Ask HN: What to do in an equity disagreement in a startup - <AUTHOR>

(This is an anonymous account.)
I work with two other co-founders on a startup. We're angel funded, though our angel took an obscene amount of equity for the little money he put in (in the 10,000-50,000 range) due to something that happened before I started to work at the startup.
I joined after the first two founders, Austin and Michael, started to work on it. Michael recently quit another startup to work on this one. (these are pseudonyms.)
I joined as the developer/a bit of business. I was the sole developer and designer of the site, of course with Austin's and Michael's non-writing-code assistance. Both guys aren't MBA-touting douchebags looking for "a hacker to make their startup a success!" - they're very knowledgeable in technology and the web, as well as business/entrepreneurship.
I originally was to receive 20% of the company. However, Austin wasn't happy with receiving only 20%, and thus wanted 24%. That meant that my equity holding was going to be reduced to 16%. (We are incorporating soon.)
Michael's all for what makes everyone more motivated to work on the startup, and the team up to this point didn't have any major disagreements or conflicts.
I surely don't want to cause any conflicts at all, considering I'm the guy that recently joined. However, I think that I'm entitled to a bit more than 16%. 20% was satisfactory for me.
What do you think I do? Suck it up and accept 16% or try to receive more?
If you'd rather not comment here, shoot me an email at firstname.lastname@example.com.
Thanks in advance. <comment><USER3> I'd say that you haven't provided enough info.

Important data points include:

\- How long did they do the startup before you? Did they take more risk? Is anyone getting paid now? If they got it to the point of being angel funded, they've hit a milestone and might deserve a bit extra. I dunno why Austin would deserve more than Michael.

\- What do they do for the startup? Is Austin valuable? Experienced? Expensive? Incredibly knowledgeable about the market you're attacking? If he's verifiably badass and is critical to the success of the company, he might deserve more. If he's setting aside a $250k gig, he's probably risking more than you and might deserve more.

\- You're clearly valuable from a implementation angle... Is the startup solving a technology problem? Sure there's coding, but if you're building a niche CMS for dentists or something, technology isn't going to make or break you. Sales will.

On a higher level, my gut tells me that the team composition is off. Two guys who don't design or code and one guy (you) who does both? Totally depends on the type of business, but for many startups I'd wonder what they're doing all day for the first 3-6 months.

</comment><comment><USER4> I'm pretty amazed that after an apparent agreement someone would decide that you and him both getting 20% wasn't enough and he needed 24% at your expense.

That's a pretty ridiculous move for someone to make, in my view. It goes well beyond dollars and cents, I'd think. It's obviously not about the percentage points. Losing 4% isn't that big of a deal, and yet neither is gaining 4%. But asking someone who is roughly equal to you to accept this type of agreement isn't trivial. You should probably ask yourself why this person was willing to go through all this potential heartache including the personal issues such a move would cause for a measly 4%.

<comment><USER5> In addition, where's Michael's sacrifice? If he's all for "what makes everyone more motivated" he should be willing to give up 2% himself, along with you giving up 2%. Fairness is important.

In fact I'd suggest it as a way to keep negotiations going forward. You sacrifice,if and only if Michael sacrifices similarly.

</comment></comment><comment><USER6> Simply say that your 20% was already agreed to and that it's not negotiable. It seems to me (and of course, I can't know from short post) that Austin is negotiating for the sake of negotiating... maybe because he was taught to be a "hard charger" in business school? Regardless, you have already framed the situation as "try to receive more." No, you already have 20%, and now Austin wants 4% of your 20%. The answer is "no," unless you have something you want to "purchase" for your 4%.

<comment><USER7> This is pretty much what I'd do. You could also make it a test. Tell him you're not giving up any equity and see if he handles it in an ethical and respectful way. If he doesn't I'd walk. Not because 4% is that important, but because he's going to suck to worth with.

</comment></comment><comment><USER8> I don't have time to type out a long answer, so forgive me if this brief version comes off too harsh.

It seems like you haven't had a success yet with another startup, and a solid track record will, over time, be far more valuable than the 4% you're squabbling over.

Concentrate on making the company work (but also make it clear you don't intend to give up any more equity). Use this as a learning experience, and go into your next company stronger and wiser.

Given the very frail odds of success most startups have, it is likely not worth your time obsessing over this.

<comment><AUTHOR> Thank you. I haven't had enormous success with another startup, no. Definitely will take this into consideration. Thanks again.

</comment></comment><comment><USER9> If you're not getting paid, and the business is pre-revenue, you're a founder. You can build a track record with people who aren't going to dick you over. They're reneging now; they'll renege later.

</comment><comment><USER10> If they offered you 20% initially, they're obliged to give it to you. Once someone names a number, they have to stick to it.

</comment><comment><USER11> At some point, you need to be able to stick up for yourself and rationally discuss tough issues amongst yourselves.

If you can't stand up for yourself here, you should understand that this may lead to the future concessions based on a past history of being "easily swayed".

Discuss this with your co-founders and be open about the situation. Better to get past the tough inter-personal issues early, rather than later when it will become even more complicated and difficult to turn back on sunk costs.

</comment><comment><USER12> Any start-up with 2 business guys and change, and one hacker, isn't starting out very well.

Why don't you start a company and take 100% of the equity?

<comment><USER13> youre a moron. a bunch of hackers doesnt just make a company. if the team is well rounded, everyone has a specific role, then it's a strong company.

<comment><USER10> Please don't call people names.

<comment><USER13> I'm sorry, just irked me at the time. Like peter/webwright said, not enough info. No excuses, I messed up.

</comment></comment></comment></comment><comment><USER14> If there is a vesting period, perhaps negotiate that to be shorter. Often times a founders shares will vest over time, so that if you quit in a month you don't retain an inappropriate amount of the company compared to the effort put in. Since you are taking a 'hit', that could be a beneficial negotiation. Read the paperwork. Three times. Make sure you understand every sentence.

You are asking us because you feel like you've been taken. You were told (promised?) that you would get 20%. Now it's down to 16% because someone's a crybaby, and your the only one getting shorted.

There's simply no right answer about what to do. And that's the crappy part about starting a company. Sometimes the rules change. Sometimes people are mean. Sometimes you get screwed. Staying with the company could either be the smartest thing or the dumbest thing you ever do. You asked for advice, so your not 100% on staying. But that also means your not 100% on leaving. So you see potential.

If you really don't know, stay. If it's fun, keep going. If not, bail instantly. This is your 'get out of jail free with no guilt' card. Later on, if things are crappy, and you just want to leave, but everyone is depending on you to work for cheap and slug through it more, and you just don't see it going anywhere, or realize it's not fun, or it turns out these guys really are assholes (which hopefully would show itself sooner, if not now) and no, you don't want to spend every waking moment of your life with them, you can just quit.

</comment><comment><USER15> Don't look at it as losing 4%. Look at it as you are losing 20% of your stake (4/20). Are you willing to leave 20% of what you were originally supposed to receive to Austin?

Another point to consider: In the end, 4% worth of equity won't make or break anyone (unless it tips the balance of power), seeing as if the company is successful you will all be "rich" in some sense. The issue is not 4%, but working with someone who demands it, and demands it from you only it appears.

Why is Michael ok with Austin getting more than he is? Was the startup all Austin's idea? Did Austin contribute more? Is it all a seniority thing (Austin was there first, then Michael, then you)? Also, you never specified what Michael and the Angel's shares were. I'm assuming that the Angel got 40% while the three founders originally planned for 20% each.

I would stand my ground and say I was working for 20% + stipend and that's what I expect AND now that it was threatened I want it in writing before moving forward. It should take the 3 of you no more than 30 minutes to have a meeting to agree on it and write up a simple contract for each of you. Then again, contracts can be messy and you should cover your bases (what work is required of each of you, how long the contract is good for - <USER2> incorporation when a final contract is created I would imagine - and what happens is someone doesn't deliver). Sorry if that sounds like conflicting advice. Get a lawyer.

</comment><comment> puzzle-out This could be pure speculation, as I don't know the details, but it seems Michael messed up the negotiations with the angel, and is trying to rectify it by negotiating you down. I'm not a hacker, more the business person, and when negotiating with hackers I offer a relatively low equity stake, fully expecting to be pushed up - to invert this process like Michael, well, if you get close to an exit, make sure he isn't in charge of negotiations with the buyer.

</comment><comment><USER16> The best option for me is that both you and michael give up 1.5% to Austin(total 3%). And, tell him that both of you already lose 1.5% and he only losts 1% since he initially demands 4%(4-3=1). I think he will be satisfied with this option.

Anyway, I am more interested in knowing how this startup goes on with two business guys and one developer. Could you please update us more with this dummy account again? Thank you.

</comment><comment><USER17> I was involved in a much similar situation... a start-up with 2 business guys and 3 tech guys. The tech team was 3 not-yet-graduated students, and we were always suspicious of the business guys.

However things turn out, just be sure that your "%" is the same kind of "%" as theirs is -- if your shares get diluted, so do theirs. This way, all interests are aligned: you all have slices of the same pie, and work to make that pie larger.

From what you've posted, it seems completely unfair for the 4% to come from you alone. It should be diluted from the remaining 80% not owned by Austin, and it should be agreed upon by all that own that 80%. In other words, it shouldn't be Austin asking you for 4%, it should be Austin asking everyone involved for 4%.

Best of luck.

<comment><USER18> I advise you to consider dissolving your partnership as soon as you can.

