Ask HN: Should I be on Twitter? - <AUTHOR> As a member of an early stage startup, let's say a technical founder, should one be tuned in to social media? What is one leaving on the table one way or the other? What advice would you give for making best use of such tools, and balancing the associated challenges? <comment><USER2> PROS

* Potential marketing for your startup, especially if you gain followers that are also in your target audience.

* Have a way for someone (e.g. investor, potential employee, potential business partner, etc) to look you up and see what kind of person you might be.

CONS

* Distraction away from your customers and team, which should be among your top priorities. It can take time to cultivate a social media presence.

* Misinterpretation risk. For better or worse, if you happen to say something that can be misinterpreted, and someone has an agenda against you, social media can be risky. Assume that everything you say can be posted on a billboard in every major city.

MY $0.02

Each of these carry different weights. I would argue that the disadvantages far outweigh the advantages.

If you want marketing benefits, you'll get more bang for your buck by having someone with lots of marketing experience. Being discoverable by investors via social media is really a minor thing; you'd have to substantially invest in your "social media reputation" in order for this to give you anything, and even then, it's more useful as a tool to maybe get meeting with an investor, than it is to secure funding from that investor.

Being a distraction from your core priorities is really the most important thing I'd offer. Social media can easily be a black hole for attention and time. That's attention and time you can't afford to lose right now.

</comment><comment><USER3> I removed all social media and I found that for the development community specifically, the only social apps that really matter are GitHub (if you consider that social) and Twitter. I had no problem as a dev removing Facebook, Instagram, Snapchat.

When I removed Twitter, I found that there was definitely a missing piece of my outreach to the community. If you use Twitter effectively, it _can_ help build your personal brand which, in turn, can help your company's brand.

Just don't let it turn into mindless surfing. Keep your activity tactical with a marketing objective. The goal is to add value to your business in terms of hiring and technical influence.

</comment><comment><USER4> You should definitely be on Twitter and Facebook, but a better question is if you should be active on these social networks.

Unless you are producing lots of marketing materials (tutorials, new features, blog posts, etc) and/or creating an audience I don't think you should invest resources in being active. A simple light presence should be enough.

Lots of people (myself included) prefer to send a tweet to a project/company than sending an email. This has the advantage that it's a public indexable conversation that could, given the circumstances, even become viral.

<comment><USER5> >Lots of people (myself included) prefer to send a tweet to a project/company than sending an email.

This. I'll tweet-complain at a company but I'm not going to mess with opening up a customer service chat or firing off a customer service email where I may or may not get someone based in the United States and might have to wait several minutes with a chat to get someone or a day or more via email.

If a company has a decent customer service plan, they're usually pretty on top of seeing twitter mentions and will reach out. AT&T, Zappos, McDonalds, State Farm, WEMO, Wendy's, Papa John's, Chevy Customer Care and Bumble are just some of the companies I've had positive exchanges with on Twitter when I've had issues.

Companies I've taken useful information from their posts however is considerably smaller: the Red Dwarf account (how I learned about the most recent season).

</comment></comment><comment><USER5> I think twitter is largely useless with the exception being using it as one of many avenues to detect unhappy customers so you can identify and help them, like Zappos does.

</comment><comment><USER6> What is the outcome that you desire? Dont just join twitter. Do it with a purpose in mind. It is certainly very useful, but having no strategy will net you zero results. Figure the outcome first, otherwise you will miss.

</comment><comment><USER7> A lot of developers especially high profile ones are on Twitter. It's a decent platform for catching up on news as well as promote your company or get its name out there.</comment>


Federal Court Throws Out Six Weeks of Warrantless Video Surveillance - <AUTHOR> https://www.eff.org/deeplinks/2014/12/federal-court-agrees-eff-throws-out-six-weeks-warrantless-video-surveillance <comment><USER4> It goes against the US tradition, but I'd prefer to _not_ have the 'fruit of the poisoned tree' doctrine but instead direct penalties for violations by police.

As it stands, it has the following effect:

1\. If illegal actions by policemen violates the rights of someone commiting a crime, then the evidence obtained this way is discarded, letting a true criminal go free, assuming that the evidence actually proves guilt.

2\. If illegal actions by policemen violates the rights and privacy of an innocent person (e.g. me) then nothing happens.

In both cases, any benefit of the doctrine goes to people who don't deserve it - the lawbreakers with or without badges and uniforms.

For most law-abiding people who value their rights and privacy it would be rational to request that the doctrine is "violations by police in gathering evidence get handled by existing law".

If a policeman obtains evidence by breaking down a door without a warrant and taking some documents, despite being a professional with special training on what their specific rights and duties are, then let the evidence stand but let also the policeman stand trial (not disciplinary action, but a proper trial) for breaking and entering. Just as for cases of policemen shooting people - <USER2> least worldwide, given the recent events I'm not sure anymore how it's in USA.

<comment><USER5> In the US, illegal actions by policemen (alleged or not) result in suppression of that evidence less than 10 percent of the time (in actual courts). Judges just don't like to suppress evidence, even in the face of what you and I would consider overwhelming reasons.

Police in the US get an extreme amount of benefit-of-the-doubt from the public and especially prosecutors' offices (police keep them in business and both sides value their working relationships), as we've seen in recent newsworthy court cases- this alternate approach you've suggested does not appear to be an improvement except in theory.

<comment><USER4> Bribery laws also don't mean that every crooked official gets caught, but still they have some positive effect as a deterrent.

I'm fairly sure that if a cop had a 'less than 10 percent of the time' risk of permanently ending his career, then they would be much more careful than they are now. Of course, there could be an argument that we as a society don't want our cops to be _too_ careful with rights of criminals, we also have an interest in them taking some risk and getting risky evidence; but that's a bit different direction of values/morals/rights.

</comment></comment></comment><comment><USER6> Needing a warrant for long term video surveillance of one's home--I can get on board with that. Despite the defendant's bad reputation, the larger implications here have the EFF defending the common man as per usual.

<comment><USER7> Absolutely. The reputation of a suspect should not be grounds for erosion of their rights.

<comment><USER8> To take this a bit further:

Concepts like "rights" and "freedom" are easy when it is people you like doing things that you like. It is so easy, that it isn't even necessary to bother with the formalization of those concepts in these _easy_ cases. The entire point of "rights" and "freedom" is that they _must_ be upheld for the people you _hate_ , doing things that you _hate_.

When judging the level of freedom in a society, you don't look at how the normal citizen is treated; you look instead at how the underclass, criminals, and other disliked groups. If their rights are overlooked and ignored, any claims at being a "free society" is just marketing/PR.

<comment><USER9> Thank you for saying this.

If there is every a doubt in your mind, consider that at some point, your actions, race, or lifestyle might make you the target of similar hate. It is very bad for any majority group to be able to take the rights away from any minority group.

I'd point to the overturning of CA Prop 8 as a major success of the equal protection clause, and a good example of this concept in practice. - [http://en.wikipedia.org/wiki/California_Proposition_8_(2008)](http://en.wikipedia.org/wiki/California_Proposition_8_\(2008\))

</comment></comment></comment></comment><comment><USER10> Wow. Not only the obvious issues with this, but they used his shooting some cans (not exactly a crime) with a rifle as grounds for a warrant to search his house, for an unrelated crime (the one they really wanted to peg him on, drug trafficking; a diatribe in itself). That's all -manner- of wrong.

<comment><USER11> Shooting cans isn't a crime, but being an illegal alien and possessing a gun violates federal law.

> A month later, police observed Vargas shoot some beer bottles with a gun and > because Vargas was an undocumented immigrant, they had probable cause to > believe he was illegally possessing a firearm.

If they had seen him shooting cans when walking by on the street, and then gotten a warrant to search his house, this would've been totally legit.

Edit: don't get the down votes. Do we not like gun control or what?

<comment><USER12> If he was a known undocumented immigrant, why couldn't ICE step in and arrest him and in the process find a valid reason to search the residence?

Mind you, I'm super glad the judgement was made in his favor, but only because of HOW they did it, not why.

<comment><USER11> I think evidence of illegal firearms possession is a hell of a better reason to search his residence than his just being an undocumented immigrant.

<comment><USER12> I agree. However, the manner in which the evidence of the illegal firearm was obtained is a serious issue.

So, my question was, if they had a reasonable suspicion he was a drug dealer but not enough evidence to obtain a warrant, then why not let ICE handle the matter since he was an illegal immigrant anyway?

And to be clear so people don't get it in their head I have something against immigrants, I'm all for people immigrating to wherever they want to live, but it's 100% unfair to those immigrants who did it legally to treat illegals like anything other than an illegal immigrant who should be deported.

P.S. Is using the term undocumented immigrant supposed to be the PC way of saying illegal immigrant?

<comment><USER13> If I had to guess, because it's problematic because they wouldn't have had probable cause to determine his immigration status anyways. I.e. they can't just walk up to the guy's house and demand to see his green card just because.

And yeah, that's pretty much exactly what it is. Some group of fools think that referring to immigrants with the qualifier "illegal" is somehow a slight against the person rather than their legal status.

<comment><USER14> _they can 't just walk up to the guy's house and demand to see his green card just because._

Sure they can! All immigrants are required to have proof of status on them at all times. It's rarely enforced, but it is the law.

Before I became a citizen I carried a copy of my green card with me at all times.

