What Were CGI Scripts? - <AUTHOR> http://rickcarlino.com/2019/07/20/what-were-cgi-scripts-html.html <comment><USER3> To answer the title: what we called FaaS back in the day. And back in those days, the suspender-wearing UNIX sysadmins said that it was just a more restricted version of inetd.

Wonder what the next generation will call it?

And yes, I am being sarcastic. There are differences. But do recall that when AWS Lambda came out, it had the exact same limitations w.r.t. one process per call, needing one fresh connection to a DB per request to handle, etc.

<comment><USER4> Lambda is still single threaded, right? You will only be sent one request at a time per process. So now its at best FastCGI.

<comment><USER5> compare inetd in wait mode

</comment></comment></comment><comment><USER6> This makes me nostalgic. Spent inordinate amounts of time writing terrible, unmaintainable Perl scripts and FTPing them to cgi-bin on free 5MB hosting plans on F2S and Netfirms. Most hosts wouldn't provide error logs, so there was nothing more than a 500 page from httpd to tell you that something had gone wrong. Debugging anything was an endeavor. Then of course, PHP came along and killed cgi-bin.

If I had to pick one thing to represent the CGI era, it would be Matt's FormMail [1].

[1] [https://www.scriptarchive.com/formmail.html](https://www.scriptarchive.com/formmail.html)

<comment><USER7> > PHP came along and killed cgi-bin

PHP was using CGI like Perl. And then PHP had Apache's mod_php, which I believe is still widely used today.

Perl, of course, had mod_perl. And later, PSGI/Plack followed by Catalyst, Mojolicious, Dancer, etc.

<comment><USER8> mod_perl had the issue that it had hooks deep into the webserver, which wasn't "shared hosting safe" mod_php had less hooks and some basic cross-vhost-access mitigations (Safe_mode oben_basedir etc.) which allowed independent users to put PHP scripts on the same server, which in turn made web hosting cheap.

</comment></comment></comment><comment><USER9> CGI is still a reasonable choice for low query rate and simple pages, like an AJAX responder.

Especially when there won't framework already in use on this particular server.

Why add <framework of the day> to your setup when every 10 minutes or so, it's time to read the temperature sensor and return a string with the reading.

Also, since it's served by a transient process, there is no problem of memory leaks, file handle leaks, other resource capture by long running processes.

Per Murphy's Law, of course, everything is fine until one day the internal app goes public and suddenly there are 500 queries a second.

<comment><USER10> > CGI is still a reasonable choice for low query rate and simple pages

By which you mean, "Almost every website in the Universe which isn't actively being DDoSed" with the understanding that essentially _nobody_ can stand up to a modern, competent DDoS.

> Per Murphy's Law, of course, everything is fine until one day the internal > app goes public and suddenly there are 500 queries a second.

Omae wa mou shindeiru. You are already dead.

<comment><USER7> It's humorous to think every random person on HN is working on a site that gets more traffic than Slashdot did in 1999. A site that ran on mod_perl and, by modern standards, fairly basic hardware.

And for the most part, CGI went on the decline the day mod_perl came out. Which was 1996. So we really didn't use basic CGI for that long. The popularity of putting Perl right in Apache eclipsed running standalone Perl via CGI. It would be at least another decade before the world started to move on from this arrangement (mod_php or mod_perl).

</comment></comment></comment><comment><USER11> One of the bits of CGI (I wrote a lot of perl back in the day) is that parts of it are still there, under the covers.

Looking at RFC 3875 [https://tools.ietf.org/html/rfc3875](https://tools.ietf.org/html/rfc3875) \- you see things like PATH_INFO, PATH_TRANSLATED, QUERY_STRING...

Pull up Java HttpServletRequest, [https://javaee.github.io/javaee- spec/javadocs/javax/servlet/...](https://javaee.github.io/javaee- spec/javadocs/javax/servlet/http/HttpServletRequest.html) and there is getPathInfo(), getPathTranslated(), and getQueryString() along with many of the other parameters that would be familiar to someone writing a CGI.

You can find them in C# - [https://docs.microsoft.com/en- us/dotnet/api/system.web.httpr...](https://docs.microsoft.com/en- us/dotnet/api/system.web.httprequest.pathinfo?view=netframework-4.8) \- PathInfo, QueryString and the like.

You can find them in Haskell - [https://hackage.haskell.org/package/happstack- server-126.96.36.199...](https://hackage.haskell.org/package/happstack- server-188.8.131.52/docs/Happstack-Server-Routing.html) Route by pathInfo and the QUERY_STRING is clear in [https://hackage.haskell.org/package/happstack- server-188.8.131.52...](https://hackage.haskell.org/package/happstack- server-126.96.36.199/docs/Happstack-Server-Internal-Types.html#t:Request)

CGI scripts aren't dead... they just got better plumbing.

</comment><comment><USER12> OP does a poor job explaining what CGI scripts were.

From the RFC linked in the OP: [https://tools.ietf.org/html/rfc3875#page-23](https://tools.ietf.org/html/rfc3875#page-23)

CGI defined an interface between a web server and an executable that would provide a response.

\- Request meta-data i.e. path, query string, and other headers passed as environment variables.

\- Request body passed via stdin

\- Response header and body passed via stdout

In this way, a webserver like Apache could provide a platform for a wide array of languages. Yes there were security and scaling concerns, but it also was an opportunity to rapidly release and iterate on a product.

</comment><comment><USER13> I'm really grateful I had to cut my teeth on cgi because it forced me to understand the whole http request/response cycle in detail. There were libraries to help (CGI.pm, anyone?) but they stayed down at a pretty low level (helping parse params from an url or POST, for example). To learn how to implement a web login form, I had to understand how cookies worked, how to set and then read a cookie header, how to send the right headers with the response, how to encode the cookie payload, how to store the password locally.

Today, a web framework will do this grunt work for you. Which honestly, if you're handling passwords, is in many ways a good thing. But people are less likely to learn the basics of how their app talks to a browser.

<comment><USER14> >> But people are less likely to learn the basics of how their app talks to a browser.

Do they need to? Do you yourself understand every miniscule detail of radio wave propagation before making a cell call to your friend?

<comment><USER15> It certainly helps knowing enough to go outside if you have no signal, rather than just thinking your phone is broken.

<comment><USER14> That's the same as knowing that "there's a thing called cookie that needs to be 'set' for my user to be authenticated".

</comment></comment></comment></comment><comment><USER16> CGI and derived protocols actually got one thing right compared to the reverse-http-proxying of today: they pass request headers in protocol variables, not the other way around. In CGI, no amount of accidental misconfiguration would permit a request to overwrite custom request variables on the way from the server to the script.

I mean, it's probably possible to configure a server to escape the original request headers as 'HTTP-<Header-Name>: value' and add custom ones on top, but I haven't seen it done, and frameworks depend on the headers being there intact.

<comment><USER17> That happened with the HTTP_PROXY environment variable and the Proxy request header: [https://httpoxy.org/](https://httpoxy.org/)

Since the CGI "protocol variables" are actually environment variables, it creates a namespace collision and an injection opportunity for environment variables beginning with "HTTP_".

<comment><USER16> Well, putting protocol fields in environment variables, un-namespaced, is one thing CGI hasn't gotten right. That's where FastCGI and SCGI come in.

Also, once in a while I begin thinking that PHP is a pretty nice language, certainly doing its job and very performant compared to Python or Ruby, even if PHP code resembles Java more and more. And I forget the numerous questionable semantic-breaking decisions. But then, bam:

> _Warning: if PHP is running in a SAPI such as Fast CGI, this function will > always return the value of an environment variable set by the SAPI, even if > putenv() has been used to set a local environment variable of the same name. > Use the local_only parameter to return the value of locally-set environment > variables._

</comment></comment></comment><comment><USER18> Written as if it's a 25 year old tech no one uses now?

I still use cgi scripts. Though these aren't "scripts", rather compiled binaries written in C.

That made some of the pages with heaviest calculations, load in under a second, which were taking more than 10 seconds in PHP.

<comment><USER19> Do you have any more information available on this? I'm curious about the use case for using compiled binaries directly over PHP.

<comment><USER20> It sounds as though the compiled binaries optimize the compute portion, which the interpreted php code was taking 10 secs to run. It's still likely running as a cgi process, that is as a fork/exec in a separate address space. If you're using mod_php or one of the many php engines available for modern web servers, you're already enjoying a scalability and execution time improvement over standard cgi. Except with compute code, apparently.

</comment></comment></comment><comment><USER21> I built a billing site for my software business and had to decide which tech to use. SPA? React + Rails? Elixir? Keep in mind we are talking about single digit req/min.

I went with CGI. It has some drawbacks but consider the advantages:

      * Requires nothing but Apache running, minimizes attack surface area
      * Deploy is a simple `git pull`, no services to restart
      * No app server running 24/7 so I don't have to monitor memory usage or anything else.

I love it. Takes little to no maintenance because it never changes. Runs on a $5/mo droplet.

[https://www.mikeperham.com/2015/01/05/cgi-rubys-bare- metal/](https://www.mikeperham.com/2015/01/05/cgi-rubys-bare-metal/)

<comment><USER22> I'm not about to dictate to someone that their choices are better nor worse than anybody else's but I don't think you make a particularly convincing argument in favour of CGI:

> _Requires nothing but Apache running, minimizes attack surface area_

Sure, but the attack surface remaining (CGI) is far less secure than pretty much everything else out there.

> _Deploy is a simple `git pull`, no services to restart_

Same could be said for a dozen other service side frameworks.

> _No app server running 24 /7 so I don't have to monitor memory usage or > anything else._

I mean, if you exclude the server you're talking about, then sure. But you still have a server running 24/7 that you need to monitor so the framework becomes somewhat irrelevant from that perspective.

\---

Personally I still use CGI for personal projects I hack together. But none of them are directly open to the internet.

<comment><USER23> The thttpd server is efficient in the extreme, can constrain itself to a chroot(), and is able to execute CGIs.

In that environment, even the largest attack surface will have great difficulty escaping confinement.

