Show HN: Javelin Browser - <AUTHOR> http://javelinbrowser.com?material-design <comment><USER2> I've been using your browser for a couple months now (I think I saw it mentioned on Android Police if you're curious) and I've been liking it. It looks slick, and works exactly how I think it should. The one problem I have with it is one I'd like other opinions on, both for my curiosity and your benefit.

Frankly, it's not my daily driver because I don't know who you are and don't trust you. Using a (no offense) no-name browser is somewhat of a risk as the developer could potentially be recording personal info. Of course, I have no guarantee that Mozilla isn't either. However, and yes I'm fully aware of how silly this sounds, I trust Mozilla despite never looking at their code or knowing any of the developers.

I'm guessing privacy is important to you (since you have the option of using a VPN service as IAP) so I'm curious how you would allay my fears of using a random browser from someone other than the big three.

Either way, I wish you luck.

<comment><AUTHOR> I'm also the developer of [http://getgom.com](http://getgom.com) (VPN as a Chrome extension using SPDY SSL proxies), and as a fellow Singaporean when our government openly does surveilance, I __completely__ understand where you are coming from. To be fair, I'm not sure how I can solve his problem though.

Open sourcing could be a plausible answer. But fighting Google Play clones and what-not is really time-consuming and as an indie dev, my time can be better spent.

What do you suggest?

<comment><USER3> What's stopping clones from replicating your UI right now? Are you concerned with loss of IAP revenue to clones?

I would suggest you open source it under a non-commercial license. Also, take a look at how some successful android open source projects are run. In particular, I like XPrivacy ([https://github.com/M66B/XPrivacy](https://github.com/M66B/XPrivacy)). This is an excellent app. Open source with optional purchase, similar to yours. Personally, I paid the $6 they charge because I'd rather not compile the src myself.

You've already had a lot of downloads and are an established app. Clones can't replicate that.. If you are a recognized dev on xda, with your own thread for discussion, feature requests, bug reports etc, no clones will be able to replace that aspect even if they can clone your app.

You should be able to get more downloads/purchases from privacy-aware users. And you can have donations for feature requests if you want.

Just some thoughts.. best of luck with the app!

<comment><USER4> > […] _open source it under a non-commercial license_ […]

A non-commercial license is _not_ , in any sane definition of the term, an "open source" license¹.

① [http://opensource.org/osd#fields-of- endeavor](http://opensource.org/osd#fields-of-endeavor)

</comment></comment></comment></comment><comment><AUTHOR> Developer here!

I've been working on Javelin since Feb this year and this is the 4th iteration, and on Reddit (r/android), and just a quick interesting byte. Javelin actually started as a "porn" browser! See: [http://www.reddit.com/r/Android/comments/1xblv9/hey_reddit_s...](http://www.reddit.com/r/Android/comments/1xblv9/hey_reddit_so_i_created_an_android_browser_for/)

PS: I'm headed to SF in October, anyone wanna grab a beer/coffee? I'm contactable at firstname.lastname@example.com

<comment><USER5> I remember that one, and I remember thinking that it looked pretty good, but will fail because of the name. Good to see you changed it.

<comment><USER6> Javelin still has a simple innuendo back into it's roots ;)

</comment></comment></comment><comment><USER7> I notice that you use www.theverge.com in a number of the screenshots for Javelin. The writers at The Verge, the developers that build the site, the designers that make it beautiful - are all paid through ad revenue. Please consider at least adding the ability to whitelist sites if you are going to bundle ad block.

*Full disclosure - I am a developer at Vox Media, the publisher of The Verge.

<comment><USER8> I don't think this mobile browser is going to make a dent in The Verge's ad revenue.

<comment><USER9> The Verge has about 45% mobile traffic: [https://www.quantcast.com/theverge.com](https://www.quantcast.com/theverge.com)

If large numbers of people were to start using Javelin, it could certainly affect revenue.

<comment><USER8> > If large numbers of people were to start using Javelin

If.

<comment> V-2 This is why I am against including ad-block as a default. People who don't install AdBlock (mostly don't know how, or can't be bothered) play an important role. Adblocking should be an opt-in.

</comment></comment></comment></comment></comment><comment><USER10> Why would I want to use a browser made by a group that is seemingly mostly preoccupied with design judging from your website? You don't even disclose who is really behind this project. Especially browser security is more important than ever. When using one made by Google or Mozilla I can be sure that they do take security seriously, have the necessary experience, technical know-how and manpower to deal with vulnerabilities in a timely manner.

</comment><comment><USER11> To me, including "mobile-first" as one of your key value proposition seems a little odd.

My immediate reaction was to wonder whether any mobile browsers _aren 't_ mobile-first? From my (incomplete) knowledge of smartphone browsers they all feature interfaces designed for smartphones and smartphones alone.

There must be a better word to use in your tagline - I notice you decided on using "Truly Mobile" further down ;)

<comment><USER12> I think the implication is that Chrome & Safari are both mobile editions of desktop apps, which is true to some extent.

</comment></comment><comment><USER13> I think you're making a mistake by offering this for free.

The kind of people who care enough about their web experience to install a new browser are the kind of people who won't mind parting with a few £$€ to do so.

To be profitable, free apps must target the broader market, but this is a relatively niche product. I don't think you'll get enough IAP fast enough to be sustainable.

<comment><AUTHOR> Why do you think Javelin is not suited for the broad market?

<comment><USER13> Because the average user doesn't even know what a web browser is, they just open up "the internet" on their phone. They are not going to _change_ something that they're not even aware of. It's also demonstrably true that the average user doesn't know or care about privacy enough to make this choice anyway. You don't have the resources to change either of these things.

So, disregard the average user. Market this as a paid product which offers a superior web browsing experience for the technology connoisseur and the privacy concious. These people, on average, have a lot more money, are easier to sell this product to, and don't mind paying.

Another reason to just charge money for this is that this provides assurances about your income stream which should mean that you are less likely to consider anti-user practises in order to generate income at some point in future.

</comment></comment></comment><comment><USER14> I used it for about 3-4 months when 'Stack' was introduced but went back to Link Bubble + Chrome. I couldn't exactly remember why I went back to LB + Chrome but mostly due to 'Stack' being too rigid to my liking compared to Link Bubble (back button not closing the stack, no easy jumping between stacks, scrolling and stack animations kind of wonky etc.)

All things said, I loved the browser experience. Especially easy access to bookmarks on right edge swipe and always available refresh button. I will definitely try it again. Speed dial looks good.

Edit: Just installed again and wow!! It totally looks different from the version I used some time back. Looks more slick and pretty now. Will definitely try again. Especially the 'Stack' behavior.

<comment><USER15> I'm on a Nexus 5 and have major memory leak issues with LB (I've reported them) if you keep the "bubble" open for too long. Chrome is very heavy as well in general, so Javelin is a really nice refresher what a fast browser feels like.

I just bought the pro version and I'm going to use it for a while before I comment more on it.

<comment><USER14> I use a Nexus 5 as well but have not personally encountered the memory leak issue with Link Bubble. But I don't keep the bubbles open very long as well.

I just went ahead and bought the Javelin Pro version as well. I like what developer is doing here.

</comment></comment></comment><comment><USER16> I'm interested but don't want to use the "play" store. Can you provide some other download link?

<comment><USER17> Why don't you want to use the play store? Just wondering is all.

<comment><USER18> Personally, I don't have Google Apps on my phone at all. If it's not in F-Droid or available as an apk from the developer, it doesn't get installed.

<comment><USER19> That seems limiting. Is it because you don't trust Google?

<comment><USER20> You are forced to have a Google account to use Google Play.

Once you have a Google account on your phone it is privacy game over.

<comment><USER19> I think that's a _little_ bombastic. So is that a custom ROM or stock Android with no account set? Seems like if you deeply distrust Google you probably wouldn't want to run Android at all.

<comment><USER20> You misunderstand me. I was simply articulating what I assumed the poster meant by his comment:

      Personally, I don't have Google Apps on my phone at all.
      If it's not in F-Droid or available as an apk from the
      developer, it doesn't get installed.

I personally have a stock Nexus 4 and accept that I'm simply a Google commodity. I accept that by having a Google Account on my phone means that Google are tracking everything I do, who I talk to, who I message, every website I visit and every opinion and iota of information about me, even some that they have extrapolated about me that I personally didn't realise, Google already knows. I accept that if Google knows this, the NSA can also get hold of this information relatively easily.

However, I don't work for any company of NSA interest. I have no threatening political or religious affiliations. I don't pose a threat to the status quo. I am not a wolf. I am a sheep. Therefore, my privacy can be traded for free Google features - slurp...

@niklasni1 though probably does care, which is why he doesn't use Google Play, because then he would need a Google account on his phone, that subsequently would be tracked by Google wherever he goes. Maybe @niklasni1 has a networking job for a European satellite provider that the NSA finds interesting. Maybe he is worried about being tasked. In which case, it isn't bombastic at all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> It looks very good. It's a pity it only syncs with Chrome and not with Firefox.

<comment><USER22> Agreed! I'd give it a try right now, but Firefox sync is a must-have for me. In fact, I'm considering giving up Dolphin Browser, even though I prefer it to Firefox for Android, because their "Dolphin Connect" Firefox add-on noticeably bogs down the browser, to the point where I often have it disabled.

</comment></comment><comment><USER23> I would - without trying to bash the project - like to understand what lures people into using this app?

I understand that I'm not the target here - I dislike Chrome/Chromium and I am a happy Firefox user.

But what drives people to use this browser? The UI alone? Maybe it would be something I can recommend to family and friends? Any decent, concise "This is why I like/use this thing" story?

</comment><comment><USER24> Awesome browser. But why use "gorgeous" as a descriptor? It's become such a meaningless term in tech, even when Jobs was still peddling it about.

It seems trivial, but seeing that word often is a red flag for an uninspired product. You guys have done great work, so I'm surprised your marketing isn't as great as the browser. Best of luck

</comment><comment><USER25> Ha! Reddit definitely doesn't look that great on mobile.