I had once experienced a similar situation: The business guy, who had experience in SAP area (he was an expereinced SAP-Consultant) had come up with the idea of founding a new freelance job search site, me being the developer.

Having developed a nice prototype using the latest technologies and after we were ready to form the new company there surfaced an issue: He, the business guy said that he receive the %60 and me the %40. The reason was that he has the initial idea and he thought of the business model and the related intricacies and that he has employed all his vast (and past) experience on the target customers... and he wasn't far from truth at this respect...

However still, his wanting a marginal majority just didn't feel right, considering that both of us afforded the expenses without getting any income.

So my advice to you: When it just doesn't feel "right" then think seriously to drift apart. The numbers are just the indicators of the main purpose behind: They, the business guys want and will always want more than you as long as you are doing business "together"

And oh by the way, it doeesn't have to be running a startup , you could be doing business in other relationships, i.e. they or he might rent their office or home to you and in that case... you guessed it right: They would try to charge you as much as possible, so beware..

</comment></comment><comment><USER19> > This is an anonymous account.

> the first two founders, Austin and Michael...

It may be an anonymous account, but I hope you realize that you've just made an un-anonymous post...

>I originally was to receive 20%...

Lesson learned the hard way: at your next startup, don't do any work until this stuff is nailed down.

> I surely don't want to cause any conflicts at all

Wrong attitude. That's EXACTLY what someone who's trying to steal 4% of the company from you wants to hear.

> What do you think I do?

Determine your BATNA (best alternative to a negotiated agreement). Maybe that's bending over and taking 16%. Maybe it's walking.

Figure out what you want to do, then do it.

<comment><USER11> "Getting To Yes" by Roger Fisher [http://www.amazon.com/Getting-Yes- Negotiating-Agreement-With...](http://www.amazon.com/Getting-Yes-Negotiating- Agreement-Without/dp/0140157352)

<comment><USER20> As a sort of sequel to "Getting to Yes", I recommend Shell's "Bargaining for Advantage": [http://www.amazon.com/Bargaining-Advantage-Negotiation- Strat...](http://www.amazon.com/Bargaining-Advantage-Negotiation-Strategies- Reasonable/dp/0143036971/ref=pd_bbs_sr_1?ie=UTF8&s=books&qid=1222173243&sr=8-1)

</comment></comment></comment><comment><USER21> I am trying to reconcile "angel funded" with "we're incorporating soon."

Was Austin not happy with 20% or was he not happy with you and he each getting 20%? The difference between 20 and 24 (or 16 and 20 for that matter) is going to be hard to detect for the likely range of exits.

Also "not happy" before you've incorporated is not a good reason to change equity: you should have a rationale based on expected contribution and degree of risk (and/or whatever other factors you three feel are appropriate). But "I want more than you" is not a good discussion to be having now.

</comment><comment><USER22> You clearly don't have a written agreement about equity stakes. Otherwise you would be getting screwed in much more interesting ways. So it sounds like you don't have 20% equity you have 0% equity.

</comment><comment><USER23> Ask for 20% or even more. Ownership is not everything it is the ONLY thing! If you are the sole developer, a indispensable part of the startup, you should be able to get you fair share. Stop all work until you do.

Starting work before the official incorporation can be a good thing if you can show that you are a damn good developer. Having a mba degree and being knowledgeable in "entrepreneurship" and "technology" doesn't mean shit in this arena.

</comment><comment><USER24> are you getting a salary on top of equity?

<comment><AUTHOR> I received a small stipend in the low thousands area to start working on it.

Otherwise, no.

</comment></comment><comment><USER25> With whom was the arrangement that you get 20%? Austin, Michael, _and_ the Angel? Some subset?

If Austin agreed you would have 20%, but now wants some of that back, some options other than shifting the full 4% from you to him include:

\- be firm: tell Austin to stick to his agreement; dare him to leave. (If he quit another job, and is fighting for an extra 4%, he thinks the company is valuable. And even if they're great guys, does the company need two non-coders at this pre-incorporation stage?)

\- acquiesce but in an equitable fashion: agree that as a beautiful and unique snowflake, Austin deserves 4% more... but take it pro-rata from all other partners (including the angel if at all possible)

\- seek compromise: while asserting that the original 20% agreements for you and he _should_ stand, also say you respect his unique value, his longer tenure as a contributor, other opportunities he gave up, whatever in his mind justifies 24%. (Also, perhaps, that you've drawn a small stipend from invested funds while he may not have.) So offer to cede to him a _little_ of what he wants. At the smallest, this is 1% more for Austin taken pro-rata from everyone; at its largest this might be 2-3% from you given to him. If his real psychological need is just acknowledgment of his slightly-higher founder status, even a slight 1% bump may be enough to put the renegotiation behind everyone.

Also consider whether the level he's seeking, in combination with other owners, changes the possible majority-interest (50%+epsilon) coalitions. That may be the real agenda.

Sticking up for yourself is important so you are respected and fairly treated in the future. (It's also a signal that you highly value and are dedicated to the company, and can discuss difficult issues involving founder tradeoffs.) On the other hand, seeking a mutual compromise, if Austin does have any plausible claim to greater value/sacrifice/seniority, shows a willingness to be flexible in aligning interests. Just make sure if you compromise you earn some kudos for a being a team player who is owed some slack in the next dispute.

If negotiations get stuck, and the Angel is truly locked at their share, perhaps they can be a neutral mediator. Or maybe there's another person everyone trusts.

Usually, someone in particular is the de facto leader/prime-instigator/CEO. Whoever this is should nudge everyone towards a fair resolution (which might be 'live with the original split' if the original split was a firm and well- understood arrangement). Otherwise, this leader is abdicating their responsibility for establishing an environment of trust and predictability.

I've given Austin some benefit-of-doubt in the above options -- there legitimately may have been some tentativeness about the original split discussions, or some reason he has greater value and deserves greater equity. But if in fact Austin is the 'de facto CEO', I'd be more worried. This sets a precedent of him renegotiating to his own benefit, which could turn toxic down the road.

</comment><comment><USER26> One designer/developer, 20% equity down to 16%, doesn't want to make a fuss and still likes and is impressed with them and believes they are all for what makes everyone more motivated.

 _they're very knowledgeable in business/entrepreneurship._

They sure are.

 _However, I think that I'm entitled to a bit more than 16%_

Entitled how? It's an agreement - whatever you can all agree with.</comment>


A bunch of NYC startups are having an open house June 10th - <AUTHOR> http://walkaboutnyc.com/

<comment><USER2> Walkabout is upon us! 84 startups are opening their doors to visitors today. This is way bigger than last year's Walkabout.

</comment><comment><USER3> Reminder, this is taking off tomorrow at noon. Over 80 companies are involved!

</comment><comment><USER4> This is going to be a great event! If you are in New York, check it out.</comment>


Crucible - <AUTHOR> https://en.wikipedia.org/wiki/Crucible_(video_game) <comment><USER2> The Steam reviews are... pretty harsh. [https://store.steampowered.com/app/1057240/Crucible/](https://store.steampowered.com/app/1057240/Crucible/)</comment>


What is Reddit Announcing Tomorrow And Why Is A Penguin Involved? - <AUTHOR> http://www.techcrunch.com/2008/06/17/what-is-reddit-announcing-tomorrow-and-why-is-a-penguin-involved/

<comment><USER2> I think it is pretty obvious: Reddit is releasing their own distro, where users can mod portions of the system up or down. On most systems this means you'll only be allowed to edit in vi or emacs (sorry pico!). Of course, that could change daily as opinion shifts. Oh, and an hourly cron job will come standard that will remind you to support Ron Paul and/or Dennis Kucinich.

</comment><comment><USER3> Or people can just read the actual blog post:

[http://blog.reddit.com/2008/06/in-san-francisco-this- wednesd...](http://blog.reddit.com/2008/06/in-san-francisco-this-wednesday- night.html)

<comment><USER4> and the reddit page says nothing about it being "invite only" like the TC page says. Maybe the writer just thought he was special?

</comment></comment><comment><USER5> I don't care anymore. Since they rolled out the new look, I quit reddit. Best of luck to them.</comment>


The Ten Commandments for Business Failure from the Man who Gave the World New Coke - <AUTHOR> http://www.bigwinner.org/2008/08/04/the-ten-commandments-for-business-failure-from-the-man-who-gave-the-world-new-coke/

<comment><USER3> The point of New Coke was to erase the taste of Coke from the memory of the consumer. What we have now is not Old Coke but in fact New New Coke - <USER2> to the original but made with cheaper sugar.</comment>


Today's Solar Eclipse: Live Video - <AUTHOR> http://events.slooh.com/

<comment><AUTHOR> This is my second attempt to submit. The video feed is not working well on my Android but the Huffington post link showed up dead. I assumed that site is blocked by hn but I don't actually know. I am just shocked that no one else has submitted anything on this (at least not that I can find).

Edit: I will add that eclipses typically show up in pairs, one solar (new moon) and one lunar (full moon). This is one of three. There was a lunar eclipse late last month and another coming up later this month.</comment>


New Zealand Man Gets 21 Months for Sharing Video of Christchurch Attacks - <AUTHOR> https://www.nytimes.com/2019/06/18/world/asia/new-zealand-video.html <comment><USER2> > The man, Philip Arps, had pleaded guilty in April to charges of distributing > objectionable content. In addition to sharing the gunman's video online, Mr. > Arps sent a copy of it to be doctored to look like a first-person-shooter > video game, featuring cross hairs and a body count.

> Mr. Arps had told the police that he thought the Christchurch massacre was > "awesome," and he had likened himself to Rudolf Hess, the Nazi deputy to > Hitler who tried to negotiate peace, reported Christchurch Court News.

21 Months well earned if you ask me. I hope he loses the appeal.

<comment><AUTHOR> We now imprison people for having objectionable beliefs?</comment></comment>


Ask HN: What are the most useful bookmarklets you use? - <AUTHOR>

<comment><USER2> "Edit this page" bookmarklet is the most useful bookmarklet that I use: [http://downloadsquad.switched.com/2008/07/08/edit-this- page-...](http://downloadsquad.switched.com/2008/07/08/edit-this-page-useless- but-fun-bookmarklet-lets-you-edit-any-we/)

</comment><comment><USER3> Readability</comment>


KwickBox - <AUTHOR> https://kwickbox.intuitive-web.co.za/ <comment><AUTHOR> KwickBox is a digital platform which allows users to create their online CV website, track when it has been viewed, by whom and where. I'm looking for feedback on the UI/UX and general comments about the usefulness of the app</comment>


PlayStation Joins Forces with the United Nations to Combat Climate Change - <AUTHOR> https://blog.us.playstation.com/2019/09/22/playstation-joins-forces-with-the-united-nations-to-combat-climate-change/ <comment><USER2> Despite being an avid gamer, this looks to me like Philip-Morris teaming up with the American Cancer Society to fight lung cancer or Coca-Cola working with the AMA to fight obesity.

Considering the electricity used to play games, to say nothing of the waste generated by the endless upgrade treadmill, I'm shocked that nobody attacks gaming and gamers for contributing to climate change.

If gaming contributes to climate change, then Sony is part of the problem. Nothing will change that.</comment>


One way to fix your rubbish password database - <AUTHOR> http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish-password.html

<comment><USER2> Is there a security disadvantage to taking the MD5 hashes you already have and running those through bcrypt? It seems like that would let you get to a salted bcrypt implementation in one day as opposed to waiting for all your users to log in. Perhaps you could do the mix (md5 + bcrypt) until the user logs in and then switch them solely to bcrypt?

<comment><USER3> No. I don't believe there's any disadvantage to this. An MD5 hash is a 128 bit random number; it's 16 fully random characters, better than almost any human password.

<comment><USER4> An MD5 hash is not a random number; it is generated from some text string. It's possible that bcrypt(salt + MD5(text)) opens you up to collision attacks that are not possible with bcrypt(salt + text). It seems unlikely that it would open you up to attacks that are not possible with md5(text) but MD5 is not a random number so I'm not too sure.

<comment><USER5> I'm still trying to learn this stuff, but I do not understand fundamentally how bcrypt(salt + MD5(text)) could be worse than bcrypt(salt + text). What if everyone's plaintext password was already a string of characters identical to some MD5(text)? If bcrypt(salt + MD5(text)) could be bad, then doesn't that mean bcrypt(salt + text) could be bad too?

<comment><USER6> If you compose hash functions, you get the union of possible collisions.

Let's say that "foo" and "bar" are two distinct passwords that have the same MD5 hash. Then bcrypt(md5("foo")) == bcrypt(md5("bar")), regardless of how bcrypt("foo") compares to bcrypt("bar"). By pre-hashing with MD5, you have added possible collisions that weren't there previously, and those collisions remain regardless of how many more hashes you pile on top.

<comment><USER7> We're not pre-hashing with MD5. The MD5 was already there. It's the only source text we have. The proper comparison here isn't MD5+bcrypt vs. just bcrypt — it's MD5+bcrypt vs. just MD5. So any collisions that MD5 causes are immaterial — they'd be there either way.

It seems to me that the most obvious problem is that you get two chances at colliding — once with MD5 and once with bcrypt. But bcrypt is not known to be especially vulnerable to collision attacks, so this setup is probably not noticeably worse than MD5 alone. But that's just looking at probabilities — I ain't no fancy crypto expert or nothin', so there might be much more subtle vulnerabilities than the added chance of collision.

<comment><USER6> > _It seems to me that the most obvious problem is that you get two chances at > colliding_

Yeah, that's all I'm saying. I was answering a question about being "fundamental worse," and fundamentally, there are now two sources of potential collisions instead of one. In theory, that's twice as insecure! However, the practical effect is unlikely to rise above absolute nil anytime soon.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is a good step, but unfortunately all of the actual passwords are still out there, so they need to be changed.

I think a better idea would be to establish an easily implemented pattern for "password bankruptcy" that companies could follow in the case of a leak.

<comment><USER9> What would a password bankruptcy pattern look like?

One thought is to invalidate all passwords and fall back on email password recovery when a login is attempted.

This leads me to an idea I've tried once - if access to the inbox is equivalent to password credentials, why not use an email to login? By this I mean the web site login is a single field - email address. The system emails a one-click-login URL to the user that can be re-used (possibly with a month expiration time). The user can look up the URL in their inbox when they want to login again, or use a long-lived cookie.

<comment><USER10> Emailing a link to login was one of two supported login methods for redhats mugshot social network. The other was sending the link via xmpp.

In practice I end up doing this for little used sites because I use either my phone, tablet, and two laptops for browsing the internet.

It's annoying if you work somewhere that doesn't allow access to personal email accounts and you want to log-in to something.

</comment></comment></comment><comment><USER11> Even if you run a bad codebase that just uses unsalted MD5 and you don't want to add a new crypto algorithm:

Couldn't you just run your whole database through X more rounds of MD5 and do the same in your authentication function?

That way, script kiddies couldn't use precomputed rainbow tables they downloaded somewhere off Bittorrent.

Each additional round will also reduce the speed of a brute force attack while still keeping the changes to the codebase will be pretty small.

Unless there are rainbow tables for a certain number of MD5 iterations, it would be a start...

<comment><USER12> I think the conventional wisdom is that you should not re-invent security. I am slowly learning this, but the give-away seems to be questions that start with "Couldn't you just..."

<comment><USER11> It also was conventional wisdom that banks were too big to fail ;)

Are there any actual arguments against using this as an 'easy' fix to the precomputed rainbow tables scenario? Multiple rounds of a cipher seem to be a relatively common operation in crypto and have helped other old ciphers. One of the more prominent ones would probably be the move from DES to triple DES.

I guess dictionary attacks on GPUs would still be easy enough, even with more iterations, but anything that isn't directly in a dictionary might benefit quite a bit from multiple iterations.

It's not as good as actually using proper crypto rather than hashing algorithms that were designed to be fast, but it seems like an easy to implement low-risk solution.

<comment><USER12> I am no security expert. I can't tell bcrypt from a hole in the ground. All I know is that it's all fun and games until there is a problem with this home- brew implementation and then it's too late. That is why I think it's best to avoid anything like this and instead go with bcrypt/scrypt, etc. and re- evaluate periodically based on latest industry standards. Perhaps an actual security expert on here can evaluate your idea. I seem to remember it being raised many times on here, so there may be an answer to this on one of the discussions of bcrypt vs scrypt or some such.

</comment></comment></comment></comment><comment><USER13> Isn't the fact that s/bcrypt is by design costly preventing this idea from being executed?

<comment><USER14> Assuming you use 0.01s per hash settings, you can upgrade somewhere around a million accounts per hour.

</comment></comment><comment><USER15> I'll admit, I must be the only one that doesn't quite get the jump from step 4 to step 5.

In step 4, we make the assumption that their API is out in the wild, in use, and sends the md5(s, p) in the request. I get that we take that value, run it through scrypt and match against our stored value to authenticate. So the database has:

        scrypt(s', md5(s, p))

No problem authenticating the API requests with that.

Step 5 says once the user logs in with their actual password, we update entirely to the new scheme of scrypt(s'', p) and store just that. Now the database only has:

        scrypt(s'', p)

But the API user still sends md5(s, p) to authenticate, right?

So then what happens when that same user goes back to the API-using app? It's still uses the API so it'll send the MD5(s, p) and fail since we've discarded the transitional scrypt value when they logged in via the web interface.

Is there a deprecation period that supports both types while API using apps updated to a new API for the new scheme?

<comment><AUTHOR> Should have made clear that you can't do 5 if you need 4.

<comment><USER15> Ah, okay. So step 5 is the else condition from the "if" that begins step 4. At least, until the API is upgraded to the new improved edition and most/all API apps are using the new version.

</comment></comment></comment><comment><USER16> Okay, I must really be missing something here.

If your original database contains a bunch of unsalted SHA1 (or worse, MD5) hashes, what good does securing the hashes themselves do if the means to generate the corresponding plaintext has already been released into the wild?

Someone please tell me I'm missing something obvious.

<comment><USER17> It's how to fix _your_ rubbish password storage, not LinkedIn's or the others who've been compromised. That's the difference.

</comment></comment><comment><USER18> The article states that LinkedIn was using salted SHA-1 hashes, but I thought that wasn't the case. Either way, aren't salted hashes essentially uncrackable by all means except full out brute force?

If my password is "password", and I change it to "#b1@password%3dy", and then hash it, isn't it secure from basic dictionary/rainbow table attacks?

I'm a bit new to cryptography, so please forgive me if I'm not understanding some of this correctly.

<comment><USER12> Brute force is sometimes all you need. The problem is that using GPU's you can compute so many hashes a second that a short password simply cannot withstand such an attack for long. The salt helps a bit, but if someone is brute-forcing the hashes all it means is that once they have your password they don't have the other person's who happens to use the same one.

<comment><USER18> I see, but isn't brute-forcing "aecd8c83718c381cpassworda3802..." going to take far, far longer? Even on some huge botnet clusters, I still don't imagine how it could be possible to crack that very quickly.

<comment><USER12> Oh, of course. But it will still take less time than you think. After trying a common dictionary the attacker just starts brute-forcing every single combination and since md5 is so quick and works so well on the GPU that it may take mere hours to find the answer. I've personally had what I considered a secure password cracked out of a sha1 + salt setup. Now I use LastPass and generate random different 32 character passwords for every service I use. LinkedIn leak does not affect me: 32 chars is enough to give me a day or two to change my password and none of my other accounts are compromised even if the attacker gets my LinkedIn password.

<comment><USER18> Okay, thanks for the answer. I was under the impression that brute forcing takes a long time.

</comment></comment></comment></comment></comment><comment><USER19> On step 3, where you say "scrypt(s'i, md5(si, password))", don't you actually need "scrypt(s'i, md5(s0, password))", where s0 is the original salt? In other words, you still need to know the original salt you were using to successfully migrate.

Therefore, if you are storing the per-user salt as the first bytes in the hashed password field, then you have to be careful when you "throw away the old weak hash hi and forget it ever existed."

<comment><AUTHOR> The original salt is s_i which you do need to keep around. The new salt is s^'_i.

<comment><USER19> Ah. my mistake. I completely missed the "'" as I was reading it.

</comment></comment></comment><comment><USER20> If I'm not mistaken, the first paragraph is wrong. All signs point to LinkedIn having used _un_ salted hashes.

<comment><USER21> According to their statement, they started salting some time recently. I guess you got a salt when you next logged in?

</comment></comment><comment><USER22> I used this strategy years ago (2002) to migrate plaintext passwords in a site with 50k+ users. In fact, I built this into the system so I could do arbitrary migrations between password encodings whenever I felt it was necessary.

It works well.

<comment><USER12> Ruby and Django could do well to have this type of strategy baked in. This way you update your configuration and the passwords are immediately upgraded.

</comment></comment><comment><USER23> I was just doing a write up on swapping auth back ends to gain more security [http://schneems.com/post/24678036532/zomg-my-passwords- are-i...](http://schneems.com/post/24678036532/zomg-my-passwords-are-insecure- now-what).

</comment><comment><USER24> > 4\. If, like last.fm, you were also allowing third-parties to authorize > users...

... then you should stop doing that and you should start using OAuth, so the client application never sees your user's password.

<comment><USER25> Theoretically, sure. But I can't think of a nice way to authorise users on something like [1]. They'd then need a computer with the radio to provide some kind of access code, I guess?

[1] [http://www.robertsradio.co.uk/Products/Internet_radios/STREA...](http://www.robertsradio.co.uk/Products/Internet_radios/STREAM83i/index.htm)

<comment><USER26> One time passwords (feed the radio your generated password & let it use that to negotiate authorisation/api keys).

</comment></comment></comment><comment><USER27> I always wondered why people don't just use rainbow tables to get all the raw passwords, and then hash them with the better algorithm. The ones that are left, you just change upon login.

</comment><comment><USER28> Here's a worked example of a similar technique I wrote up ages ago:

<https://gist.github.com/1051238>

</comment><comment><USER29> Did you get that from here?: <http://news.ycombinator.com/item?id=4078751>

<comment><AUTHOR> No, I asked a question yesterday about this (<http://news.ycombinator.com/item?id=4080823>) and spent a long time thinking about it. Great minds...

<comment><USER29> Yeah, I guess it's not that amazing a coincidence... Most people would arrive at that.

<comment><AUTHOR> A more fun instance of this sort of thing on HN is when I suggested that HN might be attackable because of a flaw in random number generation and then someone else who hadn't seen my suggestion went ahead and did it.

Me mentioning it: <http://news.ycombinator.com/item?id=596126>

The attack: <http://news.ycombinator.com/item?id=639976>

<comment><USER30> That was an absolutely amazing hack

</comment></comment></comment></comment></comment><comment><USER31> The variable names in this article are throwing me off. Is there a special significance to the subscripts and superscripts in the variables?

<comment><USER32> The subscript i denotes that the variable belongs to a single user i. The tick at the top is pronounced 'prime' and is used to differentiate between versions or iterations.

<comment><USER33> Is that called "prime" by most people? I've always heard it just pronounced "dash", as in "s-dash" or "f-dash".

<comment><USER34> >Is that called "prime" by most people?

yes.</comment></comment></comment></comment>


Firefox add-ons for Web developers - <AUTHOR> http://news.cnet.com/8301-17939_109-10217887-2.html?part=rss&tag=feed&subj=Webware

<comment><USER2> Also worth knowing about is Microsoft's attempt at a Firebug clone: IE Developer Toolbar.

[http://www.microsoft.com/downloadS/details.aspx?familyid=E59...](http://www.microsoft.com/downloadS/details.aspx?familyid=E59C3964-672D-4511-BB3E-2D5E1DB91038&displaylang=en)

<comment><USER3> If you're working with IE Firebug Lite is also worth knowing about: <http://getfirebug.com/lite.html>

</comment></comment><comment><USER4> Anybody know of a plug in to tell if there are mismatched tags on a page? I can't seem to find one for firefox, my iPhone does it nicely in the error console :(

<comment><USER3> I don't know if the Firefox Error Console handles it (it detects CSS and JS errors fairly well) but the Web Developer toolbar has a shortcut to validate the current page.

</comment></comment><comment><USER5> I used to use Aardvark a lot, but I've found that Firebug basically completely supersedes it now. There used to be room for both, but I haven't used Aardvark in more than a year now.

<comment><USER6> I think Firebug replaces half the plugins he lists. Aside from it, the only other useful ones are color picker, web developer and yslow.

<comment><USER7> I just use digital color meter (mac) or colorpix (windows) instead of colorpix. Less browser overhead :-)</comment></comment></comment>


Wan Gang pushed China to leapfrog the West in electric vehicles - <AUTHOR> https://www.bloomberg.com/news/features/2018-09-26/world-s-electric-car-visionary-isn-t-musk-it-s-china-s-wan-gang <comment><USER2> [https://twitter.com/GeorgStieler/status/1075195222953349120](https://twitter.com/GeorgStieler/status/1075195222953349120)

</comment><comment><USER3> Well the US is out: climate change is a hoax and the EPA is being silently murdered. No sense of urgency there.

</comment><comment><USER4> yeah, I'll believe it when I see it on the road. People forget that making a car suddenly doesn't get easier because you no longer use a combustion engine, there are dozens of established car manufacturers that are moving in.

It took the Koreans over 40 years to finally achieve competitiveness and quality. The road for China will be even tougher.

<comment><USER5> I think the more important point from the article is that China backed EVs big time and it is beginning to pay off. Not a lot of other governments made such forward thinking bets 20 years ago.

It's now a matter of 'when', not 'if' in China's case.

Here in India, we get random murmurs about EVs from the government, but no concrete action. There is just a single crappy EV model on the market, no charging network, and no infrastructure investment

</comment></comment><comment><USER6> The article is very light on actual useful technical information, and just tries to sing blind praises to that one guy who politically helped China think about electric vehicles.

It is good for the world that growing china uses new electric vehicles instead of gas guzzlers. But, the article fails to corroborate how the Chinese would be able to even compete in the global market. True, the Chinese already has the Chinese market. Considering the way their government works, that's a easy act.

Comparing indigenously built electric vehicles from China with globally acclaimed engineering prowess of Tesla is just silly at this point.

Are the Chinese cars superior to a Tesla in any way? (No details)

Are they better quality than Tesla in any way? (personally, I would be very skeptical)

Are they safer? Teslas keep scoring the best in crash tests. I can't find any data on Chinese cars..

When they start competing genuinely on technology, perhaps they may warrant a serious comparison. Not now. They don't deserve it.

<comment> bjelkeman-again We used to laugh at "Made in Japan." Then they became really good at consumer hardware (cameras, music, cars, TVs). China manufactures some of the most sophisticated hardware in the world (smartphones, tablets etc). They do learn and iterate fast.

The one thing that makes me wonder if they can make really good electric cars is the software side. Japan fell from the throne in consumer entertainment hardware as they didn't do software well. They still don't. I think electric cars is a lot about software and batteries. Can China do really reliable, trustworthy, user friendly software? Without it I predict their cars will struggle.

<comment><USER7> >Can China do really reliable, trustworthy, user friendly software?

You should try WeChat, the most popular Chinese chat application. Apart from the legally-mandated spying, it's super user-friendly, and quite lightweight compared to the likes of MSN Messenger, Skype, Facebook messenger and Slack (uses only 10s of MBs of ram).

<comment><USER8> You're comparing it to old junk. Whatsapp is far superior to FB Messenger. Discord is far superior to Skype, etc.

<comment><USER7> Does Whatsapp even have a desktop client? It didn't last time I checked. And Slack isn't "old" junk.</comment></comment></comment></comment></comment>


How Google Pagespeed works - <AUTHOR> https://calibreapp.com/blog/how-pagespeed-works <comment><USER2> > In July, the SEO ranking algorithm was updated to include page speed as a > ranking factor for both mobile pages __and ads __.

What's one supposed to do when PageSpeed only points to Google's own asset delivery services as being "the" big problems which cause a lower score?

\- "serve images in next gen formats" \- complains about images served from tpc.googlesyndication.com

\- "efficiently encode images" \- same as above

\- "reduce javascript execution time" \- cdn.ampproject.org; securepubads.g.doubleclick.net; www.googletagservices.com

.. ?

I can easily get rid of those issues, "simply" by not showing any ads. The site will then be really fast, and... I'll get the ability to display ads again?!

Shame the ad-related revenue will be 0, which isn't unfortunately a good thing for the site.

Why is Google themselves not doing things "right" in order to ensure a speedy execution?

A while back, one of the reasons for a low score was that the GPT.js code (required to show ads) had a short expiration time. Dammit. How am I supposed to fix that, Google?

<comment><USER3> The left hand does not always know what the right hand is doing in large corps. I'm assuming the SEO team is not in daily contact with the ad delivery team(s). The SEO team is just reporting on what they how they are seeing the page load without concern for where the slowdowns occur. It is quite funny/sad/ironic that it is within the same letters of the Alphabet that are the problem.

I had the same experience with Apple when the iTunes team were invalidating ProRes files created from Final Cut Pro.

<comment><USER4> > The left hand does not always know what the right hand is doing in large > corps.

On the other hand, it's a _good_ thing to not give a free pass for bad behavior in products you produce.

</comment></comment></comment><comment><USER5> It's hard to take this blog post seriously when there is not one but THREE open Github issues which poses a serious question about the credibility of this whole pagespeed circus. It's just fundamentally wrong to claim that pagespeed speed score is based on the Lighthouse speed score when hundreds of people are reporting otherwise and even Lighthouse is suspiciously silent on this matter.

<comment><AUTHOR> Hi, I'm the author :-)

I've left significant levels of details about pagespeed on the lighthouse issue tracker over the last few months. It's really frustrating to see the lighthouse team being blamed for something that isn't operationally even theirs… but that's a big company for you.

The biggest contributing factor to unstable pagespeed scores is the power of the machines that do the tests. Last time I checked the scores / bench mark scores for pagespeed were all over the place. … All the same, it's really important to understand how it all works. Hopefully the post had something for you?

</comment></comment><comment><USER6> > The speed of your site on mobile will affect your overall SEO ranking. > If > your pages load slowly, it will reduce your ad quality score, and ads will > cost more.

We've deliberately excluded mobile devices from our ad campaigns. Do I understand correctly that even though we do not serve any mobile visitors at all, we're still judged by the page speed of the mobile page, not just the desktop one?

<comment><USER7> >we do not serve any mobile visitors at all //

How is that possible, if people know your domain name they'll type it in to their phone/tablet/watch/gamepad (or search from their shared history, or whatever). Do you reject connections that indicate they're from non-desktop devices??

I can see "we don't target mobile" but users don't often care what you're targeting and to my surprise recently I had to review mobile usage and found that it's higher in general than desktop across the board and my sites (small local websites and personal sites, mind you) followed that trend.

<comment><USER6> These are adwords landing pages. We're in super MVP-mode, trying to establish some contacts with potential customers, they leave behind an email address, we set up a call, etc.

I understand what you're saying, but we can literally see from Google Analytics that we have 0 mobile visitors. As would be expected.

It just seems weird for being judged by our mobile experience in this case, but it would good to know if this were the case.

<comment><USER8> > we do not serve any mobile visitors at all

> > How is that possible

> These are adwords landing pages. We're in super MVP-mode

In your specific case, google pagespeed ranking is probably irrelevant.

If you truly have 0 mobile visitors, and these are just adwords landing pages, then people are probably not "Googling" your company, so search ranking is probably totally irrelevant at this point too.

<comment><USER6> As far as I understood from the article, it also impacts the adwords quality score. Or did I misunderstand this?

<comment><AUTHOR> That's what I took from it yep.

</comment></comment></comment></comment></comment></comment><comment><USER9> Too bad Google's own page describing Pagespeed and Lighthouse fares abysmally on their own tests. ([https://imgur.com/a/56FVOwK](https://imgur.com/a/56FVOwK))

I'm sick and tired of Google playing the role of the global regulator of what's acceptable and what's not. Not everyone can afford own data centers and CDNs to serve content. Not every single page can benefit from SSL.

And web's not the only area they are regulating through monopoly - the number of hoops one has to jump through these days to run an e-mail server, just to have its e-mail acceptable by the holy Google e-mail servers is silly.

<comment><USER10> > Not every single page can benefit from SSL.

huh?

<comment><USER11> You don't need "SSL" (TLS, https, etc.) to serve static, uncontroversial content

<comment><USER10> That's absolutely untrue. For example a man in the middle could intercept and modify the page.

[https://www.troyhunt.com/heres-why-your-static-website- needs...](https://www.troyhunt.com/heres-why-your-static-website-needs-https/)

<comment><USER11> This was a good article, I concede the point.

</comment></comment></comment></comment></comment><comment><USER12> Nice article, but is it just me that thinks it is weird that Google ranks better the pages that are speedier in _their_ browser?

Antitrust here?

<comment><USER7> This is curious, I'd like to see some study on this point but do you think that the ranking would vary a lot depending on which browser was used to provide the small speed related element? Any anecdotal data about sites that are super slow on Chrome but blazing on other browsers?

<comment><USER12> Just that the rank criteria is how fast it is in Chrome. Some of the micro benchmarks, like Time To Interactive, looks really browse dependent.

</comment></comment></comment><comment><USER13> Reading the definition for TTI is also helpful in narrowing down your page speed problems: [https://github.com/WICG/time-to- interactive#definition](https://github.com/WICG/time-to- interactive#definition)

Also this seems like the right time for me to brag about the impact we were able to have on our site's responsiveness. I know a lot of people will think a lot of this is BS being pushed by Google, and I agree in some cases, but overall our site is incredibly fast now (perceptively, significantly faster), and that's thanks to Lighthouse and its suggestions.

This is without HTML caching, so still some room for improvement :) [https://i.imgur.com/d7KCTmj.png](https://i.imgur.com/d7KCTmj.png)

This is a full Vue SPA with chunking enabled.

Edit: oops, I was behind a VPN when I ran the test which impacted my ping. All metrics are down to 0.3s max :)

</comment><comment><USER14> It's astounding to me that web development is in such a state that it takes google dinging placement for people to start thinking that speed is important.

Speed is a feature. Speed is your most important feature. It's a gazillion times more important than all the other cool features that developers and product managers think are important.

<comment><USER15> But react is all I know how to write...!

<comment><USER16> React doesn't make your site slow.

</comment></comment></comment><comment><USER17> > In July, the SEO ranking algorithm was updated to include page speed as a > ranking factor for both mobile pages and ads.

July 2018, according to both linked sources.

</comment><comment><USER18> If the weight of "Estimated Input Latency" is zero, why is it even mentioned?

<comment><AUTHOR> Because it's in the code and it's factually correct. It felt weird to not mention it!

</comment></comment><comment><USER19> Hi, do you have any figures for this subject? >If your pages load slowly, it will reduce your ad quality score, and ads will cost more.

Thanks.

</comment><comment><USER20> You can check for the page speed user agent and do some optimizations to satisfy it.</comment>


Tech Workers Get Choosy About Changing Jobs - <AUTHOR> http://www.wsj.com/articles/tech-workers-get-choosy-about-changing-jobs-1458086282 <comment><USER2> > The average pay for tech jobs in the San Francisco and San Jose metro areas > was $197,411 in 2015, according to labor-market analysis firm Economic > Modeling Specialists International. The average value of equity stakes held > by engineers, product managers and data scientists was $236,066 in February, > according to Paysa Inc., which tracks compensation for those professions.

That's the first time I've seen realistic compensation numbers on an article like this.</comment>


Ask HN: How to attract users to our iOS Bootcamp?  - <AUTHOR>

http://www.hackrocket.com
At HackRocket.com we are launching a 3-month online iOS Bootcamp to teach people with a basic knowledge of object-oriented programming how to build fully featured iPhone and iPad apps from scratch.
We have a great instructor, masterclass sessions with mobile entrepreneurs and experts, and a really great price (when compared to other training programs that teach people how to code)
Lots of people are really excited about this program but we need more people to sign up.
Take a look at what we're offering and give us your feedback. We would really love to hear your ideas.
Thanks! <comment><USER2> Your price (much more than free) is not competitive. This one is free, and it's from Stanford:

[http://itunes.apple.com/itunes-u/ipad-iphone-application- dev...](http://itunes.apple.com/itunes-u/ipad-iphone-application- development/id473757255?mt=10)

</comment><comment><USER3> This looks great!

I am an experienced programmer. I was planning on trying to learn iOS development on my own, but your course seems just what I was looking for.

Is your iOS program also suitable for absolute beginners?</comment>


Launching TODAY (with one humble product) - <AUTHOR>

Today I am launching my first website http://Printingfacebook.com in conjunction with "The Social Network" movie release. Though I am working on several printed products that use data from social networks and blogging platforms, I decided to make a unique url for this single product and test the water a bit. The product is a "friend poster" made up of all your friends' profile pictures.
I would love to get some feedback on the idea, and on the implementation.
Also if anyone has any insight on getting some press or getting covered on various blogs, please impart your wisdom. I'm pretty new to this. Which blogs should I reach out to and what angle of the site is most compelling. I made the site to try to offset the costs of my graduate program.
thanks! and enjoy the "trailer" video. It's a spoof off of the social network theatrical trailer.
Benjamin Lotan <comment><USER2> It's a great idea but I would expect a letter from Facebook's lawyers regarding the use of the name 'Facebook' in your product (you use the API, so that's against their terms of use) and the use of their logo in your logo. Good luck!

<comment><USER3> I think that's actually the point. when evil big company threatens to destroy little guy, it always makes great headlines regardless who is right and before you blink, he will be selling thousands of posters a day.

<comment><USER4> Since you are likley to get a C&D, I would prepare with an alternate domain name and a list of bloggers who are anti-facebook. Calcanis comes to mind. Send out a press release about the C&D, how FB is trying to control users images, and all the privacy/control of content issues. Once the media storm has whipped itself into a frenzy, then announce the new website name and redirect the original.

<comment><USER2> I guess you're getting downvoted because of the 'ethically questionable' suggestions you're making. Strictly in terms of making profit, I think you're spot on.

</comment></comment></comment></comment><comment><USER5> I think the idea is great and site looks very nice. Only problem I see is the name "printingfacebook.com" as it may cause some branding issues with facebook.

<comment><AUTHOR> thanks!, in terms of the branding issues w/ facebook, i could see that, but if i ever got big enough to have problems... i think i would be happy. I guess i chose the name for SEO, but when i start offering print services for other networks, i'll rebrand under a more unique name.

<comment><USER6> if printingfb.com is available, you could use that.

How do you handle printing? by yourself or is there a company that provides such printing services?

<comment><USER7> Thanks for sharing your idea about alternative domain names, but I think a public comment is not the best way to do that.

Someone else might grab it before the author can -- therefore please suggest domain names directly to the respective author via email. (I know benjamins email is not in his profile/website, but a whois reveals it).

<comment><USER8> I just registered printingfb.com to save it, just in case. Benjamin, you can go ahead and contact me at the email address in my profile, and I'll transfer the domain over to you free of charge.

BTW, awesome idea.

</comment></comment></comment></comment></comment><comment><USER9> Can't order as a non-US but some suggestions. Please check the default options so user can go through first step in one click. IMO Small margin, White background can be the default options. Great idea though. Looking forward for other products.

<comment><USER9> Also please make it clear with a badge or something on the home page that you can ship only to US currently. It is not clear until user clicks a (small) 'details' link on the "Your Order details" step.

<comment><AUTHOR> good idea, i'll figure out a way to make that clear earlier on in the process.

</comment></comment></comment><comment><USER10> Good luck! I can't find the recent discussion around a C&D someone got because they had the word book in their URL. So I might be a little worried if I were you about using "facebook" in your URL.

</comment><comment><AUTHOR> clickable: <http://Printingfacebook.com>

</comment><comment><USER11> Looks like a neat idea, atually i'd buy one... but US only :( Good luck with your project!

<comment><AUTHOR> yeah, Shipping internationally seems like a whole new set of complications, maybe sometime in the future. Thanks for the encouragement. It feels great to get yours as the first comment. :-)

<comment><USER4> It is not that complicated, and Paypal will let you print mailing labels directly. All you need to know is the HS Tariff code for your product and get some free plastic envelopes from the post office. I just checked a 8oz tube to Australia via USPS and it was $7.32. If you added a $10 international charge, that would cover any extra work or shipping. I ship products globally every week and it is very easy once you spend 10 minutes learning what needs to be done.

Also, you state that you are only mailing it to the 48 contiguous states. The USPS doesn't charge extra for Hawaii or Alaska (or military bases) so why would you exclude them?

<comment><AUTHOR> my shipping policy actually has to do with the printer i am working with, he only ships to the lower 48. That said, this is powerful input. My plan is that if i start getting enough orders and interest from abroad i will be able to convince the printer to ship international. Thanks for providing the info, I really appreciate it.

</comment></comment></comment></comment><comment><USER12> Great idea, I might buy a poster as a gift :)

But, as mentioned by others, save yourself from legal hassles and change your domain name - PrintingFB, PrintYourFriends, FriendsOnPaper..... and all of these are available

</comment><comment><USER13> The song on the video is rather wonderful! It's a cover of Radiohead's Creep by Scala:

<http://youtube.com/watch?v=evG2DDmSdxM>

</comment><comment><USER14> I like the idea. pic5 has red eyes, I'd change that - it's a bit too close to the text about the artist with great attention to detail.

<comment><AUTHOR> I love this comment in particular. A) my girl friend has been telling me the same thing. B) Relates to me as an artist and brings up all these aesthetic questions, about the audience vs. artist autonomy etc etc. already this project has been interesting in terms of revealing myself as an 'entrepreneur' to some artist friends... (the idea of selling out etc) .... that said. I didnt have a good camera on me, and wanted to get the site up ASAP... I'll be reshooting soon with an SLR and my other artist friend... who is actually a photographer and not a performance artist like me. :-) thanks for the comment. cheers.

</comment></comment><comment><USER15> Neat idea. best place to promote is on facebook.

<comment><USER16> I think that's a genuinely awesome idea - and I totally agree with hgarg, consider using Facebook ads to test the water. Apparantly you can get a free $50 coupon with new accounts [http://www.netpaths.net/blog/50-facebook-coupon- advertising-...](http://www.netpaths.net/blog/50-facebook-coupon-advertising- credit/) (although I've not seen that, I don't remember getting one when I signed up - I could easily be wrong).

<comment><USER17> Most registrars give you a $50 facebook coupon when you buy a domain name.

</comment></comment></comment><comment><USER18> Very nice idea, I wish you success !

</comment><comment><USER19> It's a cool idea.. I like it too!

</comment><comment><USER20> whoa... nice angle. I wouldn't buy it myself, but it seems plausible that lots of people would.

One thing: consider slightly different angles on this. For instance, a mosaic of all photos in which a person is tagged. And/or in which their friends are tagged. Furthermore, you could break this down into years, such that a person could have one poster for 2010, buy another one next year for 2011, etc. etc.

Also, think about the corporate angle here: I'm sure corporations would live this kind of thing... visual represenatations of the community who connect with them on FB. Hopefully you could sell premium versions to corporations to hang in their foyers: larger, better quality finish, whatever (you'd know better than I). Good luck :D

<comment><AUTHOR> great ideas, thanks for the feedback :-) The next product i'm working on is a yearbook style book of friends with names underneath photos and (similar to what you mentioned) the ability to choose a few of your friends, and print a poster of the photos you are tagged in together... targeting corporations, or even small businesses seems a bit difficult, but its good to think of this angle.</comment></comment>


JWTs suck (for web auth and basically everything else) - <AUTHOR> https://speakerdeck.com/rdegges/jwts-suck <comment><USER2> Note that Auth0 is a competitor of Okta, and Auth0 is all-in on JWT. Searching for anything JWT will most likely end up on an Auth0 site since the docs / content marketing is pretty well-done; they've obviously optimized for SEO. Their docs also cover how not to store a JWT as well.

[https://auth0.com/docs/security/store- tokens](https://auth0.com/docs/security/store-tokens)

The author of the deck is the "Chief Hacker" at Okta.

I would read the deck keeping that bias in mind.

(We recently had to lots of research into a 3rd party IDP to use, and chose Auth0 in the end over Okta.)

<comment><USER3> > Their docs also cover how not to store a JWT as well.

Well, it tells you something about that JWTs allow more ways to misuse the token spec which already makes it a bad standard. alg = none is still in the standard, no encryption by default and there is no sane cryptographic choice to sign/encrypt the JWT, which allows developers to shoot themselves in the foot as what we have here with using it with sessions.

Fernet [0] was the closest to being a successor of a better standard, but I believe PASETO [1] or even Branca [2] tokens look much more better alternative for JWTs. If not, then the good old session cookie may suffice even.

[0] - [https://github.com/fernet/spec](https://github.com/fernet/spec)

[1] - [https://paseto.io](https://paseto.io)

[2] - [https://branca.io](https://branca.io)

<comment><USER2> I have to agree with you. Without research, JWT is basically a foot-gun. I was aware of these issues from reading like-articles about JWT in the past. We work with a security engineer to try to ensure we're using JWTs appropriately.

One can argue that any generic tool can be used in an insecure fashion - common one is JSON.parse() in Javascript. By default, it's susceptible to prototype pollution. I can guarantee you that most devs will use that call on user input without appropriate sanitization.

Just like how the JWT spec hasn't been updated to disallow a lack of an algorithm, I'm unsure why JS doesn't offer a 'safe' version of the parse in the API.

We only use JWTs where it makes sense. For browser-based access, we personally prefer cookies with opaque ids to represent a session.

</comment></comment></comment><comment><USER4> huh. The author is "chief hacker" @ okta. This deck doesn't inspire confidence in okta. It doesn't make me want to run screaming either, though. Maybe just on the bad side of neutral. As as aside, how is okta (and OneLogin) even a thing? They are features masquerading as a company (phrase I learned on HN recently).

Perhaps, I don't know but perhaps, the interwebs is full of the type of misinformation/myths that the deck is challenging, but the reality (which I would assume a chief hacker, ie principal engineer is very well aware of) is that they are neither worse nor better than a plain cookie. I've no idea why you'd store the jwt in localstorage, again this may be an interwebs thing that doesn't reflect good choices. As a cookie-equivalent, you get, for free, a widely implemented abstraction that you learn once and portably apply everywhere. The complexity problem just isn't there AFAICT, and the choices are there for you. With pure cookies, you have to invent everything yourself.

I find particularly puzzling the claim about revocation. The example (p. 47) is a particularly naive implementation, which would scale equally poorly for homemade session ID or jwt.

Based on this visual deck alone -- I make an allowance for audio providing more detail -- I fail to see a well supported argument.

It reads much more as a soft ad for paseto.

<comment><USER5> The author kinda lost me halfway through. Was mobile or other non-web API interaction ever addressed in any meaningful way? Specifically, how much it sucks to to allow 3rd parties (or even 1st-party non-web-browser clients) access to your API if authentication is done via session cookies? Cuz that's a pretty significant thing to just gloss over.

<comment><USER6> Thanks for the comment! I didn't cover that in this talk as it was written for a 1 hour timeslot and already ran long.

I have separate content which addresses these topics in more depth.

<comment><USER5> Thanks, I look forward to reading it!

</comment></comment></comment></comment><comment><USER7> The localStorage vs cookies slide is wrong. localStorage does not open you up to XSS, you can have XSS with cookies as well. What the author probably meant is that cookies marked with `HttpOnly` cannot be exfiltrated via XSS, which is true, but:

1\. Preventing exfiltration is not very useful. If you have an XSS, you're already in trouble. Instead of exfiltrating the cookie, the XSS author could send a POST to the endpoint that changes the password, for example.

2\. You can also prevent localStorage exfiltration with either CSP's `connect- src` or a service worker, so that's not an advantage for cookies.

For a single page application, I would say that there is zero advantage to using cookies instead of localStorage for _most_ use cases. In fact, it's harmful because now you have to deal with CSRF.

</comment><comment><USER8> "JWT are more flexible" both points to expiration dates. Both kinda looks the same. No explanation why session cookies got the point. Maybe I don't understand how to use that website on mobile?

</comment><comment><USER9> False dilemma. Why not JWT inside a session cookie?

Benefit: retain horizontal scaling capabilities, don't have to use local storage.

<comment><USER7> Using a cookie is not a benefit, it's a downside. You have to deal with CSRFs, which aren't possible with localStorage.

<comment><USER6> But then you open yourself up to XSS which is a lot harder to defend against.

<comment><USER7> You don't open yourself up to XSS, see my comment above: [https://news.ycombinator.com/item?id=20773188](https://news.ycombinator.com/item?id=20773188)

</comment></comment></comment></comment><comment><USER10> I lost is after the score of 0-5.

Okay, JWT may not be good at this, let give one point to session cookie.

</comment><comment><USER11> This looks like an updated version of the the exact same talk from the same author from 2017. Link to 2017 talk below, with HN comments from 2 years ago.

[https://news.ycombinator.com/item?id=17877332](https://news.ycombinator.com/item?id=17877332)

</comment><comment><USER12> Yeah I went through three different authentication implementations and cookie session is for the majority of the use cases. JWT is bad for most cases. If you want to authenticate a user most use cases require storing the cookie in a database so the token isn't stateless anymore.</comment>


Elevator Pitch From Cofounder of Your Dreams - <AUTHOR> http://YouTu.be/vm7qkdj1gi8

<comment><USER2> This must be an elevator pitch for the Empire State building! (5:31 length is NOT an elevator pitch, should be 0:30 - 2:00)</comment>


Rules for Bootstrapped Web App Startups  - <AUTHOR> http://b.lesseverything.com/2009/7/7/10-rules-for-bootstrapped-web-app-startups

<comment><USER2> 1st rule: You do not talk about bootstrapping.

2nd rule: You DO NOT talk about bootstrapping.

3rd rule: If someone mentions real-time or social networking, it's over.

4th rule: Only two founders to a startup

5th rule: One startup at a time

6th rule: No suits, no MBAs

7th rule: Startups will go on as long as they have to

8th rule: If this is your first time at a startup, you HAVE to bootstrap.

<comment><USER3> That last point (8) sounds worthy of a decent debate. Any posts on the subject?

</comment></comment><comment><USER4> 10 rules everyone who cares has heard before,

<comment><USER5> ... and if not, you'd better read the expanded version:

<http://paulgraham.com/articles.html>

:)

</comment></comment><comment><USER6> 11: If you want to be taken seriously, don't make obvious spelling errors.

<comment><USER7> It is astonishing how few people I take seriously anymore, precisely because of this. Most blog posts I read now seem to have a blatant typo in the first paragraph, if not first sentence. It's profoundly irritating. If I can read my drafts 50 times before publishing them, couldn't others be buggered to read them _once_?

<comment><USER8> _aherm_ consider referring these folks to Uncle Raffi's spelling, style, grammar, and misused word detection for bloggers-- <http://www.afterthedeadline.com> I'm here to help!

<comment><USER9> I use this all the time for my writing. (Raffi's product)

<http://www.polishmywriting.com/>

</comment></comment></comment></comment><comment><USER10> These "rules" are a little too shallow to be very useful.

"Build something people need and love. People will talk about it."

People can only talk about it if they know about it. How will they know?

"Release, release and release. Release it before you think it's ready, you're wrong, you don't need that feature."

This would be better said as, "If you're not quite sure, don't be afraid to release. Blindly releasing for the sake of releasing is risky and stupid."

"Your app will probably fail, most of them do."

What is this doing on this list? Worst advice _ever_. Better would be, "Your app can succeed."

"Build something you want to use. Continue to use it, feel the user's pain."

This can easily be the opposite of #1, "Build something people need and love." You're unnecessarily restricting yourself to the relatively tiny population of things that interest you.

"Be Ballsy, don't follow the herd, make a courageous moves."

Such as...

"Build something you want to use. Continue to use it, feel the user's pain."

Bad advice. Better to ask the user about their own pain. Developers are notorious for having blind spots about their own apps.

"Google Adwords isn't a revenue model."

Not according to Markus Frind, founder of plentyoffish.com.

"Find the cheapest, fastest way to 500 paid users. People will pay for your app, if it's good."

Such as...

"Design is an iterative process, not just development. And you won't get it right the first time, so don't sweat so much."

Sweat a little. Release shit too soon and shoot yourself in the foot. Development must be done with design in mind.

"Don't scale until you actually need to. (The front page of Digg does not count as need.)"

But develop with scaling in mind. (Will you really have enough time to completely redesign your data base schema after 1000 users?)

"Don't spend any money."

What if spending money is more time/cost effective? (Paying someone to do something that would have taken me 5 days to do.)

<comment><USER11> "Rules" are not a "How to build the next Google For Dummies".

"People can only talk about it if they know about it. How will they know?"

Using it. Start with your friends, and if they like it, they will talk about it to their friends. There´s a lot of ways to make the user "talk". It´s not asking him like a favor, but, basically, regarding him. It´s better if to need your app, he MUST invite new users. It creates a powerful chain of humans.

This would be better said as, "If you're not quite sure, don't be afraid to release. Blindly releasing for the sake of releasing is risky and stupid."

Nope. I think it´s about really release as fast as possible, as long as your app can do the "mainly" think. It´s not even an beta, it´s a alpha, but if it works, it´s must be released.

What is this doing on this list? Worst advice ever. Better would be, "Your app can succeed."

Because newbies business men think that they will be successful by the end of the year. Don´t dream, stay focused and prepare to lose, a lot. It´s not a game where the victories depends of you and your guts, but rather luck and a lot of uncontrolled factors. The best advise ? Good luck !

This can easily be the opposite of #1, "Build something people need and love." You're unnecessarily restricting yourself to the relatively tiny population of things that interest you.

Nah ... there´s a trick part here. If you make something that you can REALLY use, so it´s will be MUCH, but really MUCH more easy to sell to others. If you any time tried to sell something, you should know that.

Such as...

Hum ... anything your mom ever have heard (even if it exists) could help. The point is to start something new, and then look for YOUR USERS needs ... not having the brilliant idea. Dont stick with examples and ideas, go for the reality and try to create anything your user need.

Not according to Markus Frind, founder of plentyoffish.com.

Maybe ... but if you are have something that don´t trows a lot of shit on the screen of the user, and even so that have money, your product is really for the win. Dont be afraid, if your app really help somebody, they will be happy to pay for it.

Such as...

Get one, listen to him, release, get ten, listen to them, release, get 100, listen to them, release, get 1000, listen to them, release ... remember, "we are not on the software business, we are on the SHOWBUSINESS". And, of course, believe on your work.

Sweat a little. Release shit too soon and shoot yourself in the foot. Development must be done with design in mind.

I agree.

But develop with scaling in mind. (Will you really have enough time to completely redesign your data base schema after 1000 users?)

Agree again with you here.

What if spending money is more time/cost effective? (Paying someone to do something that would have taken me 5 days to do.)

It works only if in this five days you can make more money then you have payed for. Therefore you are not spending, but earning.

Sorry by my poor english.

</comment></comment><comment><USER12> I've been stuck at number two for MONTHS. Analysis paralysis.

<comment><USER13> Then release today!

<comment><USER12> I've actually signed up my first beta customer, which will be a big step towards an actual product. We use the product for our business, but n+1 is challenging. I'm doing it though. I want those 500 customers and the freedom to work on my own IP.

</comment></comment></comment><comment><USER14> 1st rule: create a software app of high enough quality, that CS college grads from good departments will not vomit, when they see your source code

2nd rule: don't run out of money; get a part-time job; mow your neighbors lawns etc.

3rd rule: build something that companies, or any mid-sized and funded organization will actually use; you're insane to think you will actually succeed in the consumer market

my two cents. good luck.

</comment><comment><USER15> This is great advice that can be applied to more than web apps too!</comment>


Apple TV Markup Language - <AUTHOR> https://developer.apple.com/library/prerelease/tvos/documentation/LanguagesUtilities/Conceptual/ATV_Template_Guide/TextboxTemplate.html#//apple_ref/doc/uid/TP40015064-CH2-SW8 <comment><USER2> If any of the authors are reading, you really ought to consider putting this into an XML namespace. It can just be a mysterious invocation to most users today, but if you need to extend this in the future (inline SVG? inline XHTML?), it'll save your bacon to have done it in the first version.

<comment><USER3> Why would anyone add complexity to the syntax when you can make it simpler by removing the XML namespace?

If you need to add namespaces, then you have already failed.

<comment><USER4> It's if you want to have backwards compatible syntax supported by later devices. This will naturally happen as you add features and modify old ones. It's even more important in hardware devices that might might not be able to be updated later.

EDIT: I think someone is probably down-voting me for a technical reason. Would you please explain it?

<comment><USER5> If Apple wants to break BC they just do it. They control the entire ecosystem and has been known to break stuff pretty frequently and force everyone to keep up

<comment><USER6> > been known to break stuff pretty frequently

Apple is really good about giving developers a heads up before deprecating anything.

</comment></comment></comment></comment></comment><comment><USER7> I believe this XML+JS thing was the only way to write apps for the old Apple TV. Various postings on the internet seem to suggest this from way back; the old SDK was probably only ever available to a select few handpicked appletv channel partners.

What's new in the new tvOS SDK is that you can also write native apps in Objective-C/Swift, with a main() function that starts up UIKit, and with access to most of the normal iOS APIs (like OpenGL, SceneKit, etc etc).

<comment><USER8> I was confused at first because TVML seemed more prominent in the marketing/developer materials. But we just saw a game run on Apple TV so yeah, you could write native apps w/o the TVML.

<comment><USER9> This was confusing for A LOT of people!!

</comment></comment></comment><comment><USER10> This should be theoretically compatible with React right? I wonder if Netflix are using this + React for their Apple TV app or if they're doing something entirely different... There is a <divTemplate> option so perhaps its through that?

</comment><comment><USER11> This is what looks like a css: [https://developer.apple.com/library/prerelease/tvos/document...](https://developer.apple.com/library/prerelease/tvos/documentation/LanguagesUtilities/Conceptual/ATV_Template_Guide/ITMLStyles.html)

</comment><comment><USER12> Oh look, it's XAML for an Apple device.

That's only half-sarcastic; it does seem to be a similar but much-simplified markup language that learned a lot from HTML5. Will be interesting to watch it develop.

As others have commented, though, XML without namespaces is not a fun ride (in my humble experience).

[0] [https://en.wikipedia.org/wiki/Extensible_Application_Markup_...](https://en.wikipedia.org/wiki/Extensible_Application_Markup_Language)

<comment><USER13> If XHTML had prevailed, we would already had XAML for the web, instead HTML keeps getting hacks.

</comment></comment><comment><USER14> I'm a little surprised they're jumping into the literal "TV" namespace so wholeheartedly.

Is the future of this ecosystem really exclusively limited to the Television?

Gaming is already an explicit part of this, which undoubtedly will include VR, which is theoretically suited to Television-like content.

If they do this right, the source code running on your VR gogs will mention "TV" everywhere, much like the the current OS running their desktops and mobile devices references a defunct company.

<comment><USER15> The iPhone name worked out pretty well, even though the phone functionality is just a small fraction of the iPhone's value proposition.

<comment><USER14> Apple's phone SDK's are not prefixed "Phone", nor is it called the "Phone OS".

Exactly to my point: It's called iOS because the breadth of it's applicability was recognized from the beginning.

Edit: You're right, and it's different: naming of the mobile OS and namespacing were independent, allowing for a public re-brand without changing any code. Seems the TV is not going that way though.

<comment><USER16> Splitting hairs here: it was originally iPhone OS in the beginning, but moved to iOS in June 2010

</comment></comment></comment></comment><comment><USER17> The main problem is that we are still using XML to do component definition and composition. We need to better language (no, json and yaml are not the answer).

I am working on a new language concept (still at early thinking) but the alert template document would be defined as:

      alert#update_available [  //Composition is separated from definition
         btn#update,
         btn#cancel
      ]

      alert { //All alert elements are defined as alertTemplate
         type: alertTemplate
      }

      btn { //All btn elements are define as button
         type: button
      }

      alert#update_available { //Define the title and description for the alert with ID update_available
         title: Get the latest tvOS version
         description: Get the latest tvOS version
      }

      btn#update {
         text: Update Now
      }

      btn#cancel {
         text: Cancel
      }

      //We could override the settings like CSS
      (@language = "pt_br") {
      //If variable language is pt_br override the content with Brazilian Portuguese texts
        btn#update {
           text: Atualize Agora
        }

        btn#cancel {
           text: Cancelar
        }
      }

</comment><comment><USER18> The link should probably be the main TVML page rather than one of the template reference pages.

[https://developer.apple.com/library/prerelease/tvos/document...](https://developer.apple.com/library/prerelease/tvos/documentation/LanguagesUtilities/Conceptual/ATV_Template_Guide/index.html)

<comment><AUTHOR> OP here - You're exactly right, I looked at that front page and almost bailed. I thought this was much more interesting since it shows a simple example with code and matching output screens.

</comment></comment><comment><USER19> I think it's interesting that Apple is promoting making apps that are web based that you wouldn't have to get approval for to make updates. Maybe because it's limited on you can do with TVML but I think it's interesting.

<comment><USER20> I don't think that's what's happening here. Each of the TVML documents would be stored locally and called by a locally stored TVJS file, which is invoked by your binary.

In other words, all of the program logic and display elements are on the Apple TV - only the data that's being retrieved and displayed would be stored server-side - which is no different from any iPhone app that displays server based content today.

<comment><USER19> No the app looks to an outside server for the code. Check out Apple's sample code which makes you run the code on a python server.

</comment></comment></comment><comment><USER21> So it's just HTML?

Is there a reason (legal or otherwise) that they can't just use HTML?

<comment><USER22> In no way is this html. its xml. they use xml for the same reason that most do - to define their own elements and behaviors thereof

<comment><USER23> XML without namespaces, so pretty much just markup.

You know, without namespaces, you take out the eXtensibility-bit.

<comment><USER24> > pretty much just markup

SGML, actually. "Just markup" can entail other things, like TeX, for example.

</comment></comment></comment></comment><comment><USER25> Curious on why they chose an XML-like syntax rather than something like JSON

<comment><USER26> XML is a markup language that can describe formatted document structure well, json is best suited for things like data. For instance, this would be pretty painful to describe in json:

Hello, dave

Conversely, this is pretty painful to describe in XML:

<pair> <key>name</key> <value type="string">dave</value> </pair>

<comment><USER25> Good point, forgot about the display portion of this application

</comment></comment></comment><comment><USER27> So if you're building a simple media app, can you just use the templates and JavaScript without much or any Swift/ObjectiveC? Sort of like Roku and Sonos?

</comment><comment><USER28> So what's an example of something you could build with this?

<comment><USER29> Probably something like the MLB app they showed: \- Basic streaming \- various ajax requests for score listings, etc. \- Plus some chrome / UI with app- specific assets

</comment></comment><comment><USER30> Another mark up language? Why? What was wrong with HTML here?

<comment><USER31> I'm not sure I'd qualify TVML as another mark up language. It looks like an XML standard that adheres to a particular XML schema. Asking, "Another XML schema?" would sound like a silly question because that's the whole point of XML.

As for why not HTML? I think there's a lot of really good reasons why HTML would be a poor choice. If you want to restrict Apple TV apps and channels to rely on Apple approved idioms, HTML would be a terrible choice. Apple isn't as interested in creating an open TV browser as much as it's interested in creating a unique and positive TV experience. They can shape that with their own standard.</comment></comment>


Tumblr: Blogging for the lazy - <AUTHOR> http://www.lifehacker.com/software/web-publishing/geek-to-live--instant-no+overhead-blog-with-tumblr-244915.php <comment><USER2> I wouldn't call it "blogging for the lazy." There is a very legitimate reason for Tumblr. Don't you ever have an idea or come across something that you just wish you could jot down or share with the world without writing a lengthy opinion piece about it?

In a world that is feeling the weight of information overload, I think it's great that someone is allowing people to just get to the point and "cut the crap" so to speak.

I'm not saying that blogs like TechCrunch aren't worth reading. They are. But I bet Michael Arrington has a lot more to say every day than he can write full blog posts about.

<comment><USER3> I agree with you; Tumblr seems to fill a niche somewhere between a public del.icio.us feed and a blog. It lets you show people things in a genuinely unified manner (unlike del.icio.us, which is links, only links, nothing but links), without obligating you to go into commentary. It's kind of like a multicast, pull version of emailing something nifty to a friend. I think there's definitely a market for that.

</comment></comment><comment><AUTHOR> I like it when people launch apps similar to the ones I'm working on, shows that other people have the same problems :)

</comment><comment><USER4> I've been using Tumblr for a few weeks now (<http://extantproject.tumblr.com).> I think it's great for those quick tidbits that aren't substantial enough to post to a blog but that are more substantial than just a link.</comment>


Amazon's Next Big Business Is Selling You - <AUTHOR> http://www.wired.com/business/2012/10/amazon-next-advertising-giant/ <comment><USER2> Compare this to Facebook's strategy, which is to open an ad exchange to give advertisers access to their users on facebook.com exclusively. The Amazon plan would allow advertisers to access Amazon's users anywhere on the net.</comment>


John Gruber on iPhone coming to Verizon - <AUTHOