www.theguardian.com/global- development/2013/dec/14/to...](http://www.theguardian.com/global- development/2013/dec/14/toxic-ewaste-illegal-dumping-developing-countries)

Keepod has been discussed here before. It looks like an interesting experiment, although I would prefer it if people had access to more open systems.

</comment><comment><USER7> Why is it a for-profit operation with a 30% profit margin? Are they trying to become rich through people's charitable contributions?

Why does every student as opposed to just every classroom need one (with multiple accounts supported)?

And why is the base price $5? Flashing is $.32 ([http://www.usb2usb.com/pre- loaded-data-usb-flash-drive.htm](http://www.usb2usb.com/pre-loaded-data-usb- flash-drive.htm)) on a $3.41 drive ([http://www.usb2usb.com/marketing_series_flash_drive_costs.ht...](http://www.usb2usb.com/marketing_series_flash_drive_costs.htm)) = $3.73* ... that's $1.27 less then $5.

This doesn't sound like much until you are doing 150,000 of them. Now we have $190,500 that's not accounted for on top of the existing $300,000 deposited into their personal checking account.

Someone can do this same project for 40% less (at $4 versus $7) and still walk away with $40k+ - a much more typical salary for a social worker.

Or they could do a multiple-account, single device strategy and probably get away with an astonishing 98% drop in price. Of course, there's no money in that. ;-)

* - We can't see the price for 7500+ from this vendor - but I think that a cost of about $3.55 is fair for the volumes the founders are talking about - and there's probably better offers if you call around - so maybe $3.45 is more realistic. It's certainly not $5.00.

<comment><USER6> The hardware costs $x.

Then there is flashing the software. And creating the software. And creating documentation. And distributing the devices. And providing support.

They're not just selling a USB stick, nor selling a USB stick that has a bit of software on it.

They are possibly testing the devices on a range of older hardware, and distributing that older hardware too.

I think this is a pivot - didn't they used to aim this at people worried about security?

<comment><USER7> The flashing is $.32 per device ... it's accounted for above

The software is Android, it's maintained by Google and already exists - <USER2> does the documentation.

The distribution of the USB stick, as the article states, is through [http://www.liveinslums.org/](http://www.liveinslums.org/).

The duo also are explicitly not distributing the older hardware - although I guess they could be testing it.

They surely have added some software to an existing Android ISO. Was that their personal investment? No.

People _gave_ them $40,000 to do that through indiegogo. The $90 donation point was a 200% markup from the base price (which I believe is 40% inflated) - They were paid a disclosed $28,000 (probably closer to $32,500) to make the product. That's 3 months on a handsome 6-figure salary to write essentially a few shell scripts.

Now they have a for-profit android-based distro that They Are Selling to impoverished African children which was built through donations.

They will pitch it as "We need your money to help the children" (and, ahem, our pocket books).

Also, they want to sell a separate USB device for each child as opposed to 1 which supports multiple accounts for a single classroom (or more likely, single school). So they sell 80 to a school where 2 would do fine.

Why? I'm guessing it has to do with the "for-profit" part. It's more profitable for them if each kid has to manually reboot the computer and switch the USB stick then it is to just switch accounts.

How is this not just a clever scam?

<comment><USER8> Well, would the situation in Africa be better or worse if this takes off? There may be some greed in there, but the overall result to me seems Good. I'd rather they improve the world and make a profit than they sit in their thumbs as punishment for being greedy.

<comment><USER7> Functional sewage systems are probably a higher priority right now than giving every kid a USB stick. ([http://en.wikipedia.org/wiki/Water_supply_and_sanitation_in_...](http://en.wikipedia.org/wiki/Water_supply_and_sanitation_in_Sub- Saharan_Africa))

You do realize that the usage pattern will eventually be 1-stick-per-computer, right? And the computer-to-student ratio is many dozen to 1? That means 95% of these will be sitting around. 1 stick with 39 spares.

<comment><USER9> Hmm, wondering if you got down voted for pointing out African children need functional sewage systems over usb sticks?

</comment></comment></comment></comment></comment></comment><comment><USER10> I still can't wrap my head around, why they used Android 4.4 instead of just using linux, this does not seem like a new paradigm, just a minor "innovation".