<comment><USER22> Apache httpd 2.4 can be chrooted (maybe 2.2 as well? Or at the very least some distros back ported that feature to 2.2) but it's not enabled by default and can take some set up to get working properly if you're not a seasoned sysadmin.

chroot is definitely not common amongst Apache installations, let alone common amongst CGI usage (which likely comprise of more than just Apache httpd users).

However one blessing is at least the execution directory is limited to /cgi- bin (even if software running inside cgi-bin can fork their own processes outside of that directory).

It's also worth noting that "efficient" is a poor choice of words for CGI - <USER2> it in the context of security or it's more common usage in terms of performance. CGI work by forking processes (which is slooooow). In fact CGI is ostensibly a $SHELL for HTTP (if you look at the mechanics of how shells are written vs how CGI works). Someone elsewhere else in this discussion described CGI as a "protocol" and I wouldn't even go that far because all the HTTP headers and such like are passed to the forked process via environmental variables. In fact could literally set the same environmental variables in Bash (for example) and then run your CGI-enabled executable in the command line and get the same output as if you hit httpd first.

But as I said in my first post: I don't hate CGI. Far from it, it's been a great tool over the years and I still use it now for hacking personal stuff together. But it's also not something I'd trust on the open internet any longer. It's one of those cool pieces of tech that simply doesn't make sense on the modern internet any longer (like VRML, Sockwave and Flash, the web 1.0 method of incremental page loads (I forget the name), FTP (that protocol really needs to die!) etc.

</comment></comment></comment></comment><comment><USER24> CGI scripts don't have to run with web server privileges. Nor should they. They should be set-UID to some other user.

I still use FCGI with Go programs. FCGI launches a service process when there's a request, but keeps it alive for a while, for later requests. It can fire up multiple copies of the service process if there's sufficient demand. If there are no requests for a while, the service processes are told to exit. Until you get big enough to need multiple machines and load balancers, that's enough.

<comment><USER25> Set-UID (by itself, at least) is _not_ a feature to drop privileges. On Linux, you _must_ also use setresuid to set all ID's to the EUID. And then you must hope that you were able to execute setresuid before any vulnerabilities can be triggered.

You should tell your web server to run CGI processes as a different user, instead (f.e. suexec).

</comment></comment><comment><USER26> Python 3.8 is expected to include PEP 594 "Removing dead batteries from the standard library"... one of the modules schedules to be deprecated is cgi.

[https://www.python.org/dev/peps/pep-0594/](https://www.python.org/dev/peps/pep-0594/)

As out of date as the module is, reading the PEP made me nostalgic for the days of hammering out a quick CGI script, and I've probably got a few of those scripts still chugging away.

<comment><USER27> PEP 594, actually: [https://www.python.org/dev/peps/pep-0594/](https://www.python.org/dev/peps/pep-0594/)

<comment><USER26> Thanks — fixed

</comment></comment></comment><comment><USER28> It's worth noting that the RHCE (Red Hat Certified Engineer) used to require to at least be able to write a simple CGI script and make it available via Apache.

I haven't checked how this changed in the last RHCE update, but still.

I had the opportunity/necessity to write a couple of CGI script. While it's not comfortable at all, the nice thing is that the HTTP server makes not assumption on what language/runtime you're using. Literally, any out of the box apache will be able to run cgi scripts, no matter what language you used to write them.

If for any reason you cannot install other runtimes, you can still use CGI.

Whether you should, that's a different matter.

</comment><comment><USER29> I still do a fair amount of CGI; it's just fine for low traffic simple web services. Startup time for the script isn't awesome, to fix that you want FCGI or SCGI or whatever. Apache's default MPM these days is event (or worker) which scales CGI pretty well. Beware that it's not thread safe, so if your CGI script is doing something multithreaded it will break. (Related: if you're doing something multithreaded, it's time to graduate from CGI).

<comment><USER30> Multiple CGIs under worker and event get their own processes, they don't run in the same process as Apache nor eachother

</comment></comment><comment><USER31> Author is speaking past tense, showing lack of knowledge. CGI programs are in use, nothing "passed". All major web servers have CGI support, and it has so much use in web applications. It is standard protocol that is not going to go away.

</comment><comment><USER32> CGI is still "widely" (I don't know how to quantify) used in web interfaces for IoT devices that did not drink the Lua kool-aid. That's _a lot_ of CGI out there. Not dead yet.

</comment><comment><USER33> One of my most popular sites was CGI until 2014. Now it's just static files, rendered from the same cgi program. And the reason it changed wasn't related to performance.

</comment><comment><USER34> I cut my web-teeth on CGI. I was a TA instructing physics undergrads in C (I think around 2007). I only really knew C and python myself, and was tasked with building a page which students could upload programs and results to. It was the perfect abstraction given the tools I had and my primitive understanding HTTP at the time.

It took a few yesrs to realise I was hooked, and while I don't use CGI nowadays I'm really glad I started out with it.

</comment><comment><USER35> I'd like to point out that CGI (and its descendents) can be used with any language, not just C (e.g. there are various false dichotomies in these comments between PHP vs CGI+C).

There are also many fast, compiled languages which, unlike C, are memory-safe, make string handling easier, are higher-level, have stronger types, etc. In particular, ML-family languages like Rust/Ocaml/ReasonML/StandardML/Haskell are really good as meta-languages for safely generating other languages like HTML (that's what the "ML" stands for ;) )

It would be a shame if an inexperienced developer got the impression that their pages would load faster if they taught themselves C. Yes, it's possible to write reasonably-safe C; no, an Internet-facing CGI application isn't a good idea for a first C project.

</comment><comment><USER36> Anyone else noticed that the page is constantly doing some requests to log the users behavior, e.g., on scroll? Also some of these requests (always?) fail.

Was annoying as the page did some jumps on these requests and the icon indicated the loading activity. If you have to do - do it in the background.

<comment><USER37> This weirdness also polluted my history with the page at different scroll intervals. I had to click back about 20 times to get back to HN because ever scroll action was in my history.

</comment></comment><comment><USER38> > since the server was directly executing the script, security issues could > easily creep in (the script shares the permissions of the HTTP server).

This is still the case. PHP often runs as www-data, Rails or Django or Node or whatever often run as a normal user (usual guess, Ubuntu user id 1000) with read/write access to all the files in that user home directory. Running in a container gives some isolation now.

Anyway, writing my first CGI script in C back in 1994 was quite a hell (not a very convenient language for string processing), then Perl and CGI.pm got the upper hand for a while.

</comment><comment><USER39> What _were_ cgi script? Not sure that people have stopped using them. Old things don't always need replacing; some times, they still work fine (though you have to watch your security).

</comment><comment><USER40> How CGI scripts differ from Amazon Lambda and other serverless solutions?

<comment><USER41> For CGI you have to maintain a server running Apache or some other web server software and persistent storage for a copy of your script along with a means of deploying them. You are limited to concurrency equal to the number of cores/threads and memory on your server or you have to manage some means of load balancing between multiple servers which you maintain along with deploying your script to each of them.

Certainly you could run a cluster of servers or even an auto-scale group of servers with all of your cgi programs and handle lots of http requests. Serverless/Lambda means you don't have to do this.

Also, not all lambda's are handling http requests, so you'll need to figure out the best way to deal with other events and monitor queues, etc.

<comment><USER42> The real difference is amazon is doing it for you, not that it isn't happening.

<comment><USER41> I believe i framed my entire response from the perspective of how it is different for you. That is the whole point of lambda. You do less.

</comment></comment></comment></comment><comment><USER43> Acting like CGI is dead was the reason I (feel like I) wasted three years with PHP. It's not, and if the thought of "programming" webpages in C/C++ sounds appealing to you, you should definitely check it out.

The obvious advantages: Total (binary) control of data streams and structures and execution as well as (nigh-)zero runtime overhead.

The obvious disadvantages: Static and rigid, not well suited for rapidly changing requirements (unless they are coded in), longer development times and increased complexity.

</comment><comment><USER44> Isn't FastCGI (ok, I guess it's not really true CGI) still the canonical way to set up PHP with a webserver?

<comment><USER45> FastCGI is a binary (vs text) + enhancement version of the CGI protocol so it is less expensive to parse. CGI (the protocol) doesn't specify the execute- per-request, it's just a convention.

In the wild you will find php-cgi, php-cgid, mod_php, and php-fpm (fastcgi)

</comment></comment><comment><USER46> Find the path to Pearl and the magic will be guaranteed. I installed a lot of Perl cgi scripts.

</comment><comment><USER47> Used to do mine in Perl... a tangled web of Perl scripts. They worked at the time!

<comment><USER48> Remember Lincoln Stein and CGI.pm?

[https://en.wikipedia.org/wiki/Lincoln_Stein](https://en.wikipedia.org/wiki/Lincoln_Stein)

I wrote a Perl module (Smil.pm: [https://metacpan.org/pod/Smil](https://metacpan.org/pod/Smil)) that mimics his, wrote him about it, and it was thrilling when he responded.

</comment></comment><comment><USER49> This makes me ask the question: How much knowledge are we going to forget in the next 50 years...

\---

We have forgotten so much. But our mental velocity has been so vast in the last ~100 years... we are going to foget key knowledge soon....

</comment><comment><USER50> I wonder -- are there benchmarks out there of fastcgi vs reverse proxy via http server for various languages? I'd expect that fastcgi would be faster, but everyone uses reverse proxying nowadays.

</comment><comment><USER51> What would be the main benefits of today's serverless against classic CGI? I can think of auto scaling, but I'm not sure it wasn't possible (or even used?) in the past.

</comment><comment><USER52> What's old is new again! Many of the benefits (and drawbacks) live on in webasm and serverless execution.

</comment><comment><USER53> "Were?"

CGI is still the best choice for this. It's easier to guarantee your server's Perl installation has all the latest security patches than it is to guarantee your users' browsers all do. AJAXy nonsense is mostly too error-prone, too insecure, and too slow.

</comment><comment><USER54> I miss the days when I had shell on a unix box and could just drop a .pl file into my ~public_web directory and have random people on the internet run the script with the permission of the webserver user. Back before there was any concern with doing such a thing.

</comment><comment><USER55> crap I feel old now

</comment><comment><USER56> s/Were/Are/

There, I fixed it for you.