<comment><USER13> Being required to carry it at all times and being hassled on the grounds of your skin color because you _might_ be here illegally are two different things. The reasonable suspicion standard and other rights don't stop applying just because someone is an immigrant.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> So how do you go about applying this ruling? If I live in the suburbs do I have this protection? What if I live in a city? There are likely to be thousands of homes in view of existing cameras. Which ones of those are collecting admissible evidence? If a police department doesn't aim the camera at only one person's front door, but films several homes as a pretense, is that ok?

Is two weeks too long to set up surveillance? What about two hours?

I really hate the "reasonable expectation" standard in general and this ruling does nothing to clear the waters.

<comment><USER16> I would imagine that this sets the precedent of requiring a warrant to either set up a camera, or to access an existing camera's records.

</comment></comment><comment><USER17> It's also interesting that they might not have got a warrant to look at his garden for a month. They weren't looking for any particular behaviour - <USER3> something that would allow them to barge into his house and discover evidence of drug-related wrong-doing. If they had spotted (say) public drunkenness, they might also have argued that his house be searched. Putting up a camera to spot 'any tiny thing that the person does wrong' would seem to be very flimsy warrant-wise (I would hope).

</comment><comment><USER18> My local news station likes to do these specials about the "supposedly homeless" where they follow people who ask for handouts by the highway and film them going in to their homes and also film them through their front windows. I challeged the reporter on the ethics of this and she told me, 'It's perfectly legal.' While technically true, is that really a good source of justification?

<comment><USER19> If the beggars actually pretend to be homeless, I think they're fair game for being exposed. But asking for handouts by itself is not pretending to be homeless.

</comment></comment><comment><USER20> i wonder if this will increase or decrease the use of 'parallel construction.'

in other words, will this reduce the unlawful use of surveillance tech, or merely prompt officers/agents to walk by places 'by chance' to observe things 'serendipitously' because they're still using inadmissible surveillance tech but also know they'll need to fabricate something plausible for the courts?

</comment><comment><USER21> If a human was watching the house in person, would a search warrant have needed to be obtained? Not trying to incite anything here--I realize there are differences--but I was curious about the legal implications of video vs. in- person surveillance of a property's exterior.

</comment><comment><USER22> <sarcasm>Wow. Save (an alledged) drug trafficker from incriminating himself in plain view. They really did the public a huge favour here. </sarcasm>

As much as I support the rule of law, there's no way I can interpret that as benefiting mankind in any way.

<comment><USER23> No civil libertarian is delighted to save criminals from prosecution just to frustrate law enforcement. It often happens that the frontiers of acceptable state conduct are tested in such cases, though. Here, EFF isn't interested in making sure Vargas can shoot cans in his yard without interference. Rather, they are concerned that the government not be able to put people's homes under 24/7 video surveillance without even probable cause (which is all that is needed for a warrant).

<comment><USER22> Then, maybe the correct course of action for the EFF would be to work on improving the warrant system, rather than working on keeping alleged drug- dealing, unlicensed gun owners, illegal immigrants out of legal trouble?

<comment><USER24> _> Then, maybe the correct course of action for the EFF would be to work on improving the warrant system, rather than working on keeping alleged drug- dealing, unlicensed gun owners, illegal immigrants out of legal trouble?_

That's what they are doing, this is how jurisprudence works.

Hadn't they challenged the warantless spying, it would have made a precedent in court. The police could have relied on the acceptance of the evidence in this case to do it again, anywhere in the US.</comment></comment></comment></comment>


The Real Secret to Successful Networking - <AUTHOR> http://www.quicksprout.com/2009/05/17/the-real-secret-to-successful-network/ <comment><USER2> When I first started reading this I thought it was about focusing on personal relationships for mutual benefit rather than networking out of pure self interest. That's a good message!

But then it started to sound like bad dating advice from one of those creepy "Dating 101" books. Without genuine interest in making personal connections, the best you can do is temporarily trick people into thinking you care about them. Effective or not, it's sort of sad.

</comment><comment><USER3> The introduction talks about "networking whores". The last line is, _"[D]on't expect your networking to pay off within a few weeks or months, it can take years before you see a ROI"_.

When do friendships ever "pay off"? Thinking in terms of return on investment with regards to meeting people is _specifically being a networking whore_.

There are no secrets to meeting people. Just be a good person.</comment>


Until 2009, the human clitoris was an absolute mystery - <AUTHOR> http://io9.com/5876335/until-2009-the-human-clitoris-was-an-absolute-mystery <comment><USER2> Link to the original article that this is based on, which is much more informative:

[http://blog.museumofsex.com/the-internal- clitoris](http://blog.museumofsex.com/the-internal-clitoris)

</comment><comment><USER3> What is this stupid clickbait doing here? Even the article itself contradicts its own headline.

<comment><USER4> As I clicked comments on this article I felt anxious of whether I'd see some stupid derogatory comment — and there it is. The female sex organs weren't fully explored until 2009, but full acceptance of the exploration of the female body on HN is yet to come. So congratulations, you just made HackerNews feel as progressive as the locker room at the warehouse I worked at in my teens.

<comment><USER3> Whatever. The article says that they had medically imaged them in an aroused state as early as the late 90s, _which contradicts the claim of the headline_. That's all - and I explained that in my post.

I have no objection to exploration of the female body and was sufficiently interested in the subject beforehand to find the claim that this part of it 'was an absolute mystery until 2009' to be nonsensical.

<comment><USER4> "In fact, according to Ms. M, it wasn't until 2009 that researchers Odile Buisson and Pierre Foldés produced the first complete three-dimensional sonography of the stimulated clitoris, similar to the one shown here, depicted in profile."

Sensationalist wording is the hall mark of most journalism and isn't all that bad — it makes people read your stuff, and is used by a _lot_ of blog posts making their way to HN.(Hours are bullshit, Disrupting X, Why I hate Technology Y, etc.)

<comment><USER3> I saw that too, but mentioning the most recent development doesn't obviate the knowledge that came before that. IMHO sensationalism is that bad, and there's already too much of it on HN. but I don't think you should have been downvoted for expressing your opinion, so I gave you a vote despite disagreeing completely with you.

</comment></comment></comment></comment></comment><comment><USER5> It's still a mystery to me.

</comment><comment><USER6> Obvious giggles aside, this is well worth a read.</comment>


Docker + Red Hat OpenShift = The Tipping Point for Open PaaS? - <AUTHOR> http://www.themiddlewareman.org/2013/09/27/docker-red-hat-openshift-tiping-point-open-paas/ <comment><USER2> _> with Docker as a standard you will have a fully portable application that behaves exactly the same on one PaaS as it doesn't on another_

I wish this lie would go away. You have plenty of dependencies with a Docker app and it's trivial to either be missing them or have conflicting ones. Go ahead and copy some binaries from one random Linux distro three years ago to one made today and see if they work every time; not every chroot environment is backwards (or forwards) compatible.

While we're talking about "standards", can't we agree that LXC is still the simplest and most portable 'standard' for running Linux containers? Everyone wants a cool branded wrapper with an API, but LXC has the bare metal functionality that you need and costs you less container-specific maintenance.

<comment><USER3> Hi,

Evidently you don't feel the need for Docker and don't believe it's useful of needed, which is of course totally fine. I won't try to convince you since I've tried before and failed :) (if other are interested I cover some of the differences between docker and lxc here: [http://stackoverflow.com/questions/17989306/what-does- docker...](http://stackoverflow.com/questions/17989306/what-does-docker-add- to-just-plain-lxc))

However there are obviously people who disagree with you and find that Docker solves a real problem beyond what lxc can do. This seems to irritate you, to the point of "bullying" every thread about docker on hacker news. Why? Is it not a good thing that we toolmakers try new ways to solve a problem? If docker doesn't do a good job, people will stop using it, and the project will fail. It's really that simple. Why not let people make up their own minds instead of going on a crusade against a project?

<comment><USER4> It seems peterwwillis picked up on one very specific claim (that Docker is a portable standard) and called it out as false. That's exactly what we should be doing with false marketing claims, or else we end up with MongoDB all over again.

If the two of you have a history, that's fine, but I think the OP made a fair comment, and you've attacked him personally rather than replying to the seemingly-valid point he made.

I think the answer is that Docker is in fact less portable than previous standards (e.g. bare disk VM images), but is potentially a lot more efficient (now that AuFS has been dumped). Is that correct?

<comment><USER3> peterwwillis makes 3 claims: 1) docker does not allow standardized, portable deployment of applications 2) docker is a "fancy wrapper" over lxc and adds no substantial value, 3) anyone who disagrees with this is spreading "lies" and "hyperbolic marketing claims" which will cause the readers of hacker news to form an incorrect and uninformed opinion.

I addressed points 1 and 2 by linking to this thread: [http://stackoverflow.com/questions/17989306/what-does- docker...](http://stackoverflow.com/questions/17989306/what-does-docker-add- to-just-plain-lxc). It lists half a dozen ways that I believe docker is different from lxc. The first item in the list is "portable deployment across machines".

I then called him out on point 3 because I consider it unfair and harmful. First it insults the intelligence of the hacker news readers ("they eat the marketing up, but I don't!"). Second it introduces FUD as an substitute for facts. Shouting "marketing hype!" in hacker news is the equivalent of shouting "anti-american!" in Congress. How many people will come away from this thread thinking "huh I wonder if docker is marketing hype after all?" simply because peterwwillis claimed it? Talk about a marketing hyperbole.

<comment><USER4> I take it you two do have history, because I didn't really pick up on #2 and #3 from his comment. I would suggest that every time you say "docker is not just a fancy wrapper around LXC", mentally people assume that docker is probably little more than a fancy wrapper around LXC. Methinks you doth protest too much!

For #1, you've linked to a thread in which you claimed docker is more portable than LXC. I think you guys are arguing at cross-purposes here: you're saying that you're more portable because e.g. you abstract away the IP configuration (true), he is saying you're not portable because you're tied to specific kernel features (also true?).

I, for one, would like to hear more of Docker's benefits clearly explained (i.e. less shipping container metaphors, and more talk of IP configuration). I'd also like to hear more about the limitations of Docker (e.g. what kernel versions can I move containers between, on which kernel versions is it secure etc).

As for #2 and #3, those seem like non-fact-based arguments, so I'll let you and peter continue screaming at each other about who is more wrong on the Internet :-)

<comment><USER3> > _I, for one, would like to hear more of Docker 's benefits clearly explained > (i.e. less shipping container metaphors, and more talk of IP configuration). > I'd also like to hear more about the limitations of Docker (e.g. what kernel > versions can I move containers between, on which kernel versions is it > secure etc)._

Have you browsed the website at all? If you look through the Docker blog ([http://blog.docker.io](http://blog.docker.io)), the docs ([http://docs.docker.io](http://docs.docker.io)) and the user mailing list ([https://groups.google.com/forum/?fromgroups#!forum/docker- us...](https://groups.google.com/forum/?fromgroups#!forum/docker-user)) you will find plenty of resources.

For example here are a few videos of actual people explaining how they use docker and why they like it (Ebay, Cloudflare and Mailgun/Rackspace). [http://blog.docker.io/2013/08/docker-hack-day-6-lightning- ta...](http://blog.docker.io/2013/08/docker-hack-day-6-lightning- talks/#more-637)

There's also an online tutorial which lets you dive directly into a command- line simulator.

If you want to dig a little deeper you can also browse the dev mailing list ([https://groups.google.com/forum/#!forum/docker- dev](https://groups.google.com/forum/#!forum/docker-dev)) and our IRC channel: #docker on freenode.

I'm pretty sure none of these resources mention the shipping container more than once.

<comment><USER4> I'm sorry you took offense; it was intended as friendly feedback. I'm familiar with Docker. If you have actual answers, it would be much more constructive to post relevant links.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I would very much like to use Docker/containers to provision and deploy my software stacks on a beefy server I have. The ideal for me would be a whole VM in a container (nginx/uwsgi/redis/postgres/etc), but Docker can't currently do that (it only runs a single process).

Is there a practical/good way to easily do what I want, with Docker or another tool?

<comment><USER6> The process docker runs in the container can be /sbin/init, which spawns an entire OS. Its just not how its normally used.

<comment><USER7> Correct me if I'm wrong, but as far as I know Docker actually does run a binary called /sbin/init, it's just that they've replaced it in the base images with something that is more suited for fast startup times and running of a single process. Setting the Docker start command to init will probably not accomplish what you want.

<comment><USER3> That was true in earlier versions of Docker, but has been fixed. alexlarsson is correct :)

</comment></comment></comment></comment><comment><USER8> Contrary to what you might think, those of us working on [http://deis.io/](http://deis.io/) are excited by the Red Hat / Docker partnership and its implications on interoperability. Why? Because there will never be a one-size-fits-all PaaS.

Deis happens to be built around Chef with a workflow deeply inspired by Heroku. We believe strongly in that approach. Other PaaS's are working with more experimental technologies like CoreOS and etcd, others are going the Erlang route, others seem to be writing things from scratch in Go -- with all of it Docker compatible.

We think this is fantastic for the industry and for consumers (software teams) who will soon have lots of choices in open PaaS.

<comment><AUTHOR> I absolutely agree with you, Docker is where the community seems to be converging for standardisation around linux containers. This is a great first step towards application portability from physical, virtual and PaaS. Now it will be interesting to see who/what will win when it comes to the cartridge/buildpack side of things.

<comment><USER9> Is it really where the "community" are converging?

Docker is well-known because DotCloud is pushing it, so there's money for marketing and hype.

Docker is an attempt to make DotCloud relevant.

Docker will live on as an open-source project, but if it doesn't gain traction fast enough for DotCloud to sell its services or raise extra funding, DotCloud will die.

<comment><AUTHOR> I'd say this is a very negative comment because you are purely criticising without proposing where the community is actually going in your point of view. It might be more constructive to give your opinion on where containers should go if not Docker. I agree with you that this has been a pivot by dotCloud, but my hat goes off to them for it and I totally respect them as a startup for doing it!

<comment><USER10> Hopefully the community will continue moving forward by getting actual work done. These technologies are all cute, but nothing here, except the scale of marketing, is groundbreaking.

</comment></comment></comment></comment></comment><comment><USER11> What I like about Docker is that if I have a production server build based on Centos 6.4 and use Docker to install tools x, y and z, then I can easily and quickly build a VM on my desktop with Virtualbox, install the base Centos 6.4, and run the Docker builds for tools x, y, and z. At that point I have a dev environment that is as close as you can reasonably get to the production server. This means that there will be fewer integration issues in QA and fewer release issues down the road. That is what Docker buys you. Anyone who has worked with Solaris containers will argue that there is fundamentally no difference, and they would be right. In addition, you could skip Docker and just use build scripts written in bash and get the same results, and that is also true. Docker is a small incremental improvement over these earlier solutions, but what matters is not size, but that it does improve the situation. The Dockerfile is cleaner and clearer than a bash script. The registry is already built for you [https://github.com/dotcloud/docker- registry](https://github.com/dotcloud/docker-registry) and the learning curve for new people is much reduced [http://docs.docker.io/en/latest/](http://docs.docker.io/en/latest/)

These are worthwhile improvements.

</comment><comment><USER12> They're removing dependency on AuFS because it's not enterprisey enough, but if compared to Docker (which, in my personal opinion, is very immature and lacks almost everything you'd expect from the container virtualization management tool except for the basic features, although there are, indeed, some workarounds for some cases) AuFS is granddad-level mature.

<comment><USER8> Actually they're removing AuFS because it has awkward kernel dependencies and prevents Docker from running across all Linux distros. The move to device- mapper layers means Docker no longer requires a 3.8 kernel or an AuFS patch.

<comment><USER12> I haden't any problems with running AuFS on "stable" 2.6.x kernels (on Debian, Arch and Gentoo, and can't see why other general-purpose distros won't work) several years ago. I read, due to not being a part of kernel itself, it has problems with keeping up-to-date with very recent (3.10/3.12) kernels, but that's about it.

Not sure if enterprises wants to run the very bleeding edge software for sustainable mission-critical business-to-consumer yada yada.

<comment><USER13> Enterprises don't, but they often do want to run Redhat or Suse

</comment></comment></comment></comment><comment><USER14> Are all Docker images going to be required to conform to the Cartridge API, or is this another layer of standardness aimed at PaaS systems?

I have to say the Cartridge API _does_ look quite good. Has anyone had any experience with it to share?

<comment><AUTHOR> Hi Chris, I don't think that the Docker team have gotten that far yet in knowing where they are going to go, but you can imagine that in the future I blogged about that you might be able to layer OpenShift's gears on top of Docker - now that would be very cool! There is certainly some convergence going on here which is really exciting for PaaS.

</comment></comment><comment><USER15> Does this force the other major PaaS providers like Heroku to support Docker? Seems like you'd need more providers on board for true portability. Awesome news though.

<comment><AUTHOR> I really hope so, with the work that Red Hat and dotCloud are doing it will be possible for a Docker container to run on any Linux OS - which is a significant first step towards ubiquity. Whether Heroku's Buildpacks are then able to be layered on top of a Docker container is the question, not impossible as they are open source but will Heroku come on board? It seems Red Hat's OpenShift is making the moves towards this being possible with their cartridges which are the equivalent of the Heroku Buildpacks. The key bit is that the community seems to be converging around some standards that could lead to true application portability for PaaS, something we don't really have yet.

<comment><USER16> Jeff Lindsay wrote [https://github.com/progrium/dokku](https://github.com/progrium/dokku) which uses Heroku Buildpacks to build an app and then run it using Docker - it is a very neat little tool : )

<comment><AUTHOR> Very true, this would be more compelling if Heroku got behind the project themselves because their build packs would be very portable and possibly a future standard. It seems that Docker is becoming the container of choice but how apps are layered on top is still very much up for debate.

</comment></comment></comment></comment><comment><USER17> Actually myself, a combination of OpenVZ + prebuilt VMs for each of the OpenShift components needed, would be perfect.

Then I could run it on the free ProxMox, which has built in clustering for up to 16 hardware nodes.

Given how powerful today's servers are, and how much RAM they can hold, you could spend $200K on hardware(about $10K per server with 256GB RAM, plus Infiniband switches and cabling) and have an amazing PaaS setup to offer (or use for yourself).

</comment><comment><USER18> Lol. Still a lot of people who think that Red Hat derivatives are the only "enterprise-grade" server distros. Ubuntu and Debian work great.

<comment><USER19> Many enterprises will only use RHEL (tooling, support, market maturity etc), hence 'enterprise-grade'.

<comment><USER20> ...and enterprise software vendors (eg - Oracle) officially support their software running on RHEL. If you're paying 6 figures for a software license, the difference between APT and RPM fades quickly.</comment></comment></comment>


Life and death of Unicorns at Fotopedia - <AUTHOR> http://fotopedia-code.tumblr.com/post/64393785879/life-and-death-of-unicorns

<comment><USER2> Looks pretty cool. Does it work across multiple servers as well?

Signed, a former coworker (at your previous company).

</comment><comment><USER3> 400kb for an useless image just on top of everything?

[http://www.reactiongifs.us/wp- content/uploads/2013/03/neverm...](http://www.reactiongifs.us/wp- content/uploads/2013/03/nevermind_nathan_fillion.gif)</comment>


Ask HN - Chinese localization/internationalization - <AUTHOR>

I just met with our GM and we believe we can offer these services as a package for US-based startups who want to make a dent in the Chinese Market:
1. Translation of English Website to Chinese with cultural-mapping (to address cultural differences) 2. Creation (if not yet existent) of a Chinese business entity (i.e. a HK incoporated Pvt. Ltd. or an off-shore entity) 3. connecting #2 to a payment gateway (we have this) that can accept China Union Pay (CUP) credit cards (about 400 million Mainland Chinese have this credit card). Our gateway also accepts the normal Visa/MasterCard/JCB/PayPal/Amex options
and optional 4. A Chinese language and/or dialect call center.
Question: Is this bundled service something that YC startups (or even non-YC startups) would be interested in? <comment><USER2> I would recommend against "cultural mapping" and spin off into a consulting service catered to expansion into the Chinese market. The consumer psychology is so different, that the main premise of many Western products will be valueless. The listed services will just be added as necessary steps in the consulting process, and that way you can cater to the specific needs of a company.

<comment><AUTHOR> thanks for the comment. The "cultural mapping" here is two-way: explaining to the Westerners why a particular Western has to be translated (or not translated) to its equivalent Chinese idiom. This way the Western client progressively understands certain Chinese idioms. i.e. <http://knowledgeworkx.com/index/brochure_na.html>

</comment></comment><comment><USER3> I'd be interested in hearing about how your payment services stack up. My contact info is in my profile. You should include yours in yours if you expect people to make contact.

<comment><AUTHOR> thanks for your interest - my email is in my profile but here goes paulpajo [at] gmail and also paul.pajo [at] asiapay [dot] com

</comment></comment><comment><USER4> Someone do this for the Arab world. Please.

<comment><AUTHOR> I spent six months trying to find an acquiring bank in Saudi Arabia, Qatar, Bahrain, Kuwait, U.A.E., Yemen etc. but I couldn't find one. I came very close with one but it didn't pan out. If you know any Arab bank willing to be an acquiring bank we can set up in their country.

<comment><USER4> Let me see if I know someone who knows someone who can pull some strings :-(

If you have been following MENA financial news recently, there have been allot of new financial products coming out of Abu Dhabi and Qatar.

See my email in my profile and let's stay in touch.

Cheers!

<comment><AUTHOR> will do! :) expect an email from me very soon and you if you know someone who can be our acquiring bank - please get in touch - we can move very quickly if that facility can be made available ASAP :)</comment></comment></comment></comment>


What to do when a company refuses to fix a vulnerability I disclosed to them? - <AUTHOR> http://www.reddit.com/r/hacking/comments/ruf9w/what_to_do_when_a_company_refuses_to_fix_a/

<comment><USER2> There are security companies that buy these kind of information from you (like antivirus companies), so that they can patch the breaches themselves and proudly announce they discovered a breach and only by using their software you can be protected.

I don't know how legal it is, and I understand that the breach finder wants to publish his findings himself (for "reputations points" maybe ?), and he might lose this right by selling an info, but at least he's getting something out of this. IANAL, but i'm pretty sure you could get in trouble for publicly posting information on how to hack a public service (or pretty much anything for that matter)

<comment><USER3> Nobody is going to buy a rate limiting bug in some random mobile application. Actually: nobody is going to buy a rate limiting bug at all.

<comment><USER2> when I posted my comment the reddit post wasn't edited to say that it's a rate liming bug. Indeed, nobody is going to buy such a thing. Pretty useless for any kind of purposes, black-hat or not.

</comment></comment></comment><comment><USER4> If only the company is put in danger and they stubbornly refuse to resolve the issue, I'm not exactly sure why anyone would work so hard to convince a company to do this. The job of reporting the issue is done, a corporate decision has been made. If that decision is to remain vulnerable, as long as it does not affect users directly, why bother?

Unless, as others suggested, you can legally make a profit out of it, then by all means! Otherwise, just let it go...

<comment><USER5> It appears he wants to publish the vulnerability (might be a novice security researcher) without getting sued.

<comment><USER3> He is very, very unlikely to be sued provided that (i) he didn't explicitly agree to a contract forbidding security research when he acquired the application, (ii) he acquired the application lawfully, (iii) he at no point solicited business from the vendor of the application, (iv) he didn't exploit the vulnerability in any way that could be construed as having caused direct damages to the vendor, and (v) he is scrupulously honest and careful about how he writes the finding up.

Contrary to popular opinion on HN, finding vulnerabilities in software _you yourself run_ on _your own computer_ is rarely fraught. We hear about the exceptions in the news because they're exceptional. In reality, people publish vulnerabilities all the time.

The same thing obviously CANNOT BE SAID about finding vulnerabilities in other people's web applications. Finding web vulnerabilities without permission is _highly_ fraught. You can easily find yourself both civilly _and criminally_ liable for doing so.

<comment><USER6> I would adjust "other people's web applications" to be "in other people's deployments."

For example, it is fine to take someone else's commercial web app, install it on your own server, and beat it up.

<comment><USER3> That is a good point, thanks for amending.

</comment></comment></comment></comment></comment><comment><USER7> From an ignorance and slightly tongue in cheek POV...

...is there a difference between discovering a new exploit and discovering a company is open to an old or well known exploit? This sounds like the latter.

I'm all for disclosure of a newly found exploit because by doing so you are informing every one who might have the problem and that allows them to take action, etc. But if this is just one business who refuse to fix a known problem then, well, that's their stupidity, no?

See, the bit that bothers me is that publishing the "news" that one company is vulnerable has to be a bit iffy. Its like publishing a list of buildings that don't have good door locks or something. We don't see that in the real world, so why would it be reasonable for the IT world? I mean, there is no legitimate list of vulnerable buildings created by white hat burglars, is there? Its never been legit for such burglars to gain access to a building and leave a note describing the poor security on the CEO's desk.

<comment><USER8>
      Its never been legit for such burglars to gain access to a building and leave a note describing the poor security on the CEO's desk.

Unless, of course, you happen to be Richard Feynman. Which most of us aren't.

[http://www.silvertrading.net/articles_lagniappe_01_richard_f...](http://www.silvertrading.net/articles_lagniappe_01_richard_feynman.html)

<comment><USER9> I've had "Surely You're Joking" on my Kindle for almost a year now and have never read it, but every time I see anything written about Feynman I realize that I'm almost certainly missing out. He sounds like the most interesting man.

<comment><USER10> You are missing out on a readable book divided into short chapters. It's basically all anecdotes. Easy to intersperse with your other reading.

</comment></comment></comment></comment><comment><USER11> I don't know how big the company is, but after a certain bigness, all of the people who could fix problems like this have moved on. The only people left are managers who fix "problems" with lawyers. A classic "when all you've got's a hammer" situation.

They might not be refusing to fix the problem. They might actually be unable with the tech talent they've got left.

My advice? Don't look like a nail.

</comment><comment><USER12> If you contacted them non-anonymously first, you made a mistake, because they can and will sue you if you disclose it. Judges don't understand computers and US courts are all about draining money from someone, so they still might ruin you out of spite even if you disclose it in a way that there's no proof it was you or if someone else who discovered and released it on his own.

The correct way would be: 1) discover a vulnerability 2) contact them anonymously 3) if they don't fix it, anonymuosly release it to general public

That way, you can still help them while protecting yourself. The third step is optional of course.

</comment><comment><USER13> You almost sound like you're laying down an ultimatum to the company, you've done your job by notifying them so let sleeping giants rest. If it's a known exploit I don't see any reason to publish your findings, if it's something you've come across that hasn't been published than by all means publish away.

</comment><comment><USER14> The linked post is talking about a DoS vulnerability of the service. It doesn't impact other entities than the service provider (beyond the obvious potential for service outage of its users). I think telling them about it is all that's required. Either they fix it or they don't, that's between them and their users.

</comment><comment><USER15> Public disclosure won't help btw. half of sites here didn't fix anything([http://homakov.blogspot.com/2012/03/hacking-skrillformer- mon...](http://homakov.blogspot.com/2012/03/hacking-skrillformer- moneybookers.html))

<comment><USER3> Did you reach out to each company and tell them, or did you assume that by creating a public blog post about them and submitting it to Hacker News they were bound to find out?

<comment><USER16> Did you read his blog post and see that he did report the vulnerabilities and noted which companies fixed it?

<comment><USER3> I read the comment he wrote on HN where he said he didn't. But if Egor Homakov says he did, my next question is "who did he report it to?"

I've been doing this for awhile, maybe there's useful advice I can offer him.

</comment></comment></comment></comment><comment><USER17> I'm curious what we could change legally to make this less an issue. There's a clear conflict of interest between doing a public good by disclosing a vulnerability and not wanting to risk (at worst) the FBI coming after you or (at best) losing clients. I would certainly consider it unethical to know of a vulnerability and not disclose that information publicly, but there are so many hurdles to doing so that I don't blame some people (especially those who are less established) for not doing so.

It almost makes me feel that there should be a law _requiring_ disclosure of vulnerabilities.

<comment><USER3> The FBI is not going to come after you for publishing a DOS vulnerability in a mobile app; in fact, you could find and publish remote code execution in an extremely popular application (say Instagram or Twitter) without even telling the vendor and still not be in any trouble. People do it all the time.

Most of the stories you hear about people getting in actual trouble over vulnerability research involve web vulnerabilities. You cannot hack someone else's web site to make a point, even if the underlying point is unimpeachable ("this application is insecure and people should know about it").

</comment></comment><comment><USER18> He could just leave them alone and do nothing. It's their service and if they don't want to respond then let them leave the vulnerability open. It doesn't affect user privacy so there is no duty to fellow users as there is in some other cases where a vulnerability being left open means people could be losing private information on an ongoing basis.

</comment><comment><USER19> Pastebin, then on a disclosure list.

</comment><comment><USER20> Seems pretty straightforward to me -- since it's a DoS that doesn't put users' information at risk, just publish it without naming the company.

<comment><USER21> That's the first sensible and ethical suggestion in this thread.

</comment></comment><comment><USER22> Couldn't this vulnerability simply be published without mentioning who is directly affected? E.g. "under x and y circumstances, it is possible to do z and everyone is advised to check and correct this".

If this is not an option it means it is something very specific of that company, and what would be the purpose on releasing the vulnerability to the public?

</comment><comment><USER23> You should contact them. If that fails, make a commit to the Rails project.

</comment><comment><USER24> There should be a scientific journal for this sort of thing.

</comment><comment><USER25> Take your business elsewhere is step 1. Your information/service is not guaranteed if they aren't willing to protect it.

</comment><comment><USER26> Everything takes time and money. It may get fixed, eventually. What does 'refusal' amount to?

</comment><comment><USER27> Move on, work on something new.

I recommend two shots of wheatgrass and a smoothie.

</comment><comment><USER28> I'm sure Randal Schwartz can offer some advice on this.

</comment><comment><USER6> Name and shame.

</comment><comment><USER29> If you really want them to fix it, whatever you decide, be anon about it. If you want your name attached to it, move on.

</comment><comment><USER15> Use It.

<comment><USER30> Illegal. And juvenile.

<comment><USER31> Illegal maybe. Juvenile? If illegally making use of hacks is juvenile, someone better inform the Mexican Zetas. Very politely.

</comment></comment></comment><comment><USER32> I think you're supposed to exploit the vulnerability in relatively innocuous but deeply disturbing ways, get banned, then complain about how you only meant well, then be lauded on Hacker News as a martyr who should have been embraced by the hacked company.

<comment><USER33> Or rather you contact them. Then they ban you and possibly send the FBI after you for "illegally accessing a remote computer system" or other such crime and then you are punished for all your work. If you tell them you will disclose your research on a certain date they'll go after you for extortion.

I wrote this before and I'll say it again. I don't believe in "White Hacker" as a label. Corporations do not do well when their vulnerabilities are exposed. They don't have a way to handle "White Hackers" unless they are the ones hiring them. Most will strike back and punch you in the face no matter how good your intentions are. So if you already spent the time researching and finding the vulnerability, just disclose on a security forum or if you want to profit, sell on a black market.

<comment><USER34> I believe you mean "White Hat Hacker"... I think everyone gets the gist of what you mean but just wanted to clarify in case someone's thinking you're a racist hating on "Whitie" or something :)

<comment><USER35> Are there really people in this community who don't know this?

<comment><USER36> I've heard the phrase "white hat" used frequently to describe hackers. I've never heard the phrase "white hacker".

      About 526,000 results
      http://www.google.com/#hl=en&q=%22white+hat%22+hacker

      About 65,000 results
      http://www.google.com/search?hl=en&q=%22white%20hacker%22

<comment><USER35> You know what? I totally mentally replaced the word "white hacker" with "white hat", and only realized it after you pointed it out.

</comment></comment></comment></comment></comment></comment><comment><USER37> Nothing. If they're unwilling to fix it, they'll end up facing the consequences when someone less scrupulous than yourself discovers it. If you do publish it, odds are they'll issue a DMCA takedown and try to sue.

Speaking from experience...

<comment><USER38> _If you do publish it, odds are they'll issue a DMCA takedown and try to sue._

My experience is quite to the contrary. Even Intel, as poor as their security response was, didn't try to take legal action against me. (I was lucky that I was unemployed at the time, though...)

<comment><USER33> > didn't try to take legal action against me

But that is an interesting attitude. Instead of being indignant that they didn't offer to pay you for doing their security research for them ( or at least publicly thanking you) you just seem glad that they didn't sue you.

It is like volunteering to help someone and then just being glad they didn't beat you up in the end.

So it seems like there is not much benefit to doing this (there is a benefit if you prevent other people information from being stolen) but immediately there is no upside. You either get ignored or you get sued. If anyone gets sued by a company who has a full department of lawyers on retainer, it is guaranteed they'll pretty much have a bad time.

<comment><USER38> _It is like volunteering to help someone and then just being glad they didn't beat you up in the end._

I didn't publish the hyperthreading vulnerability to help Intel. I published it to help Intel's customers.

</comment></comment></comment></comment><comment><USER39> do nothing, it's none of your business, why bother?</comment>


A Spreadsheet That Could Solve NYC Transit - <AUTHOR> https://motherboard.vice.com/en_us/article/8x53xb/meet-the-spreadsheet-that-can-solve-nyc-transit-and-the-man-who-made-it <comment><USER2> As the article discusses at the end: the MTA is a black hole of money, it's overly optimistic to assume cash generated from congestion pricing would go back into public transit (e.g.: the NYT recently reported how Gov. Cuomo directed the MTA to hand over millions to ski resorts in upstate NY because there hadn't been a lot of snow that year).

By comparison London implemented a $15 congestion fee in 2003 and it resulted in a 26% reduction in traffic, which is good but likely not life-changing for most commuters.

So if you cynically assume you won't get free transit and congestion pricing is not a panacea for rush hour gridlock, what do you get implementing this?

Less CO2 emissions. Fewer pedestrian accidents. But mostly: more money for the city. Aka a tax.

Once you accept that, the discussion boils down to your belief in what constitutes a fair taxation scheme: should the users of a service pay per use, or should essential city services be subsidized by the wealthiest citizens? Good arguments for and against.

While I'm in favor of congestion pricing in general I think it's important to not be overly optimistic in our assumptions in what it can accomplish.

Very cool spreadsheet though.

<comment><USER3> > Once you accept that, the discussion boils down to your belief in what > constitutes a fair taxation scheme: should the users of a service pay per > use, or should essential city services be subsidized by the wealthiest > citizens? Good arguments for and against.

Very tangentially related but wanted to hear your opinion on this: I know it is not in my best interest as a poor person but I think there should not be any handouts or subsidies for poor people. We should transform any entitlement program that requires you to show you make $X or under a year and replace them with programs that everyone (regardless of income or wealth) can participate in. I am still a firm believer in a progressive tax regime to fund these programs but we should not divide beneficiaries based on income or wealth.

Another thought experiment I sometimes think about is what would change if public transit were fully paid for by taxes? How would things change? Would we see more traffic? How much more traffic would we see? Would we see more people camping out inside the subway stations?

<comment><USER2> Depends on your definition of "handouts". Free cash transfers don't seem to be a successful antipoverty program but what about free college tuition? High education levels strongly correlate with above average lifetime incomes but you can't expect poor mothers to feed their children on college degrees. I guarantee you even the most ardent proponent of regressive taxation schemes has some pet govt benefit they consider not a handout but a right.

As to the second, it's an interesting idea. Everyone complains about the NYC MTA but for $2.75 you can traverse the entire city -- even with delays it's a steal. People are definitely disconnected from the price vs reward of public transit.

<comment><USER3> > what about free college tuition

I love it! However, if we can afford to make college tuition to people making under $x, I think we can make college tuition free for everyone without checking for their income. (This is my main objection to the New York state scheme. They can make it so only NYS residents are eligible but we should drop the income requirement.)

</comment></comment></comment></comment><comment><USER4> I've sad it once and I'll say it again: we need to stop subsidizing cars and drivers as a matter of public policy. In places like NYC we need to go further and punitively tax the ownership and operation of private cars.

Every time this issue comes up, someone will pipe up that gas taxes pay for the roads. Bzzzzt, wrong [1].

Want to see how far this could (and IMHO should) go? Take a look at Singapore [2].

While we're at it, let's:

\- eliminate street parking on the avenues and other major roads (eg 14th, 23rd, 34th, 42nd, 57th, 59th, etc streets) in Manhattan;

\- eliminate half the street parking in the other streets

\- stop using the remaining parking as long-term parking. Want long-term parking in Manhattan? Put it in a garage.

As for Cuomo, he's a disaster for NYC. Then again, probably every NY Governor is and will be because they're beholden to all the upstate voters who live in SFHs, which also explains why apartment dwellers are taxed punitively by the state (except if you're a billionaire) [3] [4].

Another point worth considering is this: why do we charge anything for using the subway? It unfairly hurts low-income workers. This should be completely covered by NYC income taxes and taxes on car ownership in Manhattan in particular.

[1] [https://www.theatlantic.com/business/archive/2015/10/driving...](https://www.theatlantic.com/business/archive/2015/10/driving- true-costs/412237/?utm_source=atlfb)

[2] [https://www.lta.gov.sg/content/ltaweb/en/roads-and- motoring/...](https://www.lta.gov.sg/content/ltaweb/en/roads-and- motoring/owning-a-vehicle/costs-of-owning-a-vehicle/tax-structure-for- cars.html)

[3] [http://www.crainsnewyork.com/article/20170519/BLOGS01/170519...](http://www.crainsnewyork.com/article/20170519/BLOGS01/170519866/numbers- reveal-how-bad-nycs-property-taxes-are)

[4] [https://citylimits.org/2015/06/10/why-effort-to-reform- nyc-p...](https://citylimits.org/2015/06/10/why-effort-to-reform-nyc-property- taxes-has-stalled/)

<comment><USER5> > Another point worth considering is this: why do we charge anything for using > the subway? It unfairly hurts low-income workers.

i don't disagree with your larger point about the benefits of incentivising alternative forms of transportation, but im not sure i can agree that it is "unfair" to charge low income workers literally any amount of money to ride the subway. when you look at the operating expenses vs. fare revenue for the subway, its already subsidized by the city and state at something like 50%. the fact that you can ride on the subway for the current price already represents a substantial transfer from wealthier citizens who pay more taxes.

i think there is certainly room for debate as to what exactly the price should be, and there may be other compelling reasons why it benefits everyone to make it free; i just find it absurd to argue that making such an expensive service anything other than free is unfair.

</comment></comment><comment><USER6> [https://nurturenature.org/pages/balanced-transportation- anal...](https://nurturenature.org/pages/balanced-transportation-analyzer)

is the spreadsheet itself. Interesting is that it justifies most of the savings by saving drivers time.

I'm a little dubious that's valid, most notably because the costs of mass transit projects tend to occur early ($14 billion of the second avenue subway and east side access in NYC), while the benefits manifest later, if at all.

<comment><USER7> I'm guessing that this spreadsheet is rife with false accuracy. Modeling and forecasting markets is incredibly difficult. The reason he can get away with it is nothing will ever happen that can prove it wrong.

</comment></comment><comment><USER8> Not to denigrate what is clearly a labor of love and noble intentions (this is, of course, the necessary preamble for a comment in which I'm going to denigrate what is clearly a labor of &c.) -- but the idea of a complex 72-worksheet Excel file put together by someone who has never heard of source control ("Komanoff has more than 2,000 versions saved on a hard drive") is making my left eyelid twitch uncontrollably. I wonder what the unit testing situation is, here...

<comment><USER9> Also what the sensitivity of the final result is to each of the variables... seems like they are using a lot of assumed or estimated values for the variables.

</comment></comment><comment><USER10> I'm 100% in support of less car traffic in NYC but I think there has to be other reliable options in place before that change is made. Many people are using cars and ride-hailing apps as a remedy to the broken public transportation system. If I was working downtown and had a meeting in the middle of the day uptown on the East Side, taking the train would risk missing the meeting. Taking a car meant I had to leave earlier and pay a lot more money, but also meant I could be sure of actually getting there roughly on time. At least in my circles, the preference is public transportation and cars are used for the times when you're waiting 45 minutes or an hour for a train that never comes, watching the arrival timer continually count down to 0 and reset to 12 minutes.

<comment><USER11> wait, who does that? If you have to go somewhere, and don't want to take the subway, you usually get a cab. I am assuming normal yellow cabs will not be affected by this charge.

I live in Manhattan, and the people that I know that own a car and live here, they fall in the categories:

1\. Work outside/far in the burbs, and need the car to go to work.

2\. Are rich, and their car is there for the weekends...

3\. Have a "commercial license", and can park at places where most normal folks can't.

In some areas you can find parking during the day, but in most places where there are businesses (most of downtown, and midtown), it is impossible finding a parking place unless you are paying a lot of money.

Much cheaper and less hassle to get a cab

<comment><USER12> I think everyone (I guess other than emergency services?) should pay the congestion charge and the money should never go back to the general treasury and be directly earmarked for subways and buses only.

</comment></comment></comment><comment><USER13> Seems like this begs to have a simplified web interface, where people can adjust some of the top-level parameters, and see the results.

Maybe write a tool that reads (a snapshot of) the .xls file, and knows which cells are interesting inputs and outputs, to instrument and monitor. But then you need to "eval" all the formulas... seems tricky. Is there an easier way?

Maybe just automate tweaks to a small set of input parameters -- limiting the number of permutations -- and collect the outputs of interest. Then make a simple visualizer of that data. Perhaps even just visualize 5 primary scenarios.

<comment><USER8> From the article:

> At one point, I asked Komanoff is he'd ever considered converting the BTA > into some kind of web app to make it accessible to more people. He expressed > interest in the idea, but worried he wouldn't be able to modify the model as > easily. Moreover, he values the spreadsheet's transparency and flexibility, > which would be lost in a basic web platform. Of course, a gigantic > spreadsheet with 72 worksheets and hundreds of thousands of cells has its > own issues of opaqueness.

I agree with you, though; I don't know how you'd even begin to tease this thing apart for bugtesting.

</comment></comment><comment><USER14> How many formula errors does it contain?</comment>


US to label nuclear waste as less dangerous to quicken cleanup - <AUTHOR> https://www.theguardian.com/world/2019/jun/05/us-to-label-nuclear-waste-as-less-dangerous-to-quicken-cleanup <comment><USER2> > The old definition of high-level waste was based on how the materials were > produced, while the new definition will be based on their radioactive > characteristics – the standard used in most countries, the energy department > said.

So they moved to a more accurate labeling system with regards to the actual danger posed by the waste, so it can be disposed of more appropriately? How is this a story?

<comment><USER3> Is news supposed to be bad?

<comment><USER4> Well the title of article makes it sound like a dangerous change. Really, sounds like fear mongering around nuclear with such a title.

What if the article was titled "US to use Global standard for quantifying nuclear waste"

Like news does not need to be bad, but when you have a title like this article what does it imply.

</comment></comment></comment><comment><USER5> _The old definition of high-level waste was based on how the materials were produced, while the new definition will be based on their radioactive characteristics – the standard used in most countries, the energy department said.

The old definition said high-level radioactive waste resulted from a military production stream, Dabbar said. That meant, for instance, that all the waste from plutonium production at Hanford was classified as high level.

It was a "one-size-fits-all approach that has led to decades of delay, cost billions of dollars, and left the waste trapped in DOE facilities in the states of South Carolina, Washington and Idaho without a permanent disposal solution", the agency said._

So essentially this is low level waste that was classified as high level because it was made for military purposes.</comment>


Monthly revenue breakdown of PlentyOfFish's early days - <AUTHOR> http://plentyoffish.wordpress.com/2014/05/12/adsense-breakdown/ <comment><USER2> Welcome to HN, Markus. Please consider sticking around -- many folks here could learn a lot from you. (We have very different businesses but I've been quietly Internet-stalking a lot of your work for years.)

<comment><USER3> Seconded. (And Patio11, I've been stalking you...)

Another highlight, showing how POF early on was all about surprising and obvious innovations (presumably at the expense of polish, as noted elsewhere in the thread). If you're bootstrapping, polish is not your friend. Risky innovations are.

[http://plentyoffish.wordpress.com/2013/02/12/10-years- since-...](http://plentyoffish.wordpress.com/2013/02/12/10-years-since-pof- blew-up/)

I particularly love that the blog is still using the default Wordpress theme from years ago. :)

<comment><USER4> The motion carries. Markus will spend more time on HN :)

Marcus, you shared a great talk a few months ago at Launch Academy and it really helped me get through a difficult period in starting my company, thank you. I had just bootstrapped my company for 20 months (read: hadn't had a paycheque in 20 months), now we're month 24 and things are rolling quite nicely (read: paid myself in April!!!!).

<comment><USER5> Being in your same bootstrapped situation for 18months... I'm curious about what's your company about/name.

</comment></comment></comment></comment><comment><USER6> This is the type of stuff us HN folks need to focus on.. POF is your classic "started in the garage" success story. No fancy trendy offices, no upfront VC investments, no trendy website with no product etc. This is true entrepreneurship.

POF is the Google of dating sites, it came in to fill a need already being filled by "big money" and simply did it better, and gave it away free with revenue from advertising.

Personally I love seeing something like that work.

<comment><USER7> I agree with everything you said except I would love to see more success stories that aren't based on the ad revenue business model.

So many great new ideas come out, and then they slap ads on them to make money. It'd be nice to see some other experiments on how to extract cash from a business.

<comment><USER8> [EDIT: Two immediate downvotes and neither has the courage to explain why. Wow. Is the inconvenient truth hitting to close to home?]

Relying on ad revenue is a moral failing.

 _Advertising has us chasing cars and clothes, working jobs we hate so we can buy shit we don't need._ – Tyler Durden, Fight Club

Anyone who is truly honest with themselves will admit that 90 to 99% of ads deceive and manipulate people into consuming a product[1]. The rationalization that allowing ads allows you to give your product free to users is a self- serving shame-allaying delusion[2].

[1] Even an ad that tells no outright lie is lying if it is selectively tells a partial truth. The moral test is whether you sell that product with the same pitch to a friend who does not have money to blow. Would you leave out the cons of your product and the pros of a competing one? Would you use psychological tricks to convince your friend she needs it, even though in honesty you know she doesn't?

[2] [https://news.ycombinator.com/item?id=7485773](https://news.ycombinator.com/item?id=7485773)

<comment><USER2> _Anyone who is truly honest with themselves will admit that 90 to 99% of ads deceive and manipulate people into consuming a product_

My most effective ad incoming, prepare for the perfidy.

      Make Bingo Cards Quickly
      Create word bingo to fit any theme.
      Try now, no download required!
      www.BingoCardCreator.com

It is for a SaaS application which makes word bingo cards.

Can you suggest how the ad is deceptive and/or manipulative? If it helps, I'll supply context: it is almost guaranteed to show on pages which talk about making bingo games in an elementary school (or similar) setting.

I spent about $8k last year showing this to ~4 million teachers, homemakers, event planners, and other people interested in topics like Halloween bingo. (A particular thing that it does.) This resulted roughly 80,000 of them visiting a landing page which offered them free bingo cards for their email address. Roughly 20,000 of them took me up on that. Somewhere around 500 of those 20k decided they liked their free bingo cards so much they wanted to pay for the product which I sell.

I have a pretty good idea of where that $8k ended up. Approximately $3k of it subsidizes operations at Google, a company which you may have heard of. The other $5k subsidizes content creation at a few thousand sites across the Internet. Some of them are honestly not net value providers. Many of them are.

One of my most successful ad placements, for example, is on a hobbyist site created by a teacher and her husband. It offers many free printable activities and is ad supported. It's been lovingly maintained since the late 90s or so. My rough approximation of their annual ad revenue is "it would make for a pretty nice teacher's pension in any state."

It is very not obvious for me that anyone would be better off if that team decided to take down their site to avoid the moral impurity of advertising. Their users would lose access to many useful, free printable activities. I'd lose access to a large group of great prospects for my product. Many teachers would fail at their goal of playing classroom bingo with their students tomorrow. Their kids would be sad.

<comment><USER8> You don't negate my point because:

\- I did not say 100% of ads are lies

\- You don't prove that you could have done better through product reviews and word of mouth (which is now web-scale via social media), especially in a world where you didn't have to compete with other products that make false claims through advertising.

\- You didn't refute my claim (via the footnote link) that if people paid up front for Google, the other content creation sites you mention, as well as the hobbyist site, that it would actually be cheaper for everyone, both on a monetary and social cost-basis.

And wow, over 50% of the cost of your product went to advertising! In a world where people discover things via web-scale word-of-mouth (e.g. social networks, product review sites, recommendations from field- or topic-specific authoritative websites), your product would be 50% cheaper, and even cheaper than that considering people would not waste money buying products due to dishonest ads.

Yes, we are in a sort of catch-22. Because people are so used to getting their web for free (even though as I point out that is an illusion), a huge majority of us would have to boycott ads to change the system to where non-ad-supported business models could thrive. But those of us who dare to do it first, before that critical mass is achieved, are likely not to survive.

But a seemingly insurmountable catch-22 doesn't mean it isn't messed up and not worthy of critique. Remember, history is replete with such situations. When we all lived under totalitarianism, a small number of people could rule over a vast majority only because to unite people into a rebellion, you have to speak up, but if you speak up, you're head gets cut off.

Change is hard.

<comment><USER9> He doesn't negate your points because there were none to negate. Well, except for that clearly accurate "90-99%" figure you quoted. Your personal crusade is not a rebellion, and no one is trying to cut off "you're" head.

Sure, we all agree that deceptive advertising is deceptive. That's wrong, but not all advertising is bad. I think you'll be surprised to find out that 95% of people (yay, making up numbers is fun!) actually don't mind that google tracks their activity so they can show more relevant ads. I typically don't click on them, but hey, more relevant ads still makes my overall experience better and I really don't care if we get there because some of my search history was (relatively anonymously) logged on some of google's servers.

Also yes, word of mouth leads a lot of people to discover new products, and may be cheaper than traditional advertising in dollar amounts, but it's likely a much greater time investment that may not even pay off in the end. Likewise, patio11 could pay the hobbyist site, and google, and any other "legitimate" advertising platform directly but I think the time commitment to find those valuable platforms, enter into an agreement with them, and deal with all the associated details may not be worth it for him.

In the end, it's about finding a cost-effective way to get your products in front of its audience. That may be "word of mouth" (and I don't want to get into that debate, but product review sites tend to be more misleading, biased and corrupt than a lot of ads), or it may be ads. To each his own, but you don't need to condemn everyone who doesn't share your overly idealistic views.

</comment></comment></comment></comment></comment></comment><comment><USER10> I believe it's against the Adsense ToS to share any data except gross earnings. However, I find these data very interesting and am personally glad you shared them.

Quote:

9\. Confidentiality

You agree not to disclose Google Confidential Information without our prior written consent. "Google Confidential Information" includes: (a) all Google software, technology and documentation relating to the Services; (b) click- through rates or other statistics relating to Property performance as pertaining to the Services; (c) the existence of, and information about, beta features in a Service; and (d) any other information made available by Google that is marked confidential or would normally be considered confidential under the circumstances in which it is presented. Google Confidential Information does not include information that you already knew prior to your use of the Services, that becomes public through no fault of yours, that was independently developed by you, or that was lawfully given to you by a third party. Notwithstanding this Section 9, you may accurately disclose the amount of Google's gross payments resulting from your use of the Services.

[https://www.google.com/adsense/localized- terms](https://www.google.com/adsense/localized-terms)

<comment><USER11> What they will do? Ban his account? #1 PoF dont use Adsense anymore. #2 This was 8 years ago - I believe any legal action couldn't be taken for such a long ago by Google as their policy changed dozens of times and this will bring more advertising for them rather than damage their business.

<comment><USER10> I didn't realize PoF doesn't use Adsense any more, but I was more interested in letting HN users know in case they were inspired to share the same kind of data and risking having their accounts suspended.

</comment></comment></comment><comment><USER12> I saw 'plentyoffish.com' on the Lady Gaga video 'Telephone'. I just Googled that product placement and, allegedly, site visitors went up 15% as a result of that incidental appearance in that particular video:

[http://adage.com/article/madisonvine-news/miracle-whip- plent...](http://adage.com/article/madisonvine-news/miracle-whip-plenty-fish- tap-lady-gaga-s-telephone/142794/)

If that is a true statistic then, regardless of what was paid to get that product placement, the return is quite phenomenal compared to the click through rates of online advertising.

If Markus is listening, it would be good to know more details on how that success came about and worked out.

Also, cheeky joke question, for all that effort put into a dating site and with all that money made, did you get any good dates out of it?

<comment><USER13> I wanted to ask exactly this question (I'd typed it out and everything!) so thank you for finding that info!

</comment></comment><comment><USER14> Plenty Of Fish is one of those things where they caught lighting in a bottle and kept it there for a decade. It would be easy enough to get a site to millions of pageviews and let it die on the vine. It would also be easy to hire too many people and feature creep yourself into irrelevance.

It takes a great combination of luck and skill to take the early success and sustain it.

</comment><comment><USER15> From a technical level POF is not that great. From a UI perspective it's pretty good. From a aesthetic design perspective it's up there with Craigslist. Working at POF is like working at McDonalds. It's temporary. Pay is anemic for even the people who control the site, so they'll bounce once something better comes along.

In terms of running a company, I would prefer a style more like the guy who started MineCraft. Ie. Million dollar bonuses, really creating a corporate culture! Making employees live their dreams.

<comment><USER16> > Working at POF is like working at McDonalds. It's temporary. Pay is anemic > for even the people who control the site, so they'll bounce once something > better comes along.

I don't think that's necessarily correct. I know people who have been working there for quite some time and enjoy it.

</comment></comment><comment><USER17> Doesn't seem like anyone has actually used POF here so I'll put it out there—it's the trashiest, most annoying dating site I've used.

<comment><USER18> I've used it and had plenty of good experiences. I went on about have a dozen dates and ended up making some good female friends. There really is a wide range of people on there. (disclaimer: I'm a male)

</comment></comment><comment><USER19> Ugly, quick, potentially false graphs: [http://i.imgur.com/T5czvPO.png](http://i.imgur.com/T5czvPO.png)

</comment><comment><USER20> Hard to argue with such numbers... However I just created a test profile and the experience is less than stellar (many items in the French site appear in English, and I just received an email with the following title: "&&recievername%% résultats du test POF", etc.)

Obviously, users don't care for those kinds of details; what we'd like to know is: what do users actually care about? (in general, and specifically for a dating site)

<comment><USER21> These sites work on network effect, pretty similar to social networks, I guess. It helps to get a reasonable product quickly out there that does not compromise too much on the user experience and privacy.

In India there is a job site called naukri.com that has horrible user experience, but is still the number one job site. But it works and does the bare minimum without much issues. It would be tough for anyone to crack that market without non-trivial capital.

</comment></comment><comment><USER22> This might be a dumb question. How did you go from less than 500 page views to more than 180,000 page views in a month? That's the real secret here...

<comment><USER23> I've seen this question asked before and Markus was kind of coy about answering.

I had a feeling there was some sort of spammy element to it. Maybe something involving link stuffing or comment spamming.

Whatever it is, he doesn't seem too keen on revealing it.

</comment></comment><comment><USER24> I'd be quite curious how the AdSense revenue has dropped off since 2006, as the platform has evolved a lot since then, not to mention people have had a long time to get used text-based contextual advertising.

<comment><USER25> For a gaming site we run CPC is not close CA$0.5, more like CA$0.08. I'm also curious as to how this has developed for Plenty of Fish since 2006.

<comment><USER26> From my earlier reading on this site, essentially the other dating sites bid up ads quite highly, presumably because the lifetime value of a dating customer is quite high for a paid site.

It was a lesson I'll always remember - if you're going to build an ad-revenue- based site, then do so in a field where there are major players throwing around big money on adsense or similar. You get to effectively monetize their users by providing an advertising channel.

<comment><USER27> > if you're going to build an ad-revenue-based site, then do so in a field > where there are major players throwing around big money on adsense or > similar

It is not field based. Every company has their own bidding budget. Take any field, you will be able to find clients who are ready to pay higher CPC than avg because they have money

<comment><USER26> Not really. The same person as a customer will have different lifetime value to a company in different industries. That is dependant on the stickiness of the product, the sticker price, and the nature of the product.

Credit Cards and Insurance will always have higher CPC than florists. That's inherent, and that's what I mean by choosing the field carefully.

</comment></comment></comment></comment></comment><comment><USER28> Just checked out PlentyOfFish.com The UI has a distinct 90's feel to it. If you check out okCupid, it looks more up to date. May be this is the craigslist of dating sites.

<comment><USER29> ux != ui

<comment><USER30> There is a lot of wisdom in your comment!

</comment></comment></comment><comment><USER31> I remember spending a couple of years working on duplicating his success. Though I had fun it was ultimately a failure, and it seems obvious now just how much PoF's success was a combination of Markus's own talent and being a first mover.

</comment><comment><USER32> So, based on these numbers...he's doing ~$25M/mo today? I know he runs his own ad system now, but presumably he would be doing as well as he was doing with Adsense or better (or he would go back to Adsense).

<comment><USER33> Probably not--the eCPMs you could get on AdSense in 2006 are way higher than today.

This is true of all ad networks in general--the amount of available inventory has exploded in recent years, reducing prices.

</comment></comment><comment><USER34> Thanks Markus! It's great for the community to have data like this to learn from. I've tabulated the image for anyone interested in looking at it as a spreadsheet, which can be found here: [https://docs.google.com/spreadsheets/d/17yKe82aozcBegNs2YfPU...](https://docs.google.com/spreadsheets/d/17yKe82aozcBegNs2YfPUm9iQvy10kqMZ0fRNpOSaheU/edit?usp=sharing)

If you'd prefer that this not be made public please let me know.

</comment><comment><USER35> What was the biggest thing you did to grow big so fast?

<comment><USER36> He knocked over one bowling pin to start: he conquered the Canadian dating market, started locally and moved across the border.

That can't be replicated again in the dating market, it's hyper saturated now, but that concept holds true for most any market and for most any product or service: you have to conquer that first market.

<comment><USER37> You know, I was thinking that too... but then again, the crazy rise of Tinder really surprises me. They're conquering mobile.

<comment><USER38> Mobile shook things up. Zoosk got in early, and they're consistently among the top grossing apps. Tinder's taking off too.

</comment></comment></comment></comment><comment><USER39> I got on their extremely raunchy, six-email-a-day mailing list without my consent and couldn't get off. Fuck them.

</comment><comment><USER40> I could fall in love with that screenshot :-).

Is the revenue in relation to visitors still as big today?

<comment><USER41> I would say significantly more since he is running his own ad system.

<comment><USER42> Click rate could be down.

</comment></comment></comment><comment><USER37> "How I made a million in 3 months" by markus007 - [http://www.webmasterworld.com/forum89/13958.htm](http://www.webmasterworld.com/forum89/13958.htm)

</comment><comment><USER43> So it appears that if you can build something that gets 2 million page views, you can probably live off of just ad revenues from AdSense.

The rough cost of click seems to be fluctuating around 0.25-0.50c but gets stabilized to almost a dollar later. I guess people usually don't think about the fact that when you click on a ad, you just made someone pay a dollar to someone :).

</comment><comment><USER44> What happened between Jun and Jul 2003?

<comment><USER45> I'm wondering this too. It looks like within the span of twelve days he went from a handful of page views to almost two hundred thousand.

<comment><AUTHOR> its when I first added adsense, the start started getting real traffic back in March of that year.

<comment><USER46> >When you paid spamnets to bombard your url to millions of inboxes?

</comment></comment></comment></comment><comment><USER47> My question would be how you went from 500 pageviews to ~180K in a month at the beginning?

</comment><comment><USER48> I went through a few pages of the blog, and I didn't see anything on the hosting/hardware makeup of the site.

Does anyone know how it's hosted to handle that kind of traffic? (I'm just curious)

Thanks!

<comment><USER49> In 2008, SSD Array was deployed to handle images.

[http://plentyoffish.wordpress.com/2008/03/27/ssd-image- serve...](http://plentyoffish.wordpress.com/2008/03/27/ssd-image-server- array/)

2009 brought more upgrades, including move to _HP ProLiant DL785 with 512 GB of ram and 32 CPUs_ and SQLServer 2008 and Windows 2008, and _In the next week we will be upgrading our image serving, we are nearing 10,000 images served per second and existing stuff just isn't cutting it. We will be moving our 200 million images over to RamSan_

[http://plentyoffish.wordpress.com/2009/06/14/upgrades- themes...](http://plentyoffish.wordpress.com/2009/06/14/upgrades-themes-date- night/)

<comment><USER50> Another interesting thing:

"This month we will be building out our CUDA cluster to have 147,000 GPU cores to allow us to better predict who you will date."

From:

[http://plentyoffish.wordpress.com/2013/01/06/pof- takes-67-of...](http://plentyoffish.wordpress.com/2013/01/06/pof-takes-67-of- mobile-dating-market-share/#comments)

</comment></comment></comment><comment><USER51> Markus is POF accessible to screen reader users? I remember attempting to use the site several years ago with my screen reading software and was unable to do so.

</comment><comment><USER30> I remember when you posted that check along with the exciting details. It was very inspiring for those of us fighting giants. Thanks for the update.

</comment><comment><USER52> POF still (since I last checked) store their passwords in plain text, so for that reason I cannot give it praise

<comment><USER53> and how would you go about checking that ?

<comment><USER52> 2 reasons... 1\. Letters of my password are shown to me with asterisks inbetween.

2\. users used to get their own password sent back to them when they forgot it, rather than being forced make a new pass.

Although to be fair I don't think they do 2 anymore

You only have to google it to find other users saying the same thing.

<comment><USER54> For a long time it actually sent you your password in an automated email _once a month_ just in case you happened to forget it.

<comment><USER55> This attitude might actually be the difference between them and lesser known competitors. (not that I think it's OK)

<comment><USER56> When this originally came up people were saying that, they use it as a reminder to keep using the site. But you can get the same benefit using a login link or something, no need for all the security issues.

<comment><USER54> Yep.

The email itself is actually a call to action, it's telling you your new matches. And it's actually weekly. It looked like this before:

        Hello yournamehere,

        Thank you for signing up on MM/DD/YYYY HH:MM:SS XM.
        Remember your password is *****.

        http://www.plentyoffish.com is larger than all other free dating sites combined.

        View your latest matches here --> http://www.plentyoffish.com/viewmatches.aspx

        1. You can now easily check your messages via a cell phone.
        2. Latest signups -- > http://www.plentyoffish.com/lastsignup.aspx
        3. Users online in your city -- > http://www.plentyoffish.com/lastonlinemycity.aspx
        4. If you have found your match you can delete your account in the help menu.
        5. Read your new emails here --> http://www.plentyoffish.com/inbox.aspx
        6. Who checked out your profile? -->http://www.plentyoffish.com/whoviewedme.aspx
        7. Compatibility Test to Measure Chemistry --> http://www.plentyoffish.com/poftest.aspx

        http://www.plentyoffish.com

At some point the password line was just replaced with:

        http://www.pof.com is larger than all other free dating sites combined.

So they didn't even have to make it a login link.

</comment></comment></comment></comment></comment></comment></comment><comment><USER57> Don't know how you do it Markus but POF is awesome.

</comment><comment><USER58> this is insane. hats off to your Markus.</comment>


What Initial Coin Offerings Are, and Why VC Firms Care - <AUTHOR> https://hbr.org/2017/03/what-initial-coin-offerings-are-and-why-vc-firms-care <comment><USER2> Sometimes ICOs are pulled off by scammers. Look for HEAT-coin for example.</comment>