<comment><USER11> 1) Android _is_ a Linux, it's just not marketed as such: [http://en.wikipedia.org/wiki/Android_%28operating_system%29#...](http://en.wikipedia.org/wiki/Android_%28operating_system%29#Linux_kernel)

2) If you're someone like me who drops in to distrowatch.com occasionally, you might think a tweaked version of Puppy or Tiny Core would be more appropriate for older computers. And you'd be right in terms of hardware requirements, but...

3) Android is supported by Skynet, er, Google with massive resources. The installed base in the US is north of 80M and it has support for 47 languages.

So it's really the answer to that classic question, "what's the simplest thing that could possibly work?" If I were in the project manager's shoes Android would be at the top of my list as well.

</comment></comment><comment><USER4> It's just a bootable USB drive? So, all they need now is to find a computer which boots from USB drives (i.e. fairly recent, relatively)?

How does this solve the problem?

<comment><USER12> It solves the problem of each user not having a consistent user experience on a shared computer.

I know, it's not exactly solving the right problem, is it? Also, I'm not sure how comfortable I'd be with storing all my data on a flimsy, easily-misplaced USB drive.

<comment><USER4> Especially since they seem to be saying it'll work on any 8GB drive. However, any of us who have used very cheap USB drives (the sort you might get at a conference and the sort these people would get) will know they are about as reliable as floppy disks.

</comment></comment></comment><comment><USER13> I wish Google would do something about Android in "desktop mode". But I don't expect things to change as long as former ChromeOS boss is running the Android division. Unless Google and its partners plan to release $7 ChromeSticks, then they should at least make the open source Android be usable on desktops, with a more optimized interface for it.

</comment><comment><USER14> Maybe Shuttleworth is right. In a few years time we will have cheap smartphones available with an OS that allows docking to a monitor/keyboard unit with automatic switching of UI. Cloud + local storage. SIM card in the device rather than a myfi like the school project shown here.

<comment><USER15> I think it's pretty much a given that we will be able to pack enough computing power into a phone to make it useful for average day to day internet/office tasks (arguably we are already there).

Whether that platform will be built out of a phone I don't know but it's probably likely as economies of scale on phone production do drive down the price of the hardware.

It's not going to replace a computer for everyone though (I like my three screens too much for that) but I could see the utility.

<comment><USER4> I wonder if the end of Moore's law will make it happen. If the difference between phone CPUs and laptop CPUs narrows enough, there'd be no reason not to use such a device.

</comment></comment></comment><comment><USER16> This is essentially a plan to get local resellers to distribute an Edubuntu- like Android OS on bootable thumb drives.

</comment><comment><USER17> At least it is a good idea; time will tell how well it will help people.

It would add to the cost, but customization per geographic region would be good: farmer almanac type information, etc. If children could demonstrate to their parents some utility then the parents would be less likely to sell the devices for food, etc.</comment>


Google's Toughest Search Is for a Business Model (2002) - <AUTHOR> http://www.nytimes.com/2002/04/08/technology/ebusiness/08GOOG.html

<comment><USER2> Google had already found a viable business model when this article was written. They were profitable in 2001 and went on to make $99M in net income on $348M in revenue in 2002. This was not public knowledge at the time since Google was still a private company. That's something to keep in mind when people speculate about today's private startups.

[http://www.sec.gov/Archives/edgar/data/1288776/0001193125040...](http://www.sec.gov/Archives/edgar/data/1288776/000119312504073639/ds1.htm#toc16167_11)

<comment><USER3> Agreed. People talk about Twitter's revenue model - though in reality they are getting undisclosed amounts from several sources (not just Google and Microsoft).

<comment><USER4> whats twitter's revenue model , the fire hose ?

<comment><USER3> So far, yes it seems

</comment></comment></comment></comment><comment><USER5> Some wonderful quotes in this one: "The days of investing in Web sites we love are over," said Lanny Baker, a Salomon Smith Barney analyst. "People rave about Google. But as a business, it will take an awful lot for them to catch up to Overture."

I wonder where Lanny Baker is these days?