<comment><USER26> Yeah, isn't that a reddit-specific app?

<comment><USER27> Yeah, it's "Reddit Is Fun" (my favorite reddit app I've used)

[https://play.google.com/store/apps/details?id=com.andrewshu....](https://play.google.com/store/apps/details?id=com.andrewshu.android.reddit&hl=en)

</comment></comment></comment><comment><USER28> I like it a lot. But I have a tangential question: has anyone found a good writeup on rise of the use of adjectives like gorgeous, stunning, beautiful, amazing to describe apps? Aside from my personal opinion, I'd like to know if anyone else has observed and written about this trend.

<comment><USER29> I have not seen a write up on this, but whenever I see it, it seems strange. Calling your own app 'gorgeous' or 'stunning' may come off as conceited. Those are subjective terms. If the UX is positively impacted by the appearance, call that out in the copy. I think it would be better to let your users gush over the appearance of the app using subjective terms in reviews or testimonials.

</comment></comment><comment><USER30> This addresses a pain point I didn't even realize I had -- waiting for the browser context switch followed by waiting for the page to load, followed by impatiently scrolling the page while it continues to parse, sometimes causing janky scroll teleporting as images are embedded above my viewport.

This is simply fantastic. Pro purchased.

One suggestion -- if it is possible to insert yourself as two entries on the Open With page, it would be nice to have the option to click a link and open with "Javelin" or "Javelin (Reader Mode)" (I'm talking about the android system popup for handling mime types)

</comment><comment><USER15> Just out of curiosity, what are you using to parse the reading view of a webpage. It seems really fast so I doubt you're using Readability; probably some local library?

</comment><comment><USER31> Please, don't use automatic translator.

The text: "Jabalina es una hermosa, móvil-en primer lugar, y el pensamiento para navegadores de Android"

It has no sense.

<comment><USER32> Using automatic translator back to english : "Believes that the first and the Android browser - Javelin nice phone"

Really DON'T USE AUTOMATIC TRANSLATOR!

Also, nice browser. I trying it, mainly by the "block ads" feature

</comment></comment><comment> ezequiel-garzon You had me at "reading mode". I can't believe text wrap, pervasive in smart- and not-so-smart-phones of yore, is today considered a rarity. Thankfully I'm not alone [1].

[1] [https://code.google.com/p/android/issues/detail?id=62378](https://code.google.com/p/android/issues/detail?id=62378)

<comment><USER33> It would fantastic (and easy, technically, I think) to add a link to "reading mode" that starts text-to-speech.

</comment></comment><comment><USER34> Just curious, which browser engine does it use?

</comment><comment><USER35> Wow, this makes me want to ditch my iPhone...

</comment><comment><USER36> Any thoughts of an iOS version as well? This really makes me jealous of Android users

</comment><comment><USER37> Any particular reason it's not compatible with OnePlus One and Nexus 10 on Google Play? I get it if tablets aren't supported. I could get the apk but I was wondering... If testing is the reason, I can help.

<comment><AUTHOR> I have no idea to be honest, Google Play does that sometimes.

</comment></comment><comment><USER38> Bug reports for the developer nubela:

Swipe from the left to open the menu, then scroll down, so that part of the text is cut off, then swipe to the left to close the menu part of the way, but drag your finger back right before the menu closes. If you now scroll, the cut-off text is still visible, creating weird visual artifacts. This goes away when you close the menu completely and reopen it.

When I edit the title and URL of a bookmark, the buttons are "Cancel" and "Edit". I think "Save" would work better. I feel like what I am doing is already "editing", since I chose "Edit" to get here.

I tried to set Javelin as the default browser, but when the browser list popped up, by reflex I hit Just Once instead of Always. But Javelin still said "Javelin is now your default browser". (Then I realized what had happened and went back and did it again.) If possible, Javelin should detect when the user clicked the wrong button. If that is not possible, maybe you should show a small picture of the Always button before showing the dialog, to remind the user to hit that button.

In the page describing the Pro features, one of them is choosing your homepage. But I can already do that in the free version. It works when I go to Settings > Change homepage.

Javelin doesn't support a blank homepage. I tried setting the homepage to nothing ("") or to "about:blank", but either way, the homepage just becomes "Webpage not available". The error shows because Javelin is automatically adding an "[http://"](http://") before "about:blank" – "about:" pages should have no protocol.

I tried to press and hold on the icons (the eye icon and share icon) in the toolbar to see a tooltip describing what they do. However, those icons don't have tooltips. I would have liked to have been able to see a "Reading Mode" tooltip when I pressed and held on the eye icon instead of having to actually press it to find out. The icons in the toolbar for reading mode have the same problem.

When there are no tabs, I see a message "Javelin Browser, flies." The message confused me a bit because it is ungrammatical. It should be either "Javelin Browser flies." or "Javelin Browser – it flies."

I couldn't get Javelin Sync to work at all. I authorized it for my Google account and saw the message saying I have been sent an email. But my bookmarks are still the default Javelin ones (minus the ones I manually deleted); none of them are my Chrome for Android bookmarks. This is still the case even after I "Sync bookmarks now" – though since that command gives no feedback, I couldn't tell whether it worked. (I didn't install the desktop Chrome extension linked in the email because I don't want that home page, but the email said my device was already synced, so that shouldn't make a difference.) So either your Sync is broken or there is another step that you forgot to mention, like "wait one hour" or "restart your phone" or something.

In the menu on the left, the checkboxes look a little weird, because it is a blue checkmark on a turquoise background. I can see it, but I think they would look better if you made the check-marks very light gray, a color closer to the text but still distinct from it.

When I logged into a site, I got two dialog boxes asking me to save the password. The first was a generic Android one like in Google Chrome. I clicked Not Now, and then Javelin showed its colorful one at the bottom. You should hide the default one so that only the Javelin one shows.

I couldn't figure out how to activate the "Fullscreen Browsing" that you show in one of your website's screenshots. I tried scrolling through web pages, and I looked at all the settings, but I never had the Action Bar and the soft buttons displaying but transparent like in the screenshot. The soft buttons are always visible. I can hide the Action Bar completely with that setting, but then I can't open it all from within the app, and that's different from the screenshot anyway. It's not described as a Pro feature on the Enable Javelin Pro page either. You should make it more obvious how to enable that mode, or remove the screenshot if that feature is now gone.

This is a big list of bugs, many tiny ones and some big ones, but I'm still trying out Javelin for now – you haven't driven me back to Chrome yet. I am especially interested in your Adblock and full-screen features (so it's too bad I can't figure out how to use full-screen). I wish you luck with developing your browser.

<comment><USER39> Something I noticed is that when I open several pages in Stack view externally from the app, then open the Stack in the full browser, the tabs don't properly get thumbnails until I manually switch to them all.

Regardless, this is clearly a forward-thinking mobile browser, more so than Chrome, and so I support it wholeheartedly.

</comment></comment><comment><USER40> Adblock and readability feature integration is great! As a developer, could I ask you how you are implementing the readability feature? Is this done client side?

</comment><comment><USER41> Very minor nitpick: Your usage of "thought out" comes across as stilted and unprofessional. I'm guessing English isn't your native language?

<comment><USER42> I disagree. It's an unconventional usage but one that struck me as both deliberate and effective.

BTW almost all people in Singapore grow up speaking English, it's the common language of 4 ethnic groups and is used on all signs, government correspondence and so forth.

<comment><USER43> I disagree. I made me re-read the sentence more than once, and I still think it doesn't feel right.

<comment><USER44> I feel "well thought-out" would be a better way to phrase it.

</comment></comment></comment></comment><comment><USER45> Looks good. Adblock integration is a nice touch, thats pretty much my first line of defence when it comes to anti-malware on the systems I administrate.

<comment><USER46> Toggling JS off also makes mobile browsing super-fast and much safer.

I wish it was easy to toggle on/off. Mobile chrome is a couple clicks.

<comment><USER45> I wish I had the option if I disabled JS on my work machines none of the insurance company portals would work.

</comment></comment></comment><comment><USER47> My only criticism is that the icon is practically a mirror image of Telegram, but that's not exactly your fault.

Is there a way to save pages for offline viewing?

</comment><comment><USER48> It's not material design! Nothing accept colors is material design. No animations, no guidelines nothing!

</comment><comment><USER49> What rendering engine are you using?

<comment><AUTHOR> AOSP webview

<comment><USER5> Did you fix this? (should be fixed in 4.4+ webview, I think, if that's what you're using for all supported devices)

[https://community.rapid7.com/community/metasploit/blog/2014/...](https://community.rapid7.com/community/metasploit/blog/2014/09/15/major- android-bug-is-a-privacy-disaster-cve-2014-6041)

<comment><USER50> Just tested (using ejj.io/SOP.php), Javelin on my Note 3 isn't vulnerable.

</comment></comment></comment></comment><comment><USER51> Slightly unrelated question, but is there an equivalent for iOS app extensions on Android?

<comment><AUTHOR> Intents could be the answer. See [http://developer.android.com/guide/components/intents- filter...](http://developer.android.com/guide/components/intents-filters.html)

</comment></comment><comment><USER52> Desktop chrome sync and native ad-block! Woooha! I'm sold!

</comment><comment><USER53> I like it a lot! Any way you could have it sync with Firefox?

<comment><AUTHOR> The API is there but it's closed for now as it is just not ready for other developers (too raw). Also, not a firefox user myself.

</comment></comment><comment><USER54> Ironically, I get a blank page on my iPhone

</comment><comment><USER55> Looks great! I'm going to try this out

</comment><comment><USER56> Kudos man! It really looks beautiful.

</comment><comment><USER57> Why do you offer it for free?

<comment><AUTHOR> There is a Pro upgrade as an IAP. There's also an in-built proxy/vpn service in the browser. This is how I see myself growing Javelin down the road with the browser as the razor, and value-added services as the blade.

<comment><USER58> I obviously haven't thought about this as long as you have, but offhand I think that model is a mistake. Only a small subset of people (and perhaps a bunch of companies) want things like proxy support or VPNs or other extra services. Most people just want to browse the web, so you're limiting your market a lot.

(I do think you could make value-added browser services a business, but you'd have to go to enterprises to do it.)

<comment><USER59> That assumes that his main goal is to make a profit, rather than just put out a good product which generates a little bit of passive income.

<comment><USER58> I don't see why. Passive income vs profit is not really dichotomy; passive income is a question of how much work you put in, whereas profit is how much you make _relative_ to how much you put in. Regardless of how you structure your commitments, more profit is better than less profit.

You could argue that to be successful at generating a passive income of any magnitude, you'd be better off selling value-added services on top of a free browser rather than just selling a browser. I'd be curious to hear that argument, because the opposite seems true: making freemium work means that you need to invest not just in making a great free product that people will use, but also invest in creating enough additional value to make the sale. Thus I think wanting a lower commitment to the company actually says you should just sell the browser.

</comment></comment></comment></comment></comment><comment><USER60> Looks pretty slick!</comment>


Ask HN: How to get acquainted with an open source code base? - <AUTHOR> I am a computer scientist with solid theory but not much practice. How could I for example contribute to Neovim? <comment><USER2> I started contributing to ckb-next[1] through simply hanging around the IRC channel, and absorbing the developers trying to explain and fix bugs, and asking questions about things I didn't understand, and relevant source code.

[1][http://github.com/ckb-next/ckb-next](http://github.com/ckb-next/ckb-next)</comment>


Novation release open firmware for Launchpad Pro MIDI controller - <AUTHOR> https://github.com/dvhdr/launchpad-pro <comment><AUTHOR> From the README:

> We could have released the full source for the factory shipping firmware, > but we decided not to for a variety of reasons. Instead, we created a > simplified framework for developing "apps" on Launchpad Pro, which comprises > a build environment, application entry points / API, and a library of low > level source code.

This is a hard one. On the one hand it's great that they're making things more flexible, but as a person who prefers "free software" (ideology) to "open source" (practical matters), I can't help but think that only offering half of it is missing the point of an open firmware. What if I want to look at the LED multiplexing routines? They're allowing me to improve the product, but only with some confines they set up.

</comment><comment><USER2> This looks good. Please email email@example.com if you would like us to send you a repost invite. It's an experiment we're working on to give good submissions a second chance.</comment>


Ajenti Linux admin panel 1.0 beta released - <AUTHOR> http://ajenti.org

<comment><USER2> Congrats to the Ajenti team! Been waiting for something like this for a long time. I hope it works as advertised. Is there a plan to monetize this tool?</comment>


Alan Greenspan: Economy will 'fade' dramatically because of entitlement burden - <AUTHOR> https://www.cnbc.com/2019/04/12/alan-greenspan-says-economy-will-start-to-fade-out-because-of-growing-us-entitlement-burden.html <comment><USER2> Why would anyone listen to greenspan after 2008? A dotty old randian who doesn't know what he thinks he knows

<comment><USER3> Greenspam was associated with Rand at least through 1977 when he was chairman of Ford's Council of Economic Advisors, a position that Rand explicitly approved. She died in 1982 and Greenspam was appointed to the Fed in 1987 so she never had a chance to comment on that position.

However, based on Rand's writings on ethics and capitalism it would be immoral to accept the Fed chairmanship unless you had an explicit charter to shut it down which was obviously not the case for Greenspam. Rand would have denounced Greenspam in no uncertain terms but she was dead.

Accepting the Fed position was an explicit repudiation of Rand's philosophy and views on capitalism regardless of Greenspam's prior association with Rand. It was also an implicit repudiation of the articles (especially the article on gold) that he wrote in Rand's anthology "Capitalism: The Unknown Ideal" in which Greenspam authored three articles; "Antitrust", "Gold and Economic Freedom", and "The Assault on Integrity". He is no more a "randian" than my mom, though he is dotty and old.

Greenspam would have been wise to read and heed an article written also in Rand's book on capitalism; "The Anatomy of Compromise" in which she explains the principle of Sanction. Rand wrote;

> In any collaboration between two men (or two groups) who hold _different_ > basic principles, it is the more evil or irrational one who wins.

Greenspan chose to collaborate with dishonest bankers, currency cranks (in the Fed) and bureaucrats (in the bank regulators) who wanted make it possible to "somehow" inflate the currency, give loans to the unqualified and to back quasi-private debt (Fannie Mae and Freddie Mac) with govt guarantees all without consequences. He thus set the stage for the 2008 mortgage banking crisis.

</comment></comment><comment><USER4> Ok so maybe we should axe FICA taxes for employer and employee and just borrow it by issuing more treasury securities? I mean, he's not complaining about unfunded military expenses that are paid for exclusively by borrowing. If military adventures had their own tax, maybe we'd be thinking a little more clearly about our priorities?

</comment><comment><USER5> > "Without any major change in entitlements, entitlements are going to rise. > Why? Because the population is aging. There's no way to reverse that, and > the politics of it are awful, as you well know," Greenspan added.

Funny that he'd lay the blame on entitlements when it could just as easily be laid on out-of-control military spending with the Terrorism boogeyman cracking the whip. Why, because neither the Republicans nor Democrats can keep their entitled noses out of other countries' (or their own citizens') business. There's no way to reverse that and the politics are truly awful.

The bigger problem is that the American people have collectively decided that debt simply doesn't matter. Congress and the President pass budgets with eye- popping deficits. The Tea Party and its calls for fiscal restraint are as good as dead. Sanders, Warren, and the left wing of the Democratic party are on the ascendency and will do everything they can to implement programs with high price tags. Republicans will block any attempt to raise taxes to pay for it all. The Federal Reserve has decided to pull the plug on quantitative tightening, making it that much easier for Congress to balloon the national debt.

Greenspan bears major responsibility for this mess. His complicity in letting asset bubbles inflate well beyond control, and his rush to paper over the resulting mess leads us where we are today. A financial house of mirrors where bullshit passes for money and only the poor get hurt for their financial stupidity.

<comment><USER6> > Funny that he'd lay the blame on entitlements when it could just as easily > be laid on out-of-control military spending with the Terrorism boogeyman > cracking the whip.

Out of control military spending? As a percentage of GDP military spending has had an overall downward trend since the Korean War. Measuring in terms of dollars does not account for overall growth of the economy. There's nothing "out of control" about US military spending.

[https://images.app.goo.gl/g1j2vkJz8UpdHcvU9](https://images.app.goo.gl/g1j2vkJz8UpdHcvU9)

<comment><USER7> The chart is incorrect because it does not take into account hundreds of billions in veteran's benefits, nor interest paid on past military spending (and as there is a budget deficit, the current year's military deficit spending will be tacked onto next year's military debt interest).

<comment><USER6> This cuts both ways, the spending on veterans post Korean War, WWII, and the Vietnam War was probably very large as well. The point is the overall trend is down. The economic burden of the US defense budget is decreasing, not increasing.

Our military spending as a percentage of GDP has dropped by roughly 4x since the 1960s. From around 12% to around 4%. In no way can a reasonable person describe our military spending as "out of control".</comment></comment></comment></comment>


Consumerism: One Choice Too Many  - <AUTHOR> http://www.psychologytoday.com/articles/200401/consumerism-one-choice-too-many

<comment><USER2> Holy cow, it is hard to believe this was published as news to the psychology community.

There have been studies for _ages_ showing that consumers are unhappy and stressed with too many choices. This is not news. However, what people that swear by the "limit choices" mantra fail to recognize is that this stress is endured for the benefit of providing better to one's self, family, and others. For example, as a U.S. consumer, I hate the cereal aisle. Way too many choices. But, if I can bring home something that is desired by my family or something new that might make my family more healthy or happy, I'm happy to bear the burden of a more stressful choice.

But, having more choices is not always better. Additional complexity is stressful as stated. So, you need a balance between choice and the freedom to choice what is "best".

 _Federal law permits people to take their phone numbers with them if they switch cell phone service. It's nice to have more flexibility- but is this really what we need?_

Yes. Yes, it is. Although, I don't agree with the government always having to get involved.</comment>


Show HN: soft-launching one of my pet projects - <AUTHOR>

So a while ago I was thinking it would be neat to build a site that had the most absolute utility. The idea I came up with was a site to store those little protips that are super useful, if you know them ahead of time.
I hired a guy to work on it with me, and ClueDB was born: http://cluedb.com/
Please give it a whirl (it uses Twitter auth as login but doesn't tweet anything) and tell me what you think!
(Various trivia: My first try at a project coded by someone else and "product managed" by me. Runs on Flask + MongoDB. Also, this is totally unrelated to my startup.) <comment><USER2> Looks good.

My one UI nitpick would be that clicking the "Read another random clue" button takes you to a random clue but that button is not present on the new page. I spent ~5 confused seconds looking for the button again before I noticed the link in the header. In my opinion the button should also be present on the clue page.

If you are looking for some content to get the site started Reddit recently had a huge thread full of hints and tips like this.

<comment><USER3> Agreed. I just want to sit here and click through clues, but the UI isn't very conducive to that.

</comment></comment><comment><USER4> I really like the site, but I'm turned off by the insistence on Twitter as the only way to interact with it.

Can I at least log in with Facebook? Gmail? OpenID?

It should also be possible to submit a new clue from any page, not just the homepage, I spent a little bit of time hunting for a submit button near the top of the page.

<comment><AUTHOR> i'm starting with twitter for now, mostly because the API is the easiest for me to deal with...

<comment><USER5> do you think you'll ask for email/password later on?

<comment><AUTHOR> presumably.

</comment></comment></comment></comment><comment><USER6> Clickable: <http://cluedb.com/>

</comment><comment><USER7> I really like the site. I clicked "get random clue" enough times to get multiple repeats. Perhaps a "get next clue" is in order which a user can use to avoid repeats?

Also the "Read another random clue" button disappears after a couple of clues. I then have to click the random clue link at the top right which doesn't make a lot of sense.

<comment><AUTHOR> Strange, I shall investigate.

There aren't that many clues in the system yet.