</comment><comment><USER57> I wonder if we've reached the point where many of the people who would have been using CGI scripts (if they had not been succeeded by newer technologies to provide dynamic functionality) no longer know what it is.

<comment><USER58> I am pretty sure we reached this point quite a few years ago. From what I know, most people learning web programming nowadays start with Rails, Express JS or whatever framework of the day they have been recommended, and use the integrated HTTP server for development, I would assume, often without even really worrying about what is actually happening. CGI scripts are definitely not on the list of things to learn there.

</comment></comment><comment><USER59> CGI scripts sound like a very simple idea when described here, but I avoided learning about them at the time because the name was so arcane. Is there a good reason why these weren't simply called "executable pages", or "response programs", etc.?

<comment><USER60> Because Perl scripts were only one application of CGI, which was intended to be a generic interface between the web and any sort of backend. The thing that became Oracle Web Application Server for example started life as a direct interface between a web server and an Oracle database called WOW for Web- Oracle-Web. There were others. Pretty soon the "application server" took over that role as a thing in its own right, and instead of a Perl script directly invoked by the web server you would have a JSP or something.</comment></comment>


India Launches Unified Payment Interface API - <AUTHOR> http://www.npci.org.in/UPI_Documents.aspx <comment><USER2> This is so 90's :) [http://www.npci.org.in/images/newnpci.gif](http://www.npci.org.in/images/newnpci.gif)

<comment><USER3> Many (if not most) government websites have "NEW!!" flashing GIFs all over the place.

</comment></comment><comment><USER4> A good overview of how it would work: [http://yourstory.com/2016/02/mobile- wallets-upi/](http://yourstory.com/2016/02/mobile-wallets-upi/)

I'm very curious as how it would now play out for 'digital wallets' like Paytm, MobiKwick, PayUMoney etc.

Paytm is a "Unicorn". It is perhaps valued at $2B with 125 Million users. [http://www.business-standard.com/article/companies/paytm- val...](http://www.business-standard.com/article/companies/paytm-valuation- jumps-to-1-5-billion-115011600025_1.html)

<comment><USER5> How do these guys make money (or plan to) ? I know PayTM is trying to be a market place but I'm wondering if there are other ways they make money.

<comment><USER4> One straight forward (and older) way is to charge commission from the retailers.

The digital wallets in India started with recharging balance for prepaid mobiles. When somebody recharges, Paytm and its ilk charges commission in the range of 2-5% from the Telcos.

</comment></comment></comment><comment><USER6> Quick introduction to Unified Payment Interface: [https://www.facebook.com/cnbctv18india/videos/10244978642542...](https://www.facebook.com/cnbctv18india/videos/1024497864254278)

</comment><comment><USER7> About NCPI: [https://en.wikipedia.org/wiki/National_Payments_Corporation_...](https://en.wikipedia.org/wiki/National_Payments_Corporation_of_India)

</comment><comment><USER8> This is more like "a company in India launches", not "India itself launches".

<comment><USER9> "Bank consortium in India", including the Indian central bank and nationalised clearing bank. So very definitely a public-private joint venture.

</comment></comment><comment><USER10> We (Razorpay) recently did a webinar[0] on UPI, along with a corresponding blog post[1]. We also have an FAQ[1] up on the same.

A lot depends on how many customers adopt UPI and how well the banks implement it. If they respect what all NPCI has said, UPI could change a lot of things (affect wallets, improve transparency, cashless economy etc). However, a lot is hanging on few points:

1\. How well do banks implement UPI?

2\. Does NPCI open up UPI to more players? If yes, when and who? Wallets are the one that are most interested in this. [3]

3\. Do they improve on UPI over time? As of now, UPI is missing a lot of its (promised) teeth. For eg: recurring payments, pre-authorized payments, split payments.

If anyone is interested on knowing more, I could probably answer a few questions here :)

[0]: [https://youtu.be/0Yyxor0VYsE](https://youtu.be/0Yyxor0VYsE)

[1]: [https://razorpay.com/blog/what-is-upi/](https://razorpay.com/blog/what- is-upi/)

[2]: [https://razorpay.com/upi/](https://razorpay.com/upi/)

[3]: [http://www.livemint.com/Companies/ZSGu2hTgSn21bKzvY8hycI/Pay...](http://www.livemint.com/Companies/ZSGu2hTgSn21bKzvY8hycI/Paytm- strengthens-top-management-for-payments-bank.html)

</comment><comment><USER11> It would be really cool, if somebody comes up with a tutorial.

</comment><comment><USER12> Lol no one's getting access</comment>


Sparrow Flies Away, Google Pulls iOS/Mac Email Apps from App Stores - <AUTHOR> http://techcrunch.com/2015/02/17/google-sparrow/

<comment><USER2> I guess it's better than the alternative of having it rot in the app store, but this news makes me hesitant to ever buy another startup's popular app.

I hate the fact that I had found a great app/system, set it all up throughout my machines only to have it exit.

<comment><USER3> I know this opinion won't be popular here but to me this eventual result should be expected as the norm for basically all VC funded startups.

VC's fund startups for a financial gain - they get that financial gain when a startup is acquired, which usually involves a much larger, established company. Being bought out is considered "winning" and is the ultimate goal for VC funded startups.

The type of companies that can afford to buy out VC funded startups are generally not going to be buying to continue business-as-usual. The whole reason for VC funding is often that the business (model) can't be profitable on its own, and thus must change somehow to become a worthwhile part of the buying business.

<comment><USER4> I'd suggest that Microsoft appears to be doing the opposite lately, as evidenced by Acompli and likely Sunrise. But I agree this is generally the case.

<comment><USER3> Agreed, Microsoft's approach with Acompli has been different, but that's also a fairly unique situation where Acompli only existed because of a lack of a dedicated client targeted at Exchange customers - it may be that the purchase was as much about appearances (i.e. not reliant on a 3rd party for mobile) as anything else.</comment></comment></comment></comment>


Small Projects, Big Companies - <AUTHOR> https://pioneer.app/blog/small-projects-big-companies/ <comment><USER3> I love that the post points out the importance of selling to executives instead of users. As much as users hate most of their tools, they have very little say on what gets bought. Executives make those decisions and no amount of grousing or changing from internal users will change that. Solutions that sell upwards in an org (yammer for example) are very much the exception.

<comment><USER4> > I love that the post points out the importance of selling to executives > instead of users. As much as users hate most of their tools, they have very > little say on what gets bought. Executives make those decisions and no > amount of grousing or changing from internal users will change that.

It's possible to "sell" directly to users, but you have to have a particular pricing structure: free to individuals.

This is what TravisCI, Dropbox and Slack did.

You actually have to have a really good product to pull this off, though.

<comment><USER5> Slack? In every company I know that uses it, it was blessed by IT. It's hard to adopt for a subset of users in the company.

<comment><USER6> I've had the opposite experience. The developers start using Slack, then invite PMs, BAs, QAs, etc, they work with. Then the PMs start using it to talk to each other. Eventually, someone from compliance says "we need to pay for this to have a full audit log", and someone from IT says "what's the JML process for this?".

</comment></comment></comment></comment><comment><USER7> > The golden dataset everyone wants is the org chart. Who reports to whom. Who > is new. Who has been at the company for a while. Find a way to get this data > and sell it to companies. I suspect you'll have many takers.

Please don't. Please. Really. Please don't. Training my users to fend off social engineering attacks is hard enough as is. Please don't use your talents in this way.

<comment><USER8> I think this is the exact point of the article. Executives don't think like you, so if you want to make it big with your software, you have to change how you think. Even if it means annoying middle management and their direct reports.

<comment><USER9> That might be the point of the article, but the point of the grandparent is that the only method to get this data is to be seedy as hell. And that we should aspire to use our talents for better things.

<comment><USER10> Better things don't pay, at all. The most betterest things you can do as a developer - make infrastructure that makes other developers more efficient, or invent protocols or fundamentals to build ecosystems and industries on - <USER2> you get nothing for it. Because you made it open source, because you wanted it to be useful. But to try to make it proprietary would have been to make it useless.

Theres a reason probably 95% of software developers are employed to write redundant repetitive corporate business software over and over and over again. Everything else is being done philanthropically because anyone outside the perview of a budget department at a big co recognizes the value in reaching a consensus solution everyone uses because its a lot of work to make and is good enough. Even corporate-adjacent software like databases, game engines, etc are trending this way - Unreal, Unity, and Godot are all varying degrees of open now in ways engines weren't even a half decade ago. The world is coalescing around Postgres in a way unexpectable a decade ago under the tyranny of SQL Server and Oracle SQL alongside a half dozen "competing" open source databases.

Do you think those who contribute the most to Postgres get anything close to "reasonable" compensation for having architected the database engine that is now running likely trillions in business infrastructure and data management?

Their software is maximally useful - "the betterest things" \- but you can't survive being maximally useful. You have to sacrifice how useful what you make is to not be homeless in 99.99% of cases. You have to make worse, often redundant things, wasting your time and the time of others in the process, because thats the only (feasible and/or reliable) way corporations will pay you to write software.

<comment><USER11> Why do we have such an emphasis on making our tools open source?

How much does the license matter?

Would it be feasible to release source code for inspection while simultaneously retaining exclusive rights to operate the software?

Would that garner a negative response from the developer community?

<comment><USER12> This is like a source available license and we're trending to that. elastic, redis, I believe mongo, are all making versions of this that allow the source to be public and even used for commercial purposes, but not for commercial purposes that compete with the company.

</comment></comment></comment></comment></comment></comment><comment><USER13> Number 4 is ethical quicksand. Please don't build a machine that guesses personality traits based on personal data. It won't end well.

<comment><USER14> In the past when people created arbitrary unquantifiable categories and then proceeded to put people in them based off of unempirical/irrational voodoo it was called superstition (ex. Astrology). Involve a computer in your rituals and now it's AI.

<comment><USER13> Or worse, phrenology, which sounds very funny today but at the time people were applying it as if it were actually scientific.

</comment></comment></comment><comment><USER15> The thesis seems to "build enterprise software" because those people have a budget.

I enjoy reading people's startup ideas. But this is a pretty uninspired list - ("Better Google Groups", "Better Zendesk", etc) There are thousands of solutions to these problems out there.

Not sure what makes them more ripe for a startup then bill splitting or pizza.

<comment><USER16> I think you said exactly why these are more ripe. Your customer has a budget for it.

</comment></comment><comment><USER17> Re: Zendesk

It's not just that ticketing products won't build next-gen reporting with thematic monitoring and analysis, it's that big companies have more than one source of customer conversations.

Actually answering the questions that matter when it comes to customer contact -- "what's driving specific outcomes, and what about them has changed over time" \-- needs to be done across all sources.

The company I work at (frame.ai) is an add-on with built-in connectors for all the help desks like Zendesk, Intercom, Service Cloud, Help Scout, etc. for this reason.

</comment><comment><USER18> > Legal-Doc-to-Google-Form

> Every founder goes through an identical process: downloading Microsoft Word, > changing variables in a legal template, opening it in Preview, attaching > their signature, and sending it over to the counterparty. Automate this > process. Offer templates for common documents (company formation, SAFEs, > etc). In time, you might become the store-of-record for company documents.

My friend was working on a product that does this called Formswift! I can upload a PDF, have it convert to a set of form fields, and email it out pretty quickly.

It's not the most glamorous-looking startup, but it works really well for the mom-and-pop small businesses that are their usual clientele.

Take a look: [https://formswift.com/self-serve- builder](https://formswift.com/self-serve-builder)

</comment><comment><USER19> > 3\. Backchannel.app

Having a hard time seeing this turn into anything but linkedin wankery. The people who could give you honest responses either don't care enough to or will start a 'you scratch my back, I'll scratch yours'.

> 5\. Org Chart As a Service

Prepared to get sued out of existence. I was at a finance firm where all external emails were sent to both legal and security. I had to redo security training because I didn't report a phone call I got from an external source that shouldn't have had my details.

And god help you if you do any of those ideas to EU citizens.

</comment><comment><USER20> > 7\. Legal-Doc-to-Google-Form

Shout out to Clerky who has been doing this wonderfully since 2011.

</comment><comment><USER21> I don't think you could come up with a better critique of the problems with silicon valley today than "this product wouldn't have billions of users, but you could charge the elite few quite a bit for using it."

<comment><USER22> could you elaborate

<comment><USER23> Things are getting built for the 1% because they have the economic power, but I'd imagine OP thinks this is undemocratic (which it is) and results in many people becoming underserved by software companies (very likely).

<comment><USER24> What is getting built for specifically the 1% (or .1%, etc.)? The only service I can think of is Magic.

Additionally, what markets are underserved? This is an area I'm interested in but don't know much about (except from my own anecdotal experience like the fact that comparing costs of healthcare from different practitioners being prohibitively difficult)

<comment><USER23> > What is getting built for specifically the 1%

Should clarify that by "specifically for" I'd mean that the 1% have all the money and thus practically all the decision making power. An example of the distinction would be that though everybody engages with AdTech software the software is built _for_ the 1% to make them money.

The 1% isn't a demographic that's targeted by some SaaS in this case, it's a way of naming the rich who create the demand for a lot of software (they use the software to make money) and control the (high-level) implementation of most software in the world.

What's Magic?

<comment><USER24> It's a service where you can hire an on-demand personal assistant for $30/hour, [https://getmagic.com/](https://getmagic.com/). I never saw the appeal.

</comment></comment></comment></comment></comment></comment><comment><USER25> The point on selling to managers is the big one, imo. Not users not the company, at least not directly.

While the "decision maker" is not the user, they may be the project lead/implementor.

Certain managers are looking for low risk, high visibility projects & notable successes. They're expending a sort of social capital within their company, putting themselves on the line.

Those are the managers that need to like your thing.

Companies selling to these people need to focus on those individuals, and figure out what the hell "costs," are, irl, to them. It's not money

</comment><comment><USER26> Can someone elaborate on "Backchannel.app" thing ?

<comment><USER27> It's the common use-case: you don't know whether to trust someone. If you ever know anyone who is in danger of being hired by a friend, your friend will ask you how it was working with that person. This is usually a high-signal source because you're not going to lie to your friend, your recommendation or anti- recommendations are things you want to be meaningful, and because you have direct evidence.

They want to scale this. I've discussed this same thing with friends before but we couldn't find a way to keep it clean.

This is also a powerful advantage of a good network. You hear someone's leaving some job through the grapevine and if it's accompanied with positive feedback you hire this person. Or you're looking for a person and you ask your network for the guy who can do it.

That's how I got my current job.

<comment><USER28> But once you automate the backchannnel, it becomes impersonal. If someone is vindictive they can ruin careers through such a system. If you dont actually know a person, how can you trust their recommendation?

<comment><USER27> Well, we couldn't figure out how to make things work and decided not to pursue. Maybe the next guy will have better luck.

</comment></comment></comment></comment><comment> alex-wallish I'm curious who #6 would be valuable for. It seems like a cool thing to make, but who is the customer?

</comment><comment><USER29> For #7 there is the great webmerge

[https://www.webmerge.me](https://www.webmerge.me)

</comment><comment><USER30> Number 7 Legal-Doc-to-Google-Form is being done by Axdraft (YC W19)

Disclaimer: I'm friends with one of the cofounders.

</comment><comment><USER31> Number 7 seems like a no-brainer. Is there a reason this hasn't been done yet?

<comment><USER8> Pretty sure LegalZoom does this?

</comment></comment><comment><USER32> It's kind of disappointing that the pioneer "RFA" projects are all "more of the same" SV. I don't see anything audacious , like "build a chip that competes with Nvidia" or "build a pharmaceutical model that improves over what we have", or "find a way to do high quality journalism without a paywall". For that matter, I don't see any inkling that any of these ideas have anything in particular to do with their self-styled goal of helping outsiders get in.

For reference, here is what their main page advertised as what they seek: "We fund projects and startups built by ambitious outsiders... Apply with any type of project you need help with. It could be a company, physics research, journalism, or art..." The RFA is basically a message, "but really, this is what we want"

I guess it's easier to talk big than take risks with big money.

<comment><USER11> It may also be a case of different strategies for different channels.

If I were a VC, I might prefer to solicit these kinds of solid, boring business ideas in an RFA and source moonshot ideas through my personal network. If I looked for moonshots from my open application process, I would probably end up wading through a lot of applications that would be time- consuming to vet.

<comment><USER32> That's what I would do as a VC, too, but then I wouldn't premise the advertisement of the open application for my accelerator on something misleading.

</comment></comment></comment><comment><USER33> "Make something managers want. "

The PG quote reformulated...

</comment><comment><USER34> We are building better zendesk here - [https://provlem.com](https://provlem.com)

Still, many to go, but we have started to build better zendesk already.</comment>


How to Save the Web - <AUTHOR> https://www.nytimes.com/2018/12/06/opinion/tim-berners-lee-saving-the-internet.html <comment><USER2> I get a feeling of mild confusion after reading this article, because he keeps juggling between the Internet as a technology, the web as the sum total of linkable resources (or maybe the synonym for the Internet; I am not entirely sure), and specific internet companies.

> We need a free and open web for everyone.

Right. But at the same time:

> internet companies must play their part in making sure the web is safe, > accessible and protects user data

So, when Facebook, Twitter, Youtube, etc. banned Alex Jones (probably in the spirit of making the web "safe"), how did they advance the cause of "free and open web for everyone"? Why don't deranged conspiracy theorists (who certainly belong into the all-encompassing category of "everyone") deserve free and open web too?

"Free and open for everyone" should also mean no more attacks on Russia for using Facebook or Twitter to influence the opinions of the American public. Because "free and open for everyone" has no concept of national borders. And yet, Tim managed to combine the rhetoric of universal freedom and openness with the rhetoric of state sovereignty, borders, and us-theming ("foreign" interference, etc.)

Also, as pointed out in other comments, the goal of "free and open" internet does not align very well with the purpose of many media companies or content producers in general, who want to be compensated for their work.

I am very much a child of the promise of free and open internet. So when I see articles like this, it confuses the hell out of me.

<comment><USER3> Adding to the confusion is how someone as bright as Lee thinks more government control and regulations is going to lead to "free and open".

<comment><USER4> After WWII, the newly created state of Israel offered Albert Einstein to run for president.

Mr. Einstein, being exceptionally bright, declined the offer, saying something like: "I'm but a physicist, and am not qualified in the areas of statesmanship".

</comment></comment></comment><comment><USER5> " In recent years, it has become clear that the web is not living up to the high hopes we had for it. ... These worries are justified. In recent years, we've seen governments engage in state-sponsored trolling to quash dissent and attack opposition. We've seen hacking and foreign interference distort politics and undermine elections. And we've seen how the spread of fake news on social media can trigger chaos, confusion and lethal violence."

1\. The web is one of mankind's greatest inventions: a mirror of society in a cyber world. It has greatly surpassed all expectations, and is The Highlight of the 20th and 21st centuries.

2\. Fake news, hacking, foreign interference: nothing new under the sun. Democracy has major flaws which all governments take advantage of.

I understand where mr. Tim Berners-Lee comes from, but it feels so simplistic, even naive to propose something which various governments will not even read or comment on.

The true battle lies in changing society. Without overhauling democracy, we'll still be faced with voting issues. Without overhauling the press, we'll still get mass disinformation. And so on...

<comment><USER6> "The Internet was done so well that most people think of it as a natural resource like the Pacific Ocean, rather than something that was man-made. When was the last time a technology with a scale like that was so error-free? The Web, in comparison, is a joke. The Web was done by amateurs." \- Alan Kay

What's so great about the web, that makes you say it is one of mankind's greatest inventions? I get that you think it is a "mirror of society," but is that very great? AFAIK, the web is mostly used to 1) browse memes and 2) get informed on new things to be outraged about. I'm genuinely curious what expectations you see the web as having "greatly surpassed."

<comment><USER7> " AFAIK, the web is mostly used to 1) browse memes and 2) get informed on new things to be outraged about."