<comment><USER6> We should never _underestimate_ the stupidity of Nobel Laureates in Wall Street <http://en.wikipedia.org/wiki/LTCM>

<comment><USER7> "When Genius Failed" is a phenomenal and highly recommended book on LTCM.</comment></comment></comment>


How can I make this app have potential? - <AUTHOR> I'm building an app to solve the problem of how difficult it is to meet people with similar professional interests and goals.
It may be relevant to ask y'all since my target market would be professionals in tech. ;)
How can I improve this from a product level?
https://projects.invisionapp.com/share/YX8KA9LPA#/screens <comment><AUTHOR> [https://projects.invisionapp.com/share/YX8KA9LPA#/screens](https://projects.invisionapp.com/share/YX8KA9LPA#/screens)</comment>


Africa by Toto to play on eternal loop 'down in Africa' - <AUTHOR> https://www.bbc.com/news/world-africa-46861137 <comment><USER2> That setup doesn't look like it will last until the end of the month let alone for eternity.</comment>


Show HN: I made a tool that adds analytics and passwords to PDF/PPT files - <AUTHOR> https://dashboard.sizle.io/ <comment><USER2> I was worried that someone found a way to exploit PDF files to add tracker information there... luckily this was not the case, this is just a web-based viewer for those files with a ton of trackers.

(also, this link choice is pretty bad -- it just points me to login page with no information whatsoever. Going to sizle.io directly shows more information

<comment><USER3> Fairwai, LockLizard, ReadNotify, and DocTracking all track if a PDF is opened. So that's already a thing. Companies use it to track trade secret / IP theft.</comment></comment>


Show HN: Cortex – machine learning infrastructure for developers - <AUTHOR> https://github.com/cortexlabs/cortex <comment><USER2> Somewhat unfortunate name clash with the now-back-burnered deep learning framework written in Clojure, also called Cortex: [https://github.com/originrose/cortex](https://github.com/originrose/cortex)

<comment><AUTHOR> Thanks for letting us know, we'll take a look

<comment><USER3> Pretty cool name (cortex), but also taken by this project - [https://github.com/cortexproject/cortex](https://github.com/cortexproject/cortex) \- "A multitenant, horizontally scalable Prometheus as a Service"

</comment></comment></comment><comment><USER4> I work on ML infrastructure at some big company, so I'm always interested to see whats new in this field. This seems to be a thin wrapper around tf.estimator, which provides a majority of the functionality. The only novel things are yaml config for defining some basic transformations and data format. It doesn't seem super useful, am I missing something?

<comment><USER5> curious what kind of infrastructure have you built for deployment, serving and managing models?

<comment><AUTHOR> We use TesnorFlow serving ([https://www.tensorflow.org/serving](https://www.tensorflow.org/serving)) for serving the trained models. We also run Flask to transform the incoming JSON to match the way the data has been transformed at training time.

</comment></comment></comment><comment><USER6> How does this compare to KubeFlow?

<comment><AUTHOR> We have a lot of respect for the work that the KubeFlow team is doing. Their focus seems to be on helping you deploy a wide variety of open source ML tooling to Kubernetes. We use a more narrow stack and focus more on automating common workflows.

For example, we take a fully declarative approach; the "cortex deploy" command is a request to "make it so", rather than "run this training job". Cortex determines at runtime exactly what pipeline needs to be created to achieve the desired state, caching as aggressively as it can (e.g. if a hyperparameter to one model changes, only that model is re-trained and re-deployed, whereas if a transformer is updated, all transformed_columns which use that transformer are regenerated, all models which use those columns are re-trained, etc). We view it as an always-on ML application, rather than a one-off ML workload.

</comment></comment><comment><USER7> Congrats!

<comment><AUTHOR> Thank you!</comment></comment>


A victim of PDD (a Nasdaq listed eCommerce company) - <AUTHOR> https://github.com/fastai/fastai/issues/751 <comment><AUTHOR> When a developer was training a model(using fast.ai library), the system halted and rebooted.

Eventually, the developer figured out the cause to the failure after submitting an issue in the Github:

After debugging for around 8 hours, I found the error:

While monitoring nvidia-smi, it seems like when power usage reach 200W, the system halted and reboot.

The power supply is buy from PinDuoDuo (Nasdaq: PDD), it says it has 500W, but it may be only support ~200W. After changing this power supply, the issue solved.</comment>


On the Run: The Pursuit of Pablo Neruda - <AUTHOR> https://www.poetryfoundation.org/articles/150472/on-the-run <comment><USER2> Serendipitous, I've read a number of Alastair Reid's translations of his work without really looking into just _who_ he was. This puts a layer of skin on what I had previously considered a faceless name.

</comment><comment><USER3> What a fascinating read. Shows the American government in a poorer light than I ever knew, and certainly not without justification.

</comment><comment><USER4> Mexican actor Gael Garcia Bernal starred in a 2016 movie from the viewpoint of a fictional detective.</comment>