</comment></comment><comment><USER8> Two minor issues:

Clicked on "another random clue" after reading the first one. That disappeared on the following clues.

Having to use Twitter/any other common ID is going to cause people to shy away. Let me register for my own ID on your site.

Otherwise, I love the idea!

</comment><comment><USER9> Bug: I was clicking random clue, and it worked fine for a few, but then I got: _The webpage at<http://cluedb.com/clue/7298Bb//> has resulted in too many redirects._

<comment><AUTHOR> yeah, there's some bad data. bug created!

</comment></comment><comment><USER10> Fun! Wish the Read another clue would stay there so i can keep cruising along, but after 2 it disappears. Reading the comments is useful too. This is like a one big forum and we scroll through threads.

</comment><comment><USER11> It's a nice idea. I wish you had chosen another name, though. When I see ClueDB I think of a database product; I don't know what non-developers think of or if they'll remember the name.

</comment><comment><USER9> Has the @ symbol now become the standard symbol for denoting a user's "homepage" on a site? I thought it was generally used to link directly to their twitter page?

</comment><comment><USER5> clicking on "random clue" is unexpectedly satisfying.

</comment><comment><USER12> very cool. it would be nice to add categories or tags to clues. API would be nice too so maybe somebody else could create a mobile version :)

<comment><AUTHOR> it does have tagging!

<comment><USER12> oh sorry somehow I missed them

</comment></comment></comment><comment><USER13> I actually have been working on this same idea of my own. Good to see there will be some competition. :)

</comment><comment><USER14> joshu: do you need any design help? would be happy to hack on a simple/elegant logo and/or design.

</comment><comment><USER15> Nice work. How are you liking the flask/mongo combination?

</comment><comment><USER16> Cool idea. Back button is broken.</comment>


Should the ICANN do something about domain squatting? - <AUTHOR> I'm aware of the possibility of filing UDRP [1], but that option is only available if a specific trademark is being infringed upon. But the problem of domain squatting goes farther than that. An incredible amount of short, descriptive and potentially useful domains are being squatted and rendered unusable to anybody who isn't willing to take the risk of making a substantial investment in the domain name.<p>Some will probably argue this is a good way to determine the value of those domains, but its actual effect is that, what is probably a majority of useful domain names, are completely unused for any kind of productive or otherwise valuable purpose.<p>[1] https://www.icann.org/resources/pages/filing-udrp-2013-05-21-en <comment><USER2> At this point, no.

We have a vast number of potential TLDs now.

It doesn't matter if .com domains (by far the most lucrative squatting target) are being supposedly used for something productive or ... "valuable" (who determines what is valuable? a panel of clowns?).

If there was a good time to do something about domain squatting, it was 20-25 years ago, when we had few TLDs choices and the impact would have been far less due to fewer domain owners. Changing the system now would be a belligerent action against a very large number of existing domain owners. Someone has owned a domain for 22 years and they change the rules now - that's entirely unfair. The deal is, they pay the fee, the domain is theirs; then ICANN is going to change the deal? Letting bureaucrats begin arbitrarily changing the rules is about the worst thing you can ever do. Once you let the weasels in to change the rules in a big way, they'll keep doing it and you will not like the inevitable nightmare it creates.

The lack of supposedly useful domain names is not holding back the Web in any regard what-so-ever. If the domain is the big problem, in reality it's your product or service that is the problem. Owning Jump.com instead of JumpApp.com (made up example) is not the problem, it's the shitty product that nobody wants to use.

Domains are like ideas, it's not where the value is at in a service. Most of the value is in the execution of the thing. Tesla was at TeslaMotors.com in the beginning, it wasn't a problem for marketing. It's the same reason Business.com - after decades - has never turned into a $187 billion company like Salesforce.com, or a $42 billion company like Atlassian, despite such a tremendous name.

Why did I mention Jump.com? Microsoft acquired Jump.com in 1999, shut down the service, and then sat on the domain for the better part of two decades (now living as a redirect for Lime):

[https://news.microsoft.com/1999/04/26/microsoft-acquires- lea...](https://news.microsoft.com/1999/04/26/microsoft-acquires-leading-web- based-calendar-company-jump-networks/)

Does it matter that Jump.com hasn't been used for anything meaningful in 20 years? Nope. It doesn't matter even in the slightest.

<comment><USER3> should we fix a problem? "nah it's too much of a hassle and it will anger rich people" ok.....

<comment><USER4> That's.... completely different to what he said.

</comment></comment></comment><comment><USER5> A major problem I dislike about the current system is that when a domain expires, the domain _registrar_ has the option to keep the domain name practically free (18 cents/year):

[https://www.namecheap.com/legal/domains/icann- fee/](https://www.namecheap.com/legal/domains/icann-fee/)

The registrars usually keep expired domain names and put them in an auction. If it's a "good/valuable" domain name, the registrar will keep it locked up indefinitely at a high price since it's only costing them 18 cents/year.

If a domain registrar wants to conduct domain auctions on behalf of its users and take a cut of the selling price, I'd be fine with that: users would still have to pay the annual registration fee while it is being auctioned.

Registrars should not be allowed to hold expired domains longer than 60 days - long enough to make sure the previous owner doesn't want it.

Not saying this would fix all issues, but I do think this one is a major wart that should be fixed.

</comment><comment><USER6> Domain Squatting has a specific legal definition, so I think very little can be done about that. "using an Internet domain name with bad faith intent to profit from the goodwill of a trademark belonging to someone else". Essentially, this is only something you can enforce if you trademark something and someone takes a domain name _after_ you trademarked it.

I think we need a new term for what is going on - "Domain Scalping", wherein speculators buy up countless domains hoping to resell them for hundreds or thousands of dollars. Scalping is a better term because that's exactly what they're doing - buying an address and preventing anyone else from using it unless you pay them.

</comment><comment><USER7> Let's talk about language and why it matters. Domain Squatting (Cybersquatting) is a very specific thing, which you touch on. It's infringing on someone's trademark in bad faith. This is entirely separate from descriptive domains you mention in your next sentence. To use the Jump.com example, that's not being squatted because it's not being used to infringe on someone's TM.

I think it's impossible and unfair to change the rules now. Some of the largest portfolio holders are big corps. Look at P&G who own Clean.com and just redirect it to Tide.com. Going to have a hard time prying that away.

I know a lot of people feel like people who are holding domains are unfairly profitting, but I'm still waiting for a better system to be described that could pragmatically be implemented as well. I know there is a boogeyman of domain investors at ICANN that a lot of people (who seem very connected to registry interests) use as a way to push for their agenda because domain investor interests tend to align better with consumers at large (eg. price increases, registrant rights, etc).

Finally, you have a bajilarillions of options for domain names at this point. Hundreds of TLDs, I think 63 characters. Just using a-z0-9- we're talking 3,763,572,874,813,444,727,106,020,660,762,327,844,147,969,869,582,735,798,064,027,429,183 combinations in one TLD space. If you can't find an available domain name with that, you're not creative enough to be running a business.

<comment><USER6> Citing the potential number of free domains isn't fair because random gibberish as a URL is in no way useful. There's a reason why these scalpers aren't buying up GUIDs as domain names - they're buying up permutations and combinations of words because they know those are the 'good' domains people actually want.

<comment><USER7> And not figuring out a way to make a memorable name in a space that addressable is bullshit. I've been able to find plenty of two word .coms and built companies on them. Or startups have gone with .ly or removed vowels or a number of other creative ways to create brands when there is false scarcity.

</comment></comment></comment><comment><USER8> I'm not a fan of squatters, but it's a complex problem. I'm not sure we can ban 'squatting' or 'scalping' per se.

What we _could_ do, however, is limit the maximum price a domain can be bought and sold for (say, $100). This would eliminate most incentives.

The meta solution, of course, would be to eliminate the necessity of TLDs altogether.

<comment><USER9> >The meta solution, of course, would be to eliminate the necessity of TLDs altogether.

Would you care to elaborate on this?

Say we have no TLDs - everyone is now sharing the same address space, every company now has to compete for domains (who gets the most desirable domains e.g. "shop" or "bank"? do bank.com and bank.net have equal claim over it (assuming they're seperate entities) or does one former TLD have precedence for existing domains? who arbitrates disputes?), there's no separation for government or educational services (anyone who wants to offer free services to people with an academic email address can no longer validate on e.g. .edu or .edu.tld addressing, you have to maintain a list of every educational institution), different countries are now competing for domains... it would be chaos.

The other option would be to have a public key thumbprint, similar to Tor, but then you have the problem of remembering the address - so you'd need something like DNS to convert memorable names to thumbprints, and then a means to find out what IP address holds what services and pubkeys...

<comment><USER8> I agree, it's a difficult problem. I don't have a brilliant alternative.

</comment></comment></comment><comment><USER10> The number of TLDs should not have been expanded so greatly I think. The decision to do this in 2012/2013 makes enforcement very difficult at best.

Great example is [https://aal.army](https://aal.army)

Is it an official US Army site? I've inquired in the past. No one knows...

<comment><USER11> one step up the hierarchy, is _this_ an official US Army website: [https://armyfuturescommand.com/](https://armyfuturescommand.com/) ?

Outside of special purpose TLDs/subdomains, the number of TLDs doesn't change that much in that regard IMHO.</comment></comment>


Revenge of the Nerd - <AUTHOR> http://www.newsweek.com/id/200015/output/print

<comment><USER2> "To Wilmott, Gaussian is an example of how dangerously abstract quant finance has become. 'We need to get back to testing models rather than revering them,' he says. 'That's hard work, but this idea that there are these great principles governing finance and that correlations can just be plucked out of the air is totally false.'"

Hear. Hear.</comment>


Robots.txt Disallow: 20 Years of Mistakes To Avoid - <AUTHOR> http://www.beussery.com/blog/index.php/2014/06/robots-txt-disallow-20/ <comment><USER2> This article forgot the _very_ worst use of robots.txt:

      User-agent: ia_archiver
      Disallow: /

Those two lines mean that all content hosted on the entire site will be blocked from the Internet Archive (archive.org) WayBack Machine, and the public will be unable to look at any previous versions of the website's content. It wipes out a public view of the past.

Yeah, I'm looking at you, Washington Post: [http://www.washingtonpost.com/robots.txt](http://www.washingtonpost.com/robots.txt)

Banning access to history like that is shameful.

<comment><USER3> No, you do NOT have the right to pound my site with requests and serve data that I decided to pull down.

<comment><USER4> "serve data that I decided to pull down."

If it's on their bandwidth and power, why not?

<comment><USER5> I think pekk meant that if he deletes a blog post, the IA is still going to serve it. "Pull down" refers to deleting content, not bandwidth usage.

<comment><USER6> If you don't want it on the internet, don't post it. Assuming anything can ever be made to disappear from the internet is naive, and if people become aware you are, it'll just get Streisanded and become even more widely posted.

<comment><USER7> There are two sides to this argument. I argue both. All the fucking time.

If you're in the business of providing _public_ content that's well-known, to the public, then allowing it to be archived makes a lot of sense.

If you're providing _user-generated content_ I'd argue that the case for allowing archival is extended even more so. Sites that violate this, and Quora comes specifically to mind, are violating what many, myself included, consider to be part of the social contract of the Web.

On the other hand, if you're an individual, and you are posting your own content and ramblings, and circumstances change for whatever reason: you've got a job, you've lost a job, you're married, you're divorced, you're _getting_ divorced, your child is at war in a foreign country, a foreign country is at war with yours, or you're just sick of the crap you wrote when you were young and arrogant and now and old and arrogant you wants it gone: I'm pretty willing to grant you that right.

If you've committed some terrible crime against humanity, or just a human, _and have been fairly tried and convicted of it_ , I'd probably _not_ give you the right to remove large bits of that information.

And yes, there are vast fields, deserts, tundras, plains, steppes, ice-fields, and oceans of grey about all of this.

Barbra Streisand _got_ Streisanded _because she is_ Streisand.

Ahmed's Falafel Hut likely _wouldn 't_ suffer the same fate. His Q-score is somewhat lower, and there's only so much real estate in the public consciousness.

</comment></comment></comment></comment></comment></comment><comment><USER8> What frustrates me is the number of websites that impose additional restrictions on anything they don't recognize, or worse, websites that impose additional restrictions on (or worse yet, just outright ban) anything that isn't Googlebot.

And people wonder why alternative search engines have such a hard time taking off.

<comment><USER7> I can give you a really simple operational reason for that: complexity.

Google is somewhere between 50-90% of most sites' search referrals (source: /dev/ass). Add in a handful of other search engines (Bing, DDG, Yahoo, Ask) and you've pretty much got all of it.

They're maybe 10-20% of your crawl traffic though. And possibly a _lot_ less than that.

There are a _TON_ of bots out there. If you're lucky, they just fill your logs and hammer your bandwidth.

If you're not so lucky, they break your site search, overload your servers, and if you're particularly unlucky, they wake you up with 2:30 am pages for two weeks straight.

At which point the simplest way to solve the technical problem, that is, you getting a full night's sleep, is to ban every last fucking bot but Google. Or maybe a handful of the majors.

Now, of course, you're a data-driven operation and you're relying on Google Analytics to tell you who's sending traffic your way. But if you block a search crawler, it's going to stop sending you traffic, so you won't know it's important.

It's a rather similar set of logic that drives people to set email bans on entire CCTLDs or ASN blocks for foreign countries. And if you're a smallish site, it's probably a decent heuristic. And no, it's not just fucking n00bs who do this. Lauren Weinstein who pretty much personally birthed ARPANET at UCLA was bitching on G+ just a week or so back that the new set of unlimited TLDs ICANN were selling were rapidly going into his mailserver blocklists. Because, of course, the early adoptors of such TLDs tend to be spammers, or at least, the early adopters he's likely to hear from.

[https://plus.google.com/114753028665775786510/posts/SsgPNHLG...](https://plus.google.com/114753028665775786510/posts/SsgPNHLGvnF)

</comment></comment><comment><USER9> The article contains some good observations, but I'm struggling to understand this one:

"Some sites try to communicate with Google through comments in robots.txt"

In the examples given, none appear to be trying to "communicate with Google through comments" \- how is including...

      # What's all this then?
      #   \
      #
      #    -----
      #   | . . |
      #    -----
      #  \--|-|--/
      #     | |
      #  |</comment><comment>-|

...a "mistake" to avoid? There's no harm in it at all.

<comment><USER10> "Some sites try to communicate with Google through comments in robots.txt"

I thought that was the whole point of robots.txt

<comment><USER11> No, the point is to communicate with Google through non-comments in robots.txt.

</comment></comment></comment><comment><USER12> fun fact: robots.txt can also be used by attackers to find admin interfaces or other sensitive tidbits that you don't want search engines to crawl

lots of target-detection crawlers will look at robots.txt as the first thing they do to see if there's any fun pages you don't want the other crawlers to see

<comment><USER13> If you want to hide admin pages, add the robots meta tag to each one and set noindex, nofollow. Then you don't need to list them all in one place in robots.txt.

That said, obscurity is not really security. Your admin pages should be behind a password, which, if coded properly, will exclude spiders, bots, and bad guys.

</comment></comment><comment><USER14> In the past I've created an empty robots.txt just to keep the 404 errors out of my logs...

</comment><comment><USER15> Why does Google ignore the crawl delay?

<comment><USER16> Google has millions of spiders, in datacenters all over the world. Maybe respecting crawl delay added more shared-state overhead than they wanted.

</comment></comment><comment><USER17> The main use for robots.txt is to prevent crawling of infinite URL spaces: [http://googlewebmastercentral.blogspot.com.br/2008/08/to- inf...](http://googlewebmastercentral.blogspot.com.br/2008/08/to-infinity-and- beyond-no.html)

Alongside tagging links to such resources with nofollow.

<comment><USER18> Back in the day, I would use httrack for offline web browsing, and these were a constant irritation.

</comment></comment><comment><USER16> My server returns 410 GONE to robots.txt requests.

The robots exclusion protocol is a ridiculous anachronism. I don't use it and neither should you.

<comment><USER19> And what do you do about sites with an infinite number of pages?

<comment><USER16> By not writing bad software. State shouldn't be stored in URLs, it should be stored in cookies.

Spiders have to be robust against sites with unlimited numbers of internal links anyway, or else an attacker could trap a web spider with a malicious site, or a 13 year old writing a buggy PHP add could take down Google's entire spidering system.

<comment><USER19> > By not writing bad software. State shouldn't be stored in URLs, it should be > stored in cookies.

GAH!! So it's you who writes those horrible sites?

I want to be able to middle click on two different URLs and browse two pages with completely different state at the same time.

I HATE sites that store state in cookies, the two different tabs start getting completely mixed up about where I am in the site.

The only thing that should be in a cookie is stuff like a shopping cart. But that's only because the action "add to cart" is like a transaction and should be remembered.

Viewing a page and changing the sort is ephemeral and should have no effect on anything else.

> Spiders have to be robust

Who cares about the spider? What about your site that got hit with an unending stream of completely useless page views?

Your position about robots.txt is simply wrong and you need to change your mind.

</comment></comment></comment></comment><comment><USER20> yeah, robots.txt is a horrible standard. trust me, i wrote [https://www.npmjs.org/package/robotstxt](https://www.npmjs.org/package/robotstxt) just so that i can really understand what is going on. it's based on [https://developers.google.com/webmasters/control-crawl- index...](https://developers.google.com/webmasters/control-crawl- index/docs/robots_txt)

the article is pretty much correct (although strangely worded at some times), the stuff about "communicating via robotst comments to google" is of course not true. the example he gives are developer jokes, nothing more.

still, you should not use comments in the robots.txt, why?

you can group user agents i.e.:

        User-agent: Googlebot
        User-agent: bingbot
        User-Agent: Yandex
        Disallow: /

Congrats, you have just disallowed googlebot, bingbot and yandox from crawling (not indexing, just crawling)

ok, now:

        User-agent: Googlebot
        #User-agent: bingbot
        User-Agent: Yandex
        Disallow: /

so well, you have definitly blocked yandex, you do not care for bingbot (commented out), but what about googlebot? is googlebot and yandex part of a user-agent group? or is googlebot it's own group and yandex it's own group? if the commented line is interpredted as blank line, then googlebot and yandex are different groups, if it's interpredted are as non existent, they belong together.

they way i read the spec [https://developers.google.com/webmasters/control- crawl-index...](https://developers.google.com/webmasters/control-crawl- index/docs/robots_txt), this behaviour is undefined. (pleae correct me if i'm wrong)

simple solution: don't use comments in the robots.txt file.

also, please somebody fork and take over [https://www.npmjs.org/package/robotstxt](https://www.npmjs.org/package/robotstxt) it has this undefined behaviour and it also does not follow HTTP 301 requests (which was unspecified when i coded it) and also it tries to do too much (fetching and analysing, it should only do one thing).

by the way, my recommendation is to have a robots.txt file like this

        User-agent: *
        Dissalow:

        Sitemap: http://www.example.com/your-sitemap-index.xml

and return HTTP 200

why: if you do not have a file there, then at some point in the future suddenly you will return HTTP 500 or HTTP 200 with some response, that can be misleading. also it's quite common that the staging robots.txt file spills over into the real word, this happens as soon as you forget that you have to care about your real robots.txt

also read the spec [https://developers.google.com/webmasters/control-crawl- index...](https://developers.google.com/webmasters/control-crawl- index/docs/robots_txt)

</comment><comment><USER6> There are enough malicious bots that do follow robots.txt to make it still an important option for most sites.

</comment><comment><USER10> 500kb limit? you call that short and sweet?</comment>


Snapchat pulled off the only good April Fools' Day prank this year - <AUTHOR> https://www.recode.net/2017/4/1/15148512/snapchat-instagram-snap-april-fools-filter <comment><USER2> Sorry I must be slow, what's the joke?

<comment><USER3> Instagram has a long history of copying Snapchat, so Snapchat copied Instagram's interface/features as a joke for April Fool's Day.

<comment><USER2> Ta, I don't use either.

I did find the Rick and Morty April fools joke kinda funny, in a world that April fools has been ruined kinda like Valentine's day.</comment></comment></comment>


Ask HN: What is the best way to add authentication to REST API (for mobile)? - <AUTHOR> Newbie Question: What is a secure and accepted way for authentication and authorisation of REST API endpoint for mobile and SPA's? A google search usually yields JWT but from what I know about JWT, it's complex and doesn't support revocation of tokens easily. <comment><USER2> There are pros and cons of JWT but if you are OK with it, it is not complex if you use a library. JWT purists want everything on the token (no database) but if you are OK with using a database, just store the token and delete it to revoke. When authenticating, add a database query (it's not that bad) in addition to the verification of the token

</comment><comment><USER3> If you're using AWS, maybe take a look at Cognito?

[https://docs.aws.amazon.com/cognito/latest/developerguide/wh...](https://docs.aws.amazon.com/cognito/latest/developerguide/what- is-amazon-cognito.html)

</comment><comment><USER4> If you control both the backend and the front end, just use a session cookie.

<comment><USER5> The humble session cookie is what I've been using all these years, but now suddenly everyone is saying "JWT". Any advice on the pros and cons of JWT vs session cookies?

<comment><USER4> JWT is a buzzword. Some people are attracted to changing shit for the sake of it, and then encouraging others to use the new thing too, to validate their own use, and feel like they're 'ahead of the curve' on trendy tech.

Rather than rehashing it all myself, I'd suggest reading [http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt- fo...](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for- sessions/) and [https://developer.okta.com/blog/2017/08/17/why-jwts-suck- as-...](https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session- tokens)

</comment></comment></comment><comment><USER6> Auth0 is not a bad option.

For JWT to support revocation, you must store them in the database and delete them on logout or when they expire.

<comment><USER7> To clarify for JWT invalidation, you don't have to store the whole token. Instead just store the jti or some other identifying field that can be checked.

<comment><AUTHOR> Can you please elaborate on this?

<comment><USER8> The JWT specification defines a payload attribute named jti which is used to store the token's nonce/id.

To avoid replay attacks, the backend adds the token's nonce to a scratchpad memory when the token is used in order to invalidate the token even if the expiration timestamp isn't reached.

If a JWT implementation is implemented to ignore replay attacks or even token expiration, the jti can still be used to invalidate tokens.

</comment></comment></comment></comment><comment><USER9> May be you are interested in this page [https://sushi2k.gitbooks.io/the-owasp- mobile-security-testin...](https://sushi2k.gitbooks.io/the-owasp-mobile- security-testing-guide/content/0x04e-Testing-Authentication-and-Session- Management.html)

</comment><comment><USER10> JWT is not that complex because there are battle tested libraries available for all languages.

<comment><AUTHOR> I agree, and I was thinking of using go-jwt but given the bad rap it has received here [https://news.ycombinator.com/item?id=13865459](https://news.ycombinator.com/item?id=13865459) and here [https://news.ycombinator.com/item?id=17877332](https://news.ycombinator.com/item?id=17877332), I'm having second thoughts as I don't want to mess things up. Also, I don't really need a stateless token just something that will allow for authentication from my server, Google OAuth and Facebook OAuth.

</comment></comment><comment><USER11> Use a session cookie.

</comment><comment><USER12> An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept.

Keycloak is nice but requires some work.

<comment><USER13> > An API Gateway is pretty Quick to set up, but the industry is moving away > from it as a concept.

Can you elaborate on this?

<comment><USER14> Seconded - I'd like to hear more behind your reasoning.

<comment><USER15> Third - I'm in the 'industry' and would like to understand that more.

</comment></comment></comment></comment><comment><USER16> Depends on your requirements...

Quick and easy: Look into Firebase.

Powerful/extensible: Django + DRF

<comment><AUTHOR> I would prefer a scalable solution. Go with PostgreSQL is my current stack.

<comment><USER16> huh?

<comment><AUTHOR> Sorry wrong wording there. I'm currently using Golang (so, no DRF) and I don't want to use Firebase. My question was if I just stored the session tokens in the Postgres DB, will it take a performance hit, or should I store them in an in-memory store like Redis or Memcached?</comment></comment></comment></comment>


Tesla's Fremont factory forced to shut down under shelter-in-place order - <AUTHOR> https://www.sfchronicle.com/business/article/Tesla-s-Fremont-factory-ordered-to-shut-down-15137774.php <comment><USER2> "Another email sent to a Tesla employee instructs employees who are following the shelter in place order to take paid vacation days for days they do not show up to work and to contact human resources if they run out of those days."

What the heck? It comes out of their vacation balance?

<comment><USER3> I believe that if a government mandates a shutdown of businesses, said government should pay for it. The employees directly that is, not the businesses.

Also, businesses should have enough savings to keep paying for all of their employees in a crisis like this.

The employees in turn have to remember they have the power. If they decide to just not return unless they get paid and their already scarce vacation days back, the company is screwed.

<comment><USER4> >The employees in turn have to remember they have the power.

not really. They aren't software engineers in high demand. An acquaintance works 2 jobs - he've got a family - one job is at Tesla, and now both of these jobs are off. There is some deep unjustice that the cost of all these lockdowns/etc. is paid by the most disadvantaged members of society while Mnuchin (who has a well established track of record of exploiting for personal gain the tough fate regular people fell into during a 2008 crisis) is going to get a $1T to use at his will.

<comment><USER5> This is what unions are for.

<comment><USER6> and militias

</comment></comment></comment></comment></comment><comment><USER7> I have never believed much in the Tesla bears but this is worrying. Without their main production and assembly facility open, they can't make money.

The factory in Nevada produces batteries and powerwalls.

The factory in China has reopened but its capacity is low and it's far away from their main markets in North America and Europe. The one in the Netherlands assembles cars based on components from the US.

This comes a day after they opened deliveries for what could have / should have been their next big cash cow, the Model Y.

<comment><USER8> Is anyone out buying cars at the moment?

Is anyone selling them even if they are?

<comment><USER9> I would imagine lots of people currently using public transport might be thinking their own car is a more reliable option than public transit which is probably about to close, or taxis which might stop operations.

<comment><USER10> Public transport users are probably more likely to buy a second hand car. They can sell it in 3/6/9 months for much closer to what they're likely to pay for it.

Alternatively, maybe they could borrow a car from a neighbour who is currently working from home.

</comment></comment></comment></comment><comment><USER11> Very misleading headline by the Chronicle. From the article:

> In an email obtained by The Chronicle, Justin Kirkland, a plant manager, > wrote to some Tesla employees at the Fremont plant Monday night that they > should report to work until they hear otherwise from the company.

> Another email sent to a Tesla employee instructs employees who are following > the shelter in place order to take paid vacation days for days they do not > show up to work and to contact human resources if they run out of those > days.

</comment><comment><USER12> Just like many others under the same order. What's the news?

<comment><USER13> Yesterday it was claimed that the Fremont factory would still continue to work unlike all the other factories because they got some 'essential job' exception. That was interesting news, resulting in some political complaining, and this reversal is news as well.

</comment></comment><comment><USER14> Guess the Chinese plant will have to pick up the slack, maybe permanently.

</comment><comment><USER15> Perhaps they can retool and crank out ventilator/etc parts

</comment><comment><USER3> Are other car factories forced to shut down as well?

<comment><USER16> Yes: [https://www.ft.com/content/dd76d42a-678b-11ea-a3c9-1fe6fedcc...](https://www.ft.com/content/dd76d42a-678b-11ea-a3c9-1fe6fedcca75) Getting new shiny car will be a problem soon.

<comment><USER9> Detroit will only close when the COVID-19 death rate eclipses the murder rate, and that's gonna take a while...

<comment><USER17> The murder rate isn't growing at 30% day-on-day.

<comment><USER18> It might when the economy completely collapses after people are forced out of work for weeks on end.

</comment></comment></comment></comment></comment><comment><USER11> I wonder what the cost-benefit analysis looks like for moving the plant to another state when they factor in forced shutdowns.

I imagine there are states that will be willing exempt them from forced shutdowns.</comment>


Ask HN: Who has experience of setting up / running solar farms? - <AUTHOR> I was listening to the below podcast and at 20 mins in the speaker brings up this "lenders are enthusiastic about lending to solar - its default levels are 0.0001% historically"  Now a business where capital loans are plentiful, the inventory just sits nicely in a field and you are selling what everyone everywhere wants seems a good business.  Especially if we throw in some fun optimisation
So what is wrong about solar farming - is it a ground level cash producer at low margins for the next decade? Or is there something I don't know ?
Pathways to Climate Security https://podcasts.apple.com/gb/podcast/war-studies/id402434575 <comment><USER2> There are a few cautionary tales: Around the turn of the century, Southern Company (Alabama Power) decided to be forward-thinking and put forward one of the first large-scale solar farms using unproven thin film technology, and took a huge writedown when the panels failed and underperformed in a few short years. So the first takeaway is that not all solar panels are created equal. Some have 30 year warranties and some last 30 years.

PV doesn't maintain itself. Some panels inevitably fail and need to be changed out. Weed control has to be put in place. Compared to, say, farming corn, PV is very low maintenance, but it's not zero-maintenance. So you need a staff to watch over it, maybe brush the snow off...

Another aspect is the question of land value. Land is not worthless, and if it's land that has other uses, PV panels might not be the best thing to put on it.

Non-PV (solar thermal) is a totally different animal, with severe issues with cooking birds, but the potential to provide dispatchable power well after the sun goes down.

The duck curve is also rearing its ugly head. California's about maxed out for PV capacity without running into constant wintertime power surpluses, where it better hope Arizona wants to get paid to take the noontime surplus. PG&E, S.C.Ed, and the other major California utilities need to figure out pretty quick that home-based PV needs to have governors to disconnect them from the grid at noontime when the grid is full, much as some require for air conditioners. Expect larger-scale and longer-term duck curve problems to start showing up as PV saturates.