Well that's an argument from ignorance if I ever heard one. Much of anything I've ever learned is from the internet ( e.g. Wikipedia, books, oddly specific youtube vidoes on car repair), and I'd have a much harder time in my career without the amount of material on Math/CS online. One can literally find top level educational material for free, whether from sources like MIT opencourseware or the many textbooks freely available. I'm sure other people have found great uses for the web too.

I suspect you're caught in a bit of a bubble.

<comment><USER6> I do this too. I learned pretty much every valuable skill I have using resources freely available online.

In my experience, this is pretty uncommon though. I know only a few people that use the web this way, and _a lot_ who browse the front page of reddit, watch whatever videos show up in their FB feed or on the front page of YouTube, etc.

The resources are there, but are they used enough to make my statement regarding what the web is _mostly_ used for invalid? I don't know.

For the month of September 2018, OCW reported 1.09M unique visitors [1]. In their 2017 annual report, Facebook reported 2.13B monthly active users [2]. I suspect the comparisons between coursers, edx, udemy, etc and reddit, Twitter, memes, etc would be similar, and three orders of magnitude seems sufficient to say "most."

If you think your web use is typical, perhaps it is you in the bubble.

[1]: [https://ocw.mit.edu/about/site-statistics/monthly- reports/MI...](https://ocw.mit.edu/about/site-statistics/monthly- reports/MITOCW_DB_2018_09_v1.pdf) [2]: [http://d18rn0p25nwr6d.cloudfront.net/CIK-0001326801/c826def3...](http://d18rn0p25nwr6d.cloudfront.net/CIK-0001326801/c826def3-c1dc-47b9-99d9-76c89d6f8e6d.pdf)

<comment><USER7> Yeah, I concede that it's greatly surpassed in terms of volume. And that bubble probably wasn't the correct term.

However, my comment was more arguing against what you said with the context in a previous comment:

"What's so great about the web, that makes you say it is one of mankind's greatest inventions?"

-I don't believe that an invention being used largely for unhelpful uses makes the (still large) amount of benefit any smaller. So, even if educational use is dwarfed by facebook, it's is still a wonderful tool for many.

<comment><USER6> That's a reasonable perspective.

I disagree, however, because my opinion is that the trillions of hours spent are not simply unhelpful (i.e. neutral) but actually damaging. My calculation is therefore that the net impact of the web is maybe negative, because the positives are swamped by the greater volume of negatives.

</comment></comment></comment></comment></comment></comment><comment><USER8> As much as I agree with Tim's premise, this article is mostly useless politicking. The internet suffers from a combination of the tragedy of the commons and what I call tragedy of the new world. [1] The tragedy also afflicts governments, corporations, and foundations. Excuse me if I am skeptical that governments and organizations will fix their inherent issues reflected by the internet. Tim asking politely will not be enough I'm afraid. Meanwhile I'm relatively happy in my current, non-abusive world of HN!

[1]: [https://freetradersoftware.com/pages/The_Tragedy_of_The_New_...](https://freetradersoftware.com/pages/The_Tragedy_of_The_New_World.html)

The tragedy of the new world is a cycle where a group of smart, resource people start a platform that solves some glaring problems. The platform works beautifully and a thriving community of smart, resourceful people come in gathers. More problems arise and are squashed like a game of Whac-A-Mole. Eventually the founders lose their inspiration, quit, retire or die. The remaining members, now of much increased size and diluted merit, cling to processes left behind. As time passes these processes devolve into tradition, ritual, or meme. Due to some unforeseeable change in the structure of the original problem, the rituals stop working. For as long as possible, the members (of much increased size and diluted merit) continue to attempt shoving a square problem through a round process. Eventually a new body of leaders, also of much increased size and diluted merit, come up with a high dimensional hyper plane process to solve the problem. High dimensional hyper planes are impossible for humans to visualize so most don't understand why the square problem doesn't fit. After much scratching of heads, the platform dies as people leave to dilute the merit of the new world.

<comment><USER9> > Meanwhile I'm relatively happy in my current, non-abusive world of HN!

Sorry for going a bit off-topic, but is it non-abusive or is it our little bubble?

<comment><USER10> Both?

</comment></comment></comment><comment><USER11> I don't think the web has changed and I think HN is the perfect testament to that opinion.

Almost all of the interesting content I consume online comes from personal self-build blogs, HN or real news papers like the NYT.

I don't think the content is worse, especially not when you pay for news. Now the NYT is a poor example of this, but the Danish equivalents, Information and Weekendavisen are not, in that one turns off it's advertising when you subscribe and the other is simply not available for free.

I think in terms of the internet, you get what you pay for. For news the price is money, on HN the price is your ability to be relevant and fair and on personal blogs the price is the time it takes to find them, support them and make interesting responses to them.

The key thing that has changed for me, is how to find interesting things. HN is really the only option I know of, unless you get extremely lucky on a search engine. Because modern search results are so influenced by Alexa rankings and advertising that they very rarely lead you to the gems on the net. I do think the amount of shitty content on the internet, and unregulated/moderated social media makes the problem a lot worse, because it's harder to find interesting things in an ocean of shit. But ultimately, I think there are as many interesting things on the net as there has always been.

I do find it interesting, that none of the websites I love the most, are powered by any of the popular JavaScript frameworks, well aside from the NYT, but to be fair, the thing I dislike the most about the NYT is it's intrusive JS.

<comment><USER12> > I think in terms of the internet, you get what you pay for.

I'm coming round to this perspective. After years of reading "free" news sources I decided to experiment with paid sources. I subscribed to the Times (UK newspaper) and the Economist. The difference in content-quality and design is immense. I particularly like the Times's website compared to the Guardian and other free online newspapers.

As an example, the Times publishes stories in daily editions, much like a traditional newspaper. They may be updated throughout the day, but, as a paywalled publication, there is no pressure on it to publish a constant stream of hot takes and low-grade commentary (as you find in The Guardian) throughout the day to get eyeballs on adverts.

<comment><USER13> You're kidding right?

The Times is nothing but poorly researched clickbait or got take opinion columns preying to the bosses of its readership.

I think you can find high quality paywall content (the FT for example), but yeesh, those are very, very bad examples.

<comment><USER12> > poorly researched clickbait or got take opinion columns

Sounds more like the Guardian than the Times. Why would the Times need to publish clickbait? Its articles are behind a paywall and it doesn't have advertising?

<comment><USER13> It certainly does have advertising - it's comment is written for the print version, and readers can still read two articles a month (with advertising) without subscribing.

It has the ill researched bigotry from the likes of Janice Turner whipping up populist hatred of sexual minorities, and a series of impossibly bad technology reporting echoing the lobby lines of the current government based on nothing more than a vendetta against online companies for business reasons.

</comment></comment></comment></comment></comment><comment><USER14> Berners-Lee lost me when he supported EME. Basically, I view that as a coordinated infrastructure (the political component) that allows for a "universal" technological lockdown (the engineering component -- weaponized by the political coordination and corresponding universal dissemination).

In other words, you will never save the Internet from authoritarian bozos, when they hold the keys -- that _you_ manufactured for them.

You want to talk about saving the Internet? You have to own the physical layer -- keep it open. The rest is filtering.

Now, to RTFA, I suppose.

Oh, another example of what I'm saying: The Great Firewall of China was prototyped and initially built using Western technology and expertise. That bootstrapped them; it "gave them the keys".

The Chinese authorities have understood very well and increasingly effectively use this: Control of the physical layer.

And, they're exporting turnkey systems for this.

Maybe that's what "saving the Internet" looks like, for some people. The censored Internet. The one that tells you what's ok to build and to say -- that sooner or later butts up against innovation, dynamism, needed change and progress.

</comment><comment><USER15> > Let's make 2019 the year we push back against the forces subverting the open > spirit of the web.

I used to like TBL, but I can no longer take him seriously when he says stuff like this, after his decision[0] to allow DRM/EME[1] into the web standards. It just rings hollow.

[0][https://www.w3.org/blog/2017/02/on-eme-in- html5/](https://www.w3.org/blog/2017/02/on-eme-in-html5/)

[1][https://www.w3.org/TR/encrypted-media/](https://www.w3.org/TR/encrypted- media/)

<comment><USER16> I agree, his tarnished reputation casts a shadow on anything he says these days about the "open web".

</comment></comment><comment><USER17> OR, you know, we could make the web gradually end to end encrypted and decentralize the back end from being federated as it is now. Why do we need DNS, seriously? It's just a glorified search engine that can only get you to the front page of a site. The vast majority of links to resources on the web may as well be non human readable.

I look forward to a time when software is client-side, things are only ever decrypted client-side, social networking is basically automated key sharing, contact lists are private, keys never leave the device and group activities are all written in Javascript and done by consensus of the participants.

[https://qbix.com/blog/](https://qbix.com/blog/)

<comment><USER18> Are the security and privacy properties of Qbix dependent on Javascript cryptography? How do you handle JS package dependency and integrity management?

</comment></comment><comment><USER19> It's quite ironic that this is posted on a shitty website with a non-GDPR- compliant stalking "consent" prompt.

How about you do your own part before talking to others about "saving the web"?

<comment><USER20> I'd say the _author_ of this piece did do his part, by inventing the web.

<comment><USER21> Wooosh ;

The web has spun so deep that

Net upon unseen

</comment></comment></comment><comment><USER22> TL;DR Tim Bernes-Lee wants governments and companies to sign a "Contract for the Web" document outlining a set of principles about the Internet.

"Berners-Lee said the full terms of the contract would be agreed in the coming months, with the objective to finalize it in May 2019 - the 50/50 moment when more than half of the world's population will be online for the first time."

[https://www.reuters.com/article/us-portugal-websummit- berner...](https://www.reuters.com/article/us-portugal-websummit-berners- lee/web-creator-berners-lee-launches-contract-for-better-internet- idUSKCN1NA2CX)

<comment><USER23> Thanks for the succinct sumary, even having read the article it provides a good starting point for discussion in it's content.

This is the bit I'm worried about, alongside Tim's reference to fake news earlier in the article:

>They make it clear that individual citizens have a responsibility to act with compassion and challenge negative behavior they wouldn't tolerate offline

'They' being governments and institutions, who Tim want to make responsible for policing free speech. If this isn't going to be a horrible, apocalyptically bad mistake "acting with compassion" and "negative behavior" had better be very carefully defined.

The Economist published an article earlier this year by an Ahmadi Muslim arguing that Geert Wilders' cartoon contest for depictions of Mohamed should be banned. I can undertand abhorrence to such an abusive stunt, but as I pointed out in a comment on the article, Ahmadiyas themselves have been persecuted in Pakistan of 'insulting Mohamed' because their beliefs about him contradict Sunni teachings. When one person's religious belief is another person's heresy, you have to be very careful about how you go about 'challenging negative behaviour'. Bear in mind the governments Tim wants to enlist in doing this include Pakistan, Saudi Arabia, China, Russia, etc, etc.

Fake news is a devilishly difficult thing to define, as is negative behaviour. Tread softly Tim!

</comment></comment><comment><USER24> What is it exactly that we want to save? Bloated browsers so complex that not even MS can keep up with development? Shitty web apps needing obscene amounts of resources and power just to lock you in into web services? Clickbait journalism, a monopolistic attention economy, privacy invasion, surveillance, censorship, influencers, and propaganda?

I guess the conclusion is that the web is only as valuable as the content delivered over it, but has no inherent value of its own, or even a net- negative value. We should salvage valuable content off the web, and take stuff we want to keep elsewhere. We should create new content in a way that isn't locked to the web.

<comment><USER25> The Internet has changed the world and just ignoring it won't change it back. We won't be able to completely evade the tiresome phenomena you mention, either on the web or irl. I still have a faint hope we might be able to carve out a niche where we can use the web without falling prey to these things more than absolutely unavoidable. However, the masses have spoken and it seems glaringly obvious that they don't give a rodent's backside.

<comment><USER26> The Internet is not the web. The later is part of the first one.

</comment></comment></comment><comment><USER27> Lots of 'got to', not much 'how to'. Too bad Aaron isn't around, he actually had executables.

</comment><comment><USER28> "To live and let die" comes to mind

</comment><comment><USER29> Tim should put his money where his mouth is!

He posts on Twitter instead of his own blog. Saving the web is pretty simple: post to your own blog and stop using closed silos like Facebook and Twitter. Support IndieWeb tech instead of calling for government regulation.

Also, why is Facebook considered the web? Unless you're a member the content isn't accessible. Facebook exposes practically no HTML on the web at all.

</comment><comment><USER30> "That's why I'm asking governments, companies and citizens across the globe to commit to a set of core principles for the web."

Who does this guy think he is?

"By Tim Berners-Lee"

Oh shit...</comment>


Palantir's software was used for deportations, documents show - <AUTHOR> https://techcrunch.com/2019/05/03/palantirs-software-was-used-for-deportations-documents-show/ <comment><USER2> So? How is software being used to manage the system of national border enforcement interesting or newsworthy?

<comment><USER3> How is the software being used to manage the system of national border enforcement NOT interesting?

<comment><USER4> Why aren't there articles about big bad tech companies providing software which enables the control over the flow of goods at commercial ports?

<comment><USER3> Because people are more interesting than goods, and software that controls the flow of people has more immediate repercussions...

<comment><USER4> Only because we pretty long ago agreed that it is important for a government to control the import and export of goods at it's borders.

Pay your tariffs, citizen.

<comment><USER3> > _Pay your tariffs, citizen._

I'm all pro-tariffs, and against rampant global trade.

Domestic production boosts autonomy, keeps working class jobs, is more environment friendly (taking into account the externalities in either way), doesn't lead to a wage race to the global bottom, and makes it more expensive to build some stuff (hence reducing consumerism).

I'm also in favor of the historical notion of "citizen" \-- e.g. I believe each person has a duty to his country and community (in the "Don't ask what your country can do for you, ask what you can do for your country" sense, and in the more historical ancient Athenian sense). I'm not for people basking in their snowflake individuality while still taking advantage of all that his country and community made possibly to enjoy like cheapskates.

</comment></comment></comment></comment></comment></comment><comment><USER5> Palantir looks like IBM in the 30s but without the technical excellence and all the sales force.

<comment><USER6> I'm not sure it's quite the same thing as

[https://en.wikipedia.org/wiki/IBM_and_the_Holocaust](https://en.wikipedia.org/wiki/IBM_and_the_Holocaust)

but still not great

</comment></comment><comment><USER7> There are people actively fighting the dehumanization and there are people building tools to dehumanize and defend their work. In a movie or artwork which side do you think are going to be portrayed as the 'good guys' and who are you going to be rooting for? That is cognitive dissonance.

This is just more evidence of how the lack of a moral compass has led the software community to not only sell out and build these creepy tools but worse defend surveillance and police state technologies without a hint of self awareness in these kind of discussions.

Without push back and dissent it's only a matter of time the software community is completely tainted with collusion as a group of opportunists with zero ethics by the general public like those collaborating with authoritarian police states against the people.

<comment><USER8> > This is just more evidence of how the lack of a moral compass has led the > software community to not only sell out and build these creepy tools but > worse actually defend surveillance and police state technologies without a > hint of self awareness in these kind of discussions.

I'd only add that there's certainly a small part of the community that realizes this, in fact the free software movement is also about ethics, however the kind of developers who are aware are usually not your usual Valley types.

<comment><USER9> I'm not 100% sure that the ethics of the free software movement have a single solitary thing to do with, say, objecting to the sorts of things Palantir's clients get up to. Speaking from experience, F/OSS provides very little control over end user behavior; you can turn down a 'evil' client if you are proprietary but not if you are F/OSS. Not a dig against F/OSS, just a statement that their ethics don't really address these concerns (I'm sure they would have arguments that a greater good is served, etc.)

<comment><USER8> Sure, but I'd differentiate somewhat between "open-source software", (i.e. ESR) and "free software" i.e. RMS. Which is why I did not use FOSS, but free- software explicitly. Maybe it's even better to narrow it down to copyleft only.

Open-source is not at all concerned with what's ethical. It's free-software made corporate-friendly. Free software certainly is a bit different, if you for example look at the sort of campaigns the Free Software Foundation advocates for, there's a lot of political campaigning that has to do with ethics.

You cannot reasonably restrict software for 'no evil use' as that definition is subjective and open to abuse, but the FSF is definitely more concerned with software ethics than the OSI.

<comment><USER9> Yes, but neither group seems to regard "oh geez, my Kalman filter code is being used to build baby-killing rocket drones" as part of the range of ethical questions that software licensing might cover. I'm not saying that either group on the free/open source software spectrum _should_ be engaging with this issue or that it would be helpful if they did ("Apache License Variant Number 57, No Babykilling Plz!") but one of the aspects of free or open source software is that you have pretty much zero ability to stop what some folks might consider highly unethical or immoral uses of one's software.

</comment></comment></comment></comment></comment><comment><USER4> When did deportation become a dirty word?

> _an operation in 2017 in which immigrants crossing the border were arrested > for deportation_

Because it is illegal to enter the United States except for at controlled points of entry. This is true of every nation in the world. The power to control borders is part of the definition of sovereignty.

If you don't think it should be illegal to enter the United States at any location, call your Representative and get the law changed.

</comment><comment><USER10> They also used software from Google, Microsoft, and every other big company. If there's an issue with the agency and government then that's where the attention should be, not with some corporation.

</comment><comment><USER11> Are we now against all forms of deportation? This is pretty silly.

<comment><USER12> Rather like the War On Drugs, it's worth asking what all this life-ruining use of violence is actually achieving.

<comment><USER11> There are lots of reasons that open borders might not be a good idea. There are certainly reasonable arguments in favor of them as well. But if you're not going to have open borders, then you have to deport some number of people. So, either you're making the case for completely open borders and all that comes with it, or you're in favor of deportation.

<comment><USER13> > So, either you're making the case for completely open borders and all that > comes with it, or you're in favor of deportation.

It's this type of black and white thinking that is so poisonous to current discourse. There are many people that are okay with deporting illegal immigrants, as long as they are treated with some modicum of respect during the process, families are not separated, asylum laws are upheld, and children brought across the border at a young age that know no other place are allowed to stay.

There are pretty reasonable solutions to these problems. Unfortunately, everyone prefers to see only my side versus your side.

<comment><USER11> > It's this type of black and white thinking that is so poisonous to current > discourse. There are many people that are okay with deporting illegal > immigrants, as long as they are treated with some modicum of respect during > the process, families are not separated, asylum laws are upheld, and > children brought across the border at a young age that know no other place > are allowed to stay.

Nothing I said contradicted any of that.

<comment><USER8> > Nothing I said contradicted any of that.

You made it seem as if the people arguing for decent treatment of illegal migrants are somehow for 'open borders', when nobody on the left is seriously talking about having open borders.

<comment><USER14> > nobody on the left is seriously talking about having open borders.

This is a blatant lie.

<comment><USER8> Ok, strong statement, any evidence?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> How does Palantir actually make their money? I know probably a lot though government contracts, but I've never heard of them out side of the comp sci field until now.

<comment><USER16> Same as other consultancies and software companies. They get hired by other companies for ridiculously high daily wages and sell their platform for recurring fees. E.g. in a recruiting event they demonstrated how they setup their data analytics platform for a chemical plant to optimize production. Most of the work is transforming and structuring the data.

<comment><USER17> \- high pressure sales tactics convince management its cheaper to "buy off the shelf" than build your own

\- but we aren't selling you a finished product (didn't we mention that?), just a base framework that needs customization. Cue fly-in-fly-out consultants for exorbitant daily rates.

\- to lower costs, why not send your own staff to our "university" for thousands of dollars for a 5 day class?

\- hire said staff to become consultants after customer pays for their training. They don't appear out of thin air!

\- when customer finally ditches product, blame them for lack of investment and use contacts to complain at highest levels of bureaucracy.

\- rinse and repeat.

A tried and tested formula.

<comment><USER18> Palantir combines those techniques with one extra thing... Government.

Government is far less concerned about money-efficiency, and nobody working in government has a direct interest in profitability (like being a shareholder would). Hence those tactics work all-the-better.

<comment><USER19> Combine that with the fact that government can't go bankrupt. If some department blows through way more money than it should either it just doesn't get it's job done or it gets more money. Pretty painless compared to what happens to a company that blows through a bunch of money without delivering results.

<comment><USER18> I wonder what would happen if government departments were allowed to go bankrupt?

Simply say "this is your budget for the year, if you spend more, we'll fire every one of you and sell the office".

And then hire an entirely new team of non-overlapping staff next year.

</comment></comment></comment></comment></comment></comment><comment><USER20> How about Excel? Is anyone using Excel for something bad and immoral? Watch out, Microsoft. Social justice might be coming after you soon.

<comment><USER21> This is custom software built for these use cases, not something generic like Excel. They're worlds apart

<comment><USER20> I don't think Palantir has a purpose-built app for immigrant children separation and deportation. As far as I can understand (from the product videos that I've seen), Palantir is rather general-purpose software for data mining and analysis. If it's less generic than Excel then only by a small margin.

</comment></comment></comment><comment><USER21> Important to highlight because Palantir initially lied about what they're building and what it's supporting. Makes you think about what else they have their hands in

</comment><comment><USER22> This stupid article should be simply flagged. There is no good discussion can come out of it.</comment>


California Zero-Emission Push Grows to 8 States, 3 Million Autos - <AUTHOR> http://www.bloomberg.com/news/2013-10-24/california-zero-emission-push-grows-to-8-states-3-million-autos.html <comment><AUTHOR> I'd be curious if any of these 8 states is also blocking Tesla sales with dealership laws. Or have special taxes for electric vehicles. I know VA charges something like $64/year.</comment>


Jonathan Schwartz Blog - <AUTHOR> http://jonathanischwartz.wordpress.com/ <comment><USER2> "What I Couldn't Say..." about driving a Fortune 500 company into the ground.

<comment><USER3> Come on, he wasn't CEO until April of 2006; all you can fairly say is that he failed to save Sun, which is a very different thing.

<comment><USER4> "The decision to go with Microsoft was based on overall value - it was also predicated upon their endorsement of and agreement to help promote MySQL. Stay tuned for more details on what we'll be doing together."

From: [http://blogs.sun.com/jonathan/entry/winds_of_change_are_blow...](http://blogs.sun.com/jonathan/entry/winds_of_change_are_blowing)

This has always been my favourite example of Shwartz' inability to grasp reality. Perhaps I am interpreting this incorrectly but Microsoft "help[ing] promote MySQL?" This deal didn't sound sane in January 2008 and it looks even more ludicrous to me in 2010.

By early 2008 the company had lost most of its value despite having a strong brand and a talented pool of engineers. What was going on at Sun? Deals to ship dinky browser bars with Java, JavaFX (which stood no chance in a market dominated by Adobe with Microsoft nipping at their ankles), no roadmap for JAVA 7, inability to see the potential benefits of ZFS on Linux - really, we could be here all evening.

You don't "save" a company - You run a company and you should be "saving" it every day with every decision you make.

</comment></comment></comment><comment><USER5> Is it the real jonathan?

<comment><AUTHOR> I was wondering the same thing until I saw it linked from his account on Twitter.

<http://twitter.com/OpenJonathan/status/8972790094>

</comment></comment><comment><USER6> I have had just about enough of My Little Pony.

See this opinion piece from the SJ Mercury News (from yesterday) for a well- formed opinion: <http://www.mercurynews.com/breaking-news/ci_14385237>

But in summation:

\- Schwartz will depart with $12.8 million in severance

\- The company will pay his health insurance premiums for two years

\- Average Sun employees got a maximum of three months of pay

\- Average Sun employees got a maximum of two months of health insurance, in some cases less.

In January, Jonathan wrote to Sun employees: "For those that ultimately won't become a part of Oracle, this will be the first step in a new adventure." Then a few days ago he wrote a cute little haiku to announce his termination from OraSun.

The laid off employees' haiku? Mike Cassidy, who wrote this editorial for the Mercury News, says it would go something like this:

State unemployment /

over 12 percent today /

Losing health insurance soon.</comment>


All 27 things wrong with today's Daily Mail front cover - <AUTHOR> http://www.newstatesman.com/politics/uk/2017/03/all-27-things-wrong-today-s-daily-mail-front-cover <comment><USER2> Regardless of whether or not the Daily Mail's cover is lowbrow or inaccurate, this article's tone is disrespectful and borderline offensive. It genuinely oozes immaturity, a lack of empathy, and pride in the author's disconnect from those affected.</comment>


A Stick Figure Guide to the Advanced Encryption Standard (2009) - <AUTHOR> http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html

<comment><USER2> My favorite slide: [http://2.bp.blogspot.com/_Zfbv3mHcYrc/Sre5JqBKZyI/AAAAAAAABn...](http://2.bp.blogspot.com/_Zfbv3mHcYrc/Sre5JqBKZyI/AAAAAAAABn8/Op- n-e0JVaA/s1600-h/aes_act_3_scene_02_agreement_1100.png)

<comment><USER3> Should be added to many text books too.

</comment></comment><comment><USER4> We, the people[1], demand more Stick Figure Guides!!

[1] mostly me

<comment><USER5> [http://mathwithbaddrawings.com/](http://mathwithbaddrawings.com/)

Assuming you're specifically demanding stick figures doing math. It tends towards middle school level math and light comedy. The mystery of "point nine repeating" which was pretty interesting in 7th grade, and a skit along the lines of four technical professions try to split the check at a restaurant.

If someone knows of higher level stick figure math (aside from the linked AES discussion) that would be interesting.

Theoretically there are probably startup ideas around stick figure presentation online (a blogging / image service oriented strictly around sequential stick figures and comics?) or maybe in the infrastructure of something not as formalized and boring as visio but a little more cleaned up than a phone camera shot. Or an online service dedicated to cleaning up phone camera pics WRT hand drawings maybe even with OCR.

</comment></comment><comment><USER6> I remember finding this comic very useful when I had to implement AES for a crypto class.

<comment><USER7> Implementing AES for crypto class? Seems the kind of school I would love to go to.

<comment><USER8> You might like my intro to ASIC/HDL course that I took as a junior at Purdue University. My team won an "AMD Design Award" for our VHDL implementation of a timing-attack-proof AES encryptor that sits on a PCIe bus. [0] Other, wanted, features were omitted (like decryption) for die space concerns. This animation was popular among my team. =)

One of the features that helped it win the award is that it used file IO for "language bridging". Most of the other projects were pure VHDL. Our project used Python to verify the VHDL and Python AES implementations against each other. Fairly simple (OK, VHDL file IO isn't great) in practice but very powerful in effect.

We also had an interactive demo where you would enter a block and key. The Python implementation would encrypt the block and print the output. We would also run the key and block through ModelSim running our VHDL implementation (making sure to go through the PCIe bridge). The output was displayed to the user, allowing them to "see with their own eyes" that the implementation was correct. It was a powerful demonstration. The other team that also won implemented a Java simulator for their 3D "GPU", at least as much as a GPU you can do in 2 mm x 2 mm with ~35 um feature size standard gates.

0: [https://github.com/jevinskie/aes-over- pcie](https://github.com/jevinskie/aes-over-pcie)

</comment></comment></comment><comment><USER9> If this page displays wrong for you too and you just want to view the images. [http://pastebin.com/MDk6uv1X](http://pastebin.com/MDk6uv1X)</comment>


Ask HN: How to spend a marketing budget of $US 2k per month? - <AUTHOR> Hi HNers,
We are a startup in the casual gaming space, beta for a couple months, just hit 10,000 users and picking up pace.  Main demographic is teenage - 20 something girls.
Haven't spent any money on marketing, so far just done a bit of posting on some relevant game sites and forums/social networks.
Now we're growing and will close a seed round shortly, we're putting aside $2k per month for marketing budget (vast majority remains on development).
We know viral/referral is the only long term strategy but want to spend a bit to gain an initial audience.
Question - how would you spend that budget? <comment><USER2> Personally I would experiment with different sources and different types of adds. The main thing to do is find out if the adds are working.

If you are advertising online there is always the big two - Google(Adwords) and Yahoo(Overture). I would also have a look at some online comics. The two bigest ones focusing on gaming are: * <http://www.pvponline.com/> * <http://www.penny-arcade.com/comic>

There are about 50 other comics that focus on gaming. Each one focuses on different types of gamers. So if you can try different comics.

The most important thing is to make sure you know how well your campain is going. If you haven't set up a marketing funnel I would probably try to setup on of those first: * [http://sethgodin.typepad.com/seths_blog/2006/01/understandin...](http://sethgodin.typepad.com/seths_blog/2006/01/understanding_t.html) * [http://brianwong.com/blog/funnel-visualization-with- google-a...](http://brianwong.com/blog/funnel-visualization-with-google- analytics/)

If you have a revenue model you can even justify spending more money on advertising. Even if you are just trying to BUY market share it is worth know where you will get the most bang for your buck.

Nathaniel Brown - <http://www.adinobro.com/>

<comment><AUTHOR> Thanks Nathaniel, we use analytics a lot and have some ad:hoc ways of getting some stats, but haven't properly setup the goal/funnel view... we should.

<comment><USER2> The main idea is that if you use goals and then segment your marketing dollars into say 10 lots of $200. You can then run 10 different tests. You might run campain A on site 2 for a month then change to campain B on site 2. Different campains might work differently on different sites. The main thing is keep testing. For the first 3 months you might waste a bit of money but by the 3rd month you should be able to allocate at least half of your money to areas that work based on the tracking you've setup and then keep spending at least a little bit trying new sites. If you don't have at least some for testing new sites you will eventually start to saturate your market. Keep a log of sites that were ok because you might want to go back to them with a new campain targeting their users later on.

</comment></comment></comment><comment><USER3> It seems to me you have to focus on your demographic and spend some time figuring out their top websites, then figure out ways to partner with them. It sounds obvious but if you spend the money on getting Digg frontpaged or an ad on Penny-Arcade the customers presumably won't actually stick, since they're not your target audience.

Can you set up a myspace page? Add Facebook integration, a Facebook fan page, etc? Advertise on Livejournal? Celebrities is a good one as someone else mentioned, also fashion and style sites - with the death of print, could you even afford to advertise in Cosmo or the teenage equivalents? As well as casual gaming sites and possibly MMO sites, as plenty of women play MMOs and look for other distractions as well.

To be honest although I'm a twentysomething girl I'm somewhat atypical and don't really know what sites my 'demographic' visit - but you need to find that out. Maybe look at some of your competitors too, there are a ton of casual games out there.

If you've got 10k users already maybe you can incentivise them to recruit a friend with some of the marketing budget as well. Free months/extras etc.

<comment><AUTHOR> yes, we'll introduce the "refer a friend" + "import your contact list" in a couple weeks

</comment></comment><comment><USER4> While there are always exceptions, I'm guessing most startups that are around the 10k user mark have plenty of _free_ low hanging fruit left in terms of improving a user's experience or getting more traffic in general. Whatever you end up doing, you're going to get a lot more bang for your buck with a more optimized flow.

Personally (and without knowing more about what you guys are doing), I'd spend the $2k exploring different avenues to get a better idea of what kinds of things do and do not work. It's hard to know what may or may not work sometimes without trying it, at least a little bit. Seemingly similar startups may have very different levels of success with things like untargeted Google Adwords, targeted Google adwords, other methods of product placement, etc., and while you can't always get conclusive evidence from $2k, it's a start.

<comment><AUTHOR> Yes, we have plenty to improve in improving the flow and newbie experience

Always wondering about what priority should be new features we need for stickiness vs improving the first time experience

<comment><USER5> Honestly? first time experience if you want to grow your userbase.

You only get one chance to make a first impression.

For example, there are many arguments to why WOW is a dominating force in the MMO market and one of them is with the "first 5 minutes" concept. It hooks players early and from there tries to keep the experience fairly pleasant through the first X levels of play.

There are many other MMO's out there and the first 5 minutes can be frustrating. These games usually don't do as well.

EDIT - Having thought quickly about another benefit of stickiness vs first impression, this is another argument I came up with that is pro-first impression.

I think that if you had to choose between the two, that first impression is better for the network effects that it can create.

Think about your browsing behaviour and how you pass content along to your friends.

When you find something new and interesting, do you send it to your friends (via IM/email/facebook/twitter) straight away or do you wait a couple of days before you send it?

<comment><AUTHOR> Good point

</comment></comment></comment></comment><comment><USER6> Develop linkworthy content which is unique to your site.

<comment><USER5> It doesn't even need to be on your site - there is a certain digg user (I forget his username) that always does a bait & switch with content.

Basically he sets up microsites that look well designed (it's usually a very simple single page design) and have relatively funny content aimed at the Digg community.

He then submits that content to Digg, pushes it, waits for it to frontpage and then changes the page to have a "sponsored by" or similar message at the footer or header, but so it looks like it's part of the actual original design.

He does this often (perhaps twice a month?) and the cost is very minimal to him, but sends several 10's of thousands of users to his main site and each of these microsites provides Google juice for his main site.

He has also managed to pickup additional traffic from bloggers looking for content via Digg.

Since your main target is teen-20something females, I'd probably start thinking up comedic microsites related to various celebrities? They always seem to be a fairly easy to hit target.

<comment><AUTHOR> Thats a good suggestion, thanks! ps - got any links to the digg examples?

<comment><USER5> Ok after some searching I found an example. The guy who used to do this is named Matt Inman and this is one example.

<http://mingle2.com/dating/phases>

You can also see some of the other microsites towards the footer of that page. They all usually changed after they frontpaged to promote his dating site. Classic bait and switch.

<comment><USER7> Inman is a great marketer and has all sorts of interesting tactics for driving traffic to his dating site. He's also the former CTO of SEOmoz (<http://www.seomoz.org>).

Here's a recent interview with him about marketing: <http://blog.mixergy.com/real-marketing/>

<comment><USER8> Thanks for recommending my site Gibbon.

The Inman interview you linked to is full of techniques for marketing that doesn't cost money, but it does cost time.

My suggestion is to pick just one of his techniques and focusing on that (quizzes, shocking content, for example).

<comment><AUTHOR> thanks guys!

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> What's your site? A link or name would help us understand your product better. It's always easier to give advice when we see the product rather than blind.

</comment><comment><USER10> Are the websites/games free or paid?

If it's free and you're really after eyeballs, you might considering utilizing methods that give you a higher reach. I'd think about websites with a low CPM/PPC rate that reach your demographic. I'd also consider spending that money on developing a good FaceBook integration.

If you games are paid, I'd consider spending a little more on PPC/CPM rates to get a high quality audience.

<comment><AUTHOR> Free for now, introducing paid options starting later this month. Yes, we'll do Facebook app/connect to get our viral growth rate up, planned for next month.

Any suggestion how to find the sites targeting particular demographics and their rates? Sorry if that sounds like a noob question, we haven't done any advertising before and are not in the US (although most of our new users are)

<comment><USER10> One idea might be to utilize Google Adwords (network sites) to find sites by demographic and then

* use Adwords to advertise there,

* go direct to the sites and see if you can score better deals,

* use various websites like Alexa to find websites just like those sites so you can go direct and talk about sponsorships

* use a combination of the above

</comment></comment></comment><comment><USER5> I've already replied to this thread but I thought I would add another anecdote about using ads. This is just my personal experience, but I think can underline that you really need to be creative.

Personally, I think online ads are mostly a waste of money unless you get a good, measurable conversion from those ads.

Using Adsense for mostly branding or signing up free users is, in my opinion, the wrong approach since everyone is doing it. It ends up a war of attrition with who has the bigger budget, with the only winner being Google.

That's not to say you can't do very interesting things with online ads from a branding perspective. I've used online ads to great effect to create notoriety, the ad units themselves didn't increase traffic, it was the word of mouth associated with what I was doing with them.

Last year when I was spearheading the campaign to get Rick Astley the Best Act Ever award at MTV's Europe Music Awards, a bit of a rivalry occurred between the Tokio Hotel fans and the Rick Astley fans - I used this to my advantage.

Essentially, I leveraged Google's Adsense to plaster simple flashing (annoying) "Vote 4 Rick" ads all over other fansites around october 20th when the site's traffic was flat.

Post's below contain screenshots that blog readers were sending in of ads in action.

<http://www.bestactever.com/2008/10/20/please-stand-by/>

<http://www.bestactever.com/2008/10/23/this-oozes-irony/>

All up, I think the ad spend over a 10 day period was about $20 .. it was around that, I don't remember it costing me too much.

You can see the traffic increase to the site as people became interested again with what was occurring and telling their friends of the pranks that were happening.

[http://files.marklancaster.org/images/bestactever_traffic_oc...](http://files.marklancaster.org/images/bestactever_traffic_oct1-nov11)

In one case, I managed to embed a rickrolling flash ad in a certain Tokio Hotel Fansite, belonging to a critic of our efforts. She got so angry that she actually disabled advertising for her site so that I couldn't get ads in there.

<http://www.bestactever.com/2008/10/26/unappreciated-gift/>

I also started targeting certain fansites directly, specifically one fan fiction site because they used Project Wonderful and the Ad unit was relatively cheap.

This is the message that the admin of that fansite sent to me via project wonderful. I found it to be highly amusing and this is the first time that I have made this public. I literally had every ad spot on their site filled with a flashing "Vote 4 Rick" ad which cost me the minimum $5 for project Wonderful and lasted about 4 days.

      Hello Mark Lancaster,

      Darcy Gilmore has sent you a new message! The message is:

      </comment><comment></comment><comment></comment><comment>---
      Subject: Your Ad on our TH Site

      I love that you're advertising on our site, it's ingenious! Keep up
      the hilarious work, it's making all of our douchebag members foam at
      the mouth, and nothing pleases me more than that.

So, I guess the overall message is get creative. Create Purple Cows. Nothing beats word of mouth dollar for dollar.

<comment><AUTHOR> Thanks, froo, we did a little test of a couple of viral things (tag a friend / youtube etc) but to be honest they didn't really do so much, maybe because the content was cute but wasn't funny/shocking/bizarre enough...the hard part is to come up with a creative idea

<comment><USER5> I think really the best thing you can do is listen to your users, keep your fingers on the pulse of your site and then act accordingly.

In my case, I didn't create the rivalry, I simply listened to what the readers were saying and the discussion happening on other sites and reacted accordingly.

It's much easier to ride a wave than it is to create that wave.

Sidenote: There were a few negative effects of my antics, but I turned those lemons into lemonade. The people in the IRC channel at the time got a real kick out of what I was doing.

It ended up in the sites comments being spammed a little by Tokio Hotel fans in a short couple hour window, which luckily I noticed it as it was happening.

I actually found much joy when I noticed this occurring in realtime and redirected those particular people to a rickroll on YouTube using a 301 redirect for those specific IP's in the .htaccess file.

Actually the best use of this tactic (specific IP redirects) was to a certain Tokio Hotel fan/critic named Claire (admin of a TH fansite) who left a very nasty comment on the site. I simply set up a redirect for her IP to a subdomain on the site and a page I set up specifically for her in minutes.

<http://hacked.bestactever.com/>

She was very upset thinking I had somehow "hacked" her computer and had emailed me with all sorts of threats and many four letter words.

The site's users got a huge kick out of that. It was childish yes, but that's what the site required at the time. Stupid childish antics. It added to the site's notoriety and was free - word spread around about the antics and traffic increased as a result.

</comment></comment></comment><comment><USER11> if you are in the casual gaming space, I'm guessing you are doing flash games. Spend that money to hire some people to develop games for you. Almost any game will spread like wildfire all across every single game aggregator, and will drive a ton of traffic your way

And if you are going to ask questions, you shouldn't hide your startup name on here, you'll get higher quality help, if people know exactly what you are doing.

</comment><comment><USER12> I'm no expert on marketing, but I think I'd check out StumbleUpon paid ads:

<http://www.stumbleupon.com/ads/>

<comment><USER13> Having used stumbleupon ads I'd have to say that the quality sucks. YMMV but for our main site and our news site StumbleUpon didn't add anything for us.</comment></comment>