<comment><AUTHOR> Duck curve sounds so much more dubious than swan neck or s-curve - I like it</comment></comment>


NSA Claims Surveillance Programs Aided Stopping Of 50 Attacks; Details Lacking - <AUTHOR> http://www.techdirt.com/articles/20130618/10230323518/nsa-claims-surveillance-programs-aided-stopping-50-attacks-details-lacking.shtml

<comment><USER2> I really dont like the idea that because some people may have been saved from death that trampling on peoples rights is ok.

How many people died for us to end up with these rights? Thousands? Millions? Tens of millions? So is it ok to dash away 4th amendment rights to save hundreds? Thousands?

It just doesn't seem fair to everyone who sacrificed so much before us.

<comment><USER3> >I really dont like the idea that because some people may have been saved from death that trampling on peoples rights is ok.

Isn't that exactly the argument inherent in gun control legislation?

<comment><USER2> Yes. I don't like most gun control legislation either. My only belief regarding gun control is that if we want to do it properly we have to repeal the 2nd Amendment.

<comment><USER4> This gets into the issue of where rights originate. Do they originate with the government (or its founding documents) or are they an integral part of being human?

<comment><USER2> I don't believe a right to bear arms is an integral part of being human. I think the 2nd Amendment has outlived its usefulness.

<comment><USER3> >I don't believe a right to bear arms is an integral part of being human.

Couldn't disagree more with this. I think the right to self-defense is very much and integral part of being human.

</comment></comment></comment></comment></comment></comment><comment><USER5> Watching this play out was painful, but as much as I like the comments about unicorns and being the Queen of England, for a moment let's assume that most or all of the fifty cases were real threats on some level or another, and this information played a role.

The problem that I see in the way these questions get asked or answered is in the speculation they leave up to the answerer to interpret. Asking the FBI whether an attack would haven't been thwarted if this tool didn't exist allows the FBI to answer from the imaginary perspective of having no tool at all. I feel like that's what we started seeing this morning.

It's a harder, longer conversation (than I suspect congress has patience for) to thoroughly evaluate whether alternative tools could have done the same job.

I also feel like we saw a very selective use of speculation. When asked whether this tool would have prevented 9/11 we got [paraphrased, barely] "We'll never know, but I can tell you this tool didn't exist back then". But when asked whether PRISM was essential in thwarting threats, or whether this leak has affected national security ongoing... the speculation was suddenly reasonable.

<comment><USER6> It is painful, and typically the reasoning for not revealing details is that it will compromise the method used to acquire said details. However that reasoning completely fails when the _point_ of the conversation is that we already know about how the information was acquired, so telling us what it prevented doesn't change the status quo.

<comment><USER7> I'm not all that interested in how the information was acquired, but metadata goes both ways. 'We acquired important information by reading ChuckMcM's HN posts' tips off other people involved in conversations with you such as FamousActress and myself, so open discussion of the details is tricky.

</comment></comment></comment><comment><USER8> If you watch the video of Alexander's testimony, he says "potential terrorist events" not attacks. So these could have just been meetings among people with fringe political views. I'm not buying it.

</comment><comment><USER9> _DETAILS LACKING_ is the key phrase here. Were these realistic attacks? Were the attackers being egged on the by the government?

Also, am I the only one wondering why the number of attacks that these programs supposedly stopped increases every few days?

<comment><USER10> Indeed. If there were 50 attacks like 9/11 that were only stopped because of this, I would have to sit back and think real hard about my stance about the fight against terrorism. On the other hand, if it was 50 attacks like the idiots who were going to destroy the Brooklyn Bridge by cutting the support cables with a blowtorch, then the program is obviously not even remotely worthwhile.

Of course, the lack of details gives us some details already. If it really was 50 9/11-scale attacks, they would have said so. That they have not said so tells us that these attacks were not important anyway.

</comment></comment><comment><USER11> I bet we could stop a lot more than 50 attacks if we gut the rest of the fourth amendment too.

<comment><USER12> That doesn't make sense, at least inside the US. If 50 were stopped, to stop a lot more than 50 (what, 100?), would require that many to have actually succeeded or going to succeed. There's no evidence of that.

</comment></comment><comment><USER13> How many attacks did they _provoke_?

How many people on the cusp of violent retaliation now feel justified to do what they only thought about before?

How many people who wouldn't dislike the U.S. will?

How many governments who would partner with the U.S. won't trust the country?

How much reason did they give people to hate them?

How much did they breach the Constitution and how is that different from anyone else doing it?

<comment><USER14> None. Look at all politically-motivated violent attacks that deliberately or recklessly affected civilians; all of them were done by people who would be uninfluenced by any detail of due process in the US.

No sane person tries to blow up an airplane over NSA surveillance.

I think James Clapper should be fired, that we need to reevaluate the FISA court system, and (most radically) that NSA needs to be transitioned back into a foreign intelligence agency and be firewalled off from domestic law enforcement.

I don't think we should try to get there by making arguments that 99% of Americans will immediately reject, in part because even people who are sympathetic to the problem of an overreaching NSA will disagree strongly with them.

<comment><USER15> >No sane person tries to blow up an airplane

You could have stopped there.

<comment><USER14> No, I don't think so.

<comment><USER15> Oh hey tptacek it looks like you've shifted your opinion on this whole NSA scandal a bit over the past couple days to be less skeptical and more in line with the rest of HN. Was there any particular story that made you change your mind?

<comment><USER14> My opinion hasn't changed at all. I don't want to make another thread about me, so if you have more questions, you can ping me via email.

</comment></comment></comment></comment></comment></comment><comment><USER16> I have 50 pink unicorns in this box. I can't show you because it would compromise their safety. I have them working on a cigarette that stops lung cancer.

<comment><USER17> Potentially pink unicorns, to be precise.

</comment></comment><comment><USER18> In the former communist block there was virtually no organized crime, except maybe some small time crime. The secret police had everything under a tight control, screening phone calls, mail etc. Indeed, it was a very safe place to live if you did not stand out from the crowd and did what was expected.

<comment><USER19> The organized crime in the Soviet block was put away but not eradicated ([https://en.wikipedia.org/wiki/Vor_v_zakone](https://en.wikipedia.org/wiki/Vor_v_zakone) .) Which, of course, resulted in a shitstorm after the collapse of USSR.

</comment></comment><comment><USER20> What set of facts would the NSA be required to show before those who oppose these surveillance measures in general start saying what the NSA has done is reasonable?

Is 50 threats stopped that wouldn't have been enough to justify the intrusion of privacy? Would 100? Maybe 1000?

<comment><USER21> In my book, there's no number.

The question assumes that this is all negotiable, that there's some level at which we should be prepared to surrender fundamental freedoms. I claim that no such value exists.

Since the primary source of these threats seems to be from militant Islamicists, it would seem that we could get some measure of safety from banning Islam from America. How many thwarted attacks should it take for us to toss out the First Amendment?

It's difficult to prove that somebody is conspiring with a terrorist organization. Surely the need to prove a defendant guilty before a jury, is opening the door for terrorist attacks. How many thwarted attacks should we expect before we're willing to discard the Seventh Amendment? Oh, wait, we've already done that one in Guantanamo. Maybe we are on the way...

<comment><USER7> _Since the primary source of these threats seems to be from militant Islamicists, it would seem that we could get some measure of safety from banning Islam from America. How many thwarted attacks should it take for us to toss out the First Amendment?_

Surely you've noticed that there's a small but vocal minority that is heartily in favor of this, along with things like militarizing the border with Mexico, rounding up 1--12 million illegal aliens, and so on.

<comment><USER21> Indeed. And I'm comfortable lumping those xenophobes into the same group as those who believe that we should throw out the 4th Amendment, and have already discarded the 7th (and chunks of several others).

<comment><USER20> Don't you hear yourself? You're as unreasonable as the people you deride...

<comment><USER21> Well, I guess that depends on what you consider "unreasonable". I'll admit to idealistic, resolute, and maybe even impractical.

But it's actually my point that it's the ideals that matter. We can never say that the ends justify the means, because there's never actually an end: time just keeps rolling on.

So tell me: do you see me being unreasonable in a _bad_ way? (This is a sincere question: what am I missing from my point of view?)

<comment><USER20> Okay, you do recognize it's not useful as a means of determining policy and legislation (practical).

That's fine. The world needs idealists, but you have to understand when you don't get your way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> "By your logic I could claim that this rock keeps tigers away." Lisa Simpson

</comment><comment><USER23> I'm sure the Stasi prevented a few heinous crimes in its day too.

</comment><comment><USER24> I wish somebody would leak the details on this too.

</comment><comment><USER25> How many people would have died in 50 years under a totalitarian surveillance state if this information didn't leak?

</comment><comment><USER26> "Trust us, we're the US government, what have we ever done to make you wary of that trust?"

</comment><comment><USER27> meh, all that data not a preemptive measure against terrorists but to blackmail ppl whenever necessary.

I know what u did last summer!!

</comment><comment><USER28> 50 is on the highish side of reasonable, seems like a good choice. still, i would've gone with a bazillion, just to really wow people.

</comment><comment><USER29> _NSA Claims Surveillance Programs Aided Stopping Of 50 Attacks; Details Lacking_

Yeah, I'm the Queen of England. Really, but details are lacking.

Sorry NSA but I am not buying it, some megacorp is worried about losing billion dollar checks from FedGov</comment>


Advice HN - <AUTHOR>

Background:
I am a engineer by background with a brief experience in web development [rails]. Based out of Mumbai, India. I have started a company here supplying cleaning goods[Air fresheners] to corporates and SMB's . I got the gig going for over one and half years. The revenue as it stands now is around 2500$ a month approximately.We do an Annual Maintainence contract of providing air fresheners.We are also on the verge of bringing out a new product in car air freshener segment.
Problem:
Now the issue is i am getting kicked out of this company and i do not hold any strategic advantages. I have improved on sales but i improved quite late. Now i have to look after operations and other tidbits.
Advice :
I dont know how to go ahead. I am in the late twenties but i have been doing work which does not contribute to my resume. I dont know what to chose next a job or to start a new company also so in which area. I do not have the money to do it. I have the motivation but i dont have the guidance. i need to make some money to make ends meet. I am not married yet. I will be tremendously grateful to know your views and take the necessary steps to go ahead. Thanks for giving the time to read. <comment><USER2> It sucks to be kicked out of your own co. chton here has given good advice. Hopefully you still have some shareholdings/vested interest, right? Maybe remaining founders/investors are interested to purchase your vested stake if you're in dire need of money.

If there's absolutely no way you can avoid being fired from your co then it's better to accept that fact rather than keep looking in rear-view mirror and postulate 'what-if' scenarios. Own it and proudly include it in your resume.

"Grew XYZ from zero to $N until I was kicked out by my board and learned a few imp business lessons" \- that's an experience most companies will value.

Since you're still in twenties, unmarried - you still have some time left on your side. Start hanging around on hackerearth kind of spaces where they combine hackernight kind of events with recruitment by actual startups if you want to remain on the tech path.

But looking at fact that you were able to sell airfresheners to SMBs (the toughest mkt) in Mumbai I'm sure you can sell pretty much any similar product to similar or (for that matter even same?) clientele. Enterpreneurship is 10x hard in India and so what you've achieved in oldschool product/mkt is no mean feat.

Is there anything that stops you from tapping in to your existing clients? If not, I'll suggest go back to purchasing managers of these SMB clients, be upfront & tell them you're out of your current co and ask them if there's anything else you can supply to them. If they were impressed by your capabilities/service in previous co, some of them will still like to have you around as vendor for a different product. Or maybe they can refer you to some other co. So take that up. Get some commitments, restart, bootstrap. But this time having learnt lesson from current misfortune, take care not to dilute so much that you lose controlling interest.

All the best.

I'm from Bombay. I'll gladly be your sounding board if you want to discuss any of this in-person. My email is in my profile.

<comment><AUTHOR> yes, you are correct. There is a bottleneck of how much i can grow hitting at individual clients as corporates. Also you are correct that i can add more products and supply those too in addition.

The market i am targeting is commercial and has a limit to how much i can grow and manage. But, I need volume to grow and probably move a brand to retail chain stores to actually be realise some good overall cumulative profits. Otherwise whatever i start, will be a small business and wont be able to become large over time. Even after this much time i still have no idea how to make this business grow to multi-city or state.

</comment></comment><comment><USER3> Assuming you still have good relationships with your customer base-- call each one individually. Explain that you are leaving the company and appreciate the business you did together.

Ask them two questions 1) Do they have any unmet needs for other products or services? 2) Might they be able to refer you to any friends or old colleagues who could use your help with sales/service/operations?

Do this and you will not only expand your network, but likely uncover several 'hidden opportunities'.

<comment><AUTHOR> that is great advice.

</comment></comment><comment><USER4> I'm sorry to hear you're being kicked out of your own company. That's never an easy thing to go through, but you'll pull through.

I don't think it's fair to say starting your own company doesn't contribute to your resume. You did things outside of your comfort zone, and learned a lot. I would be happy to write that kind of experience on my resume. Own it, be proud of it, and use that when looking for a new job.

If you're currently strapped for cash, kicking back or starting something new is not going to be an option. I would advise you to hit the jobs market again, and try to find a job you would like to do. With your diverse experience, that could be in engineering, web development, or management or team leading. Keep your options open, and apply for a lot. If there is a company that is doing it near you, maybe some form of evangelism would be a good combination of your sales and management skills with your engineering background.

Good luck!

</comment><comment><USER5> Do you like web programming? Could you get up-to-speed in it again quickly? If so, do that -- there's a world-wide shortage of competent engineers. Resume is irrelevant (and yours is fine anyway)

If you need a quick job, talk to your customers, and see if they have any openings.

<comment><AUTHOR> I do but i am not so good as compared to others. Also i can understand the parts quickly but i dont know i am good enough to make it commercially. I am at beginner's level of ROR i had made a small data management system and hostd it on heroku for my company.

<comment><USER5> You don't need to be better than anyone, just good enough to get stuff done. If you want to go this route, just spend a few hours every day building on Rails knowledge -- there are junior positions in the US -- I have to believe there are some in India as well.

Take a look at this: [https://rubysteps.com](https://rubysteps.com)

It was created for exactly your situation.

<comment><AUTHOR> Thanks for the link.</comment></comment></comment></comment>


The 'Oh, Shit' Moment When Growth Stops - <AUTHOR> http://a16z.com/2015/09/30/what-to-do-if-growth-stops/ <comment><USER3> > _But if the startup gods aren't smiling, and you can't either figure out the > cause and /or figure out how to correct it, it's time to start working on a > Plan B for the business. Plan B often includes kicking off a strategic > process that ends up in the sale of the company before it becomes as obvious > to others as it is to you that you've got a dying shark on your hands._

That sounds not entirely ethical / honest..

<comment><USER4> Dead sharks are worth a lot of money in the art world: [http://www.amazon.com/The-Million-Stuffed-Shark- Contemporary...](http://www.amazon.com/The-Million-Stuffed-Shark- Contemporary/dp/0230620590)

<comment><USER5> Perhaps a dead unicorn would have been even more noteworthy.

The original shark fell apart and had to be replaced, which added an amusing patina of involuntary performance art to that famously iconic work.

It's not known if the piece now includes an ongoing shark-replacement maintenance contract.

<comment><USER6> Yeah, he made one of those, too[0]

[0] [http://www.damienhirst.com/the-dream](http://www.damienhirst.com/the- dream)

</comment></comment></comment></comment><comment><USER7> If a business is not growing, but you're paying all the bills and still making money, why is that such a terrifying situation?

There are two reasons I can see for this fear. First, investors who are afraid to lose a lot of money that they put into the company. Second, leaders who are afraid to have to lay off a whole bunch of people because that's very painful. Are there other reasons that I'm missing?

Seems if you're bootstrapped and hire slowly, it's easier to keep balance in this situation.

<comment><USER8> Because, unless you're something like a utility that just keeps on chugging at a steady state, most large businesses _don 't_ just "steady state" \- they either grow or die, largely because some other competitor will grow faster and eat their lunch. Think of Yahoo - when they stopped growing it was largely because companies like Google and Facebook did a better job of attracting users.

<comment><USER7> To me your Yahoo example seems to prove the opposite of your point - <USER2> stalled and yet it didn't die. It not only employs thousands of people but also earns billions in profit.

<comment><USER9> It doesn't get much press, so in the metric that counts (VC availability bias), Yahoo died.

Microsoft's corpse has similarly been squirting billions of dollars of profit through its several layers of tombstones for decades now.

<comment><USER10> Confusion arises because who gets to say that's the metric that counts? What are your criteria for a business to be considered alive and healthy? Why are those your criteria?

Growth is not inherently positive, it depends on context. For example, if I tell you my cancer has grown 500% this year, it wouldn't be good news. And before you say this is a stretched analogy, it's not necessarily positive in tech either - if you're growing while bleeding money, all you're doing is bleeding more money. So how do you reach your conclusions?

<comment><USER11> Confusion arises for a lot of reasons, but cancer definitely isn't a useful analogy to discuss a blog post that starts "Most high-growth businesses..."

It's definitely the metric that counts for the kinds of businesses Andreessen Horowitz cares about.

Microsoft and Yahoo are particularly confusing examples, because they are both very large companies who enjoyed a lot of first mover advantage, but were started almost 20 years apart. And then ended up as very direct competition, before settling down as symbiotic partners. If you really want to use an example from biology, you should look at gut bacteria.

</comment></comment></comment></comment></comment></comment><comment><USER12> > So, when growth slows or stops, feel free to freak out.

Or you could just save yourself the mental angst and build a profitable, sustainable business that doesn't require perpetual growth to keep the wheels from falling off.

<comment><USER13> If you exit as a $10 billion unicorn, does it matter if the wheels fall off immediately after?

<comment><USER14> Aren't these called decacorns these days :)

It only matters if you have any morality since selling a company to investors for $10 billion when you know the wheels are about to fall off is not exactly the right thing to do.

<comment><USER13> I don't assume that you know the wheels are about to fall off, only that it doesn't matter to any decisions made prior to the exit.

Assuming a voluntary transaction, it is incumbent upon the investors to perform any due diligence they feel they are entitled to.

<comment><USER14> I would hope as a CEO you would know of something major like the wheels falling off immediately after you exit. If the event was truly unknowable before you exited then you are morally fine, but to knowing exit when you know there are serious issues is not fine.

<comment><USER13> One would hope.

As long as everything is fully disclosed, an investor may purchase without recourse.

For example, M. Cuban achieved a $1 billion valuation of a company on $3.1 million in revenue and $2.7 million in net losses. This was transformed into a $5.7 billion exit months later. Yahoo's market cap was then chopped down by about 80% over the next few years.

<comment><USER14> There is still a moral duty of care towards non-sophisticated investors. You can make an argument that an investor that buys a company knowing all the risks and who is able to rationally evaluate the risk is responsible for their actions, but many investors are not able to determine the risks involved.

<comment><USER13> An investor who cannot determine risks is not really an investor. More of a cash supply.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Dang, shouldn't this be pointed towards the original source?

[http://recode.net/2015/09/29/the-oh-shit-moment-when- growth-...](http://recode.net/2015/09/29/the-oh-shit-moment-when-growth- stops/)

Edit. It is interesting that market saturation is not raised as a possible cause.

</comment><comment><USER15> "Freak out", "Drop everything else", "Involve all the /key/ people", "Search maniacally for underlying causes" (scapegoat), "Assume the situation is self- inflicted", "search ... systematic[ally]", "Divide and conquer", "Consider a Plan B"

To my ears, all those phrases sound like "lay people off".

<comment><USER16> Getting rid of people would (or should) be the last thing on their minds. Reducing cost does not mean increasing growth. If anything, it further damages any chance to recover.

Now firing someone clearly and directly responsible for the reduced growth on the other hand...</comment></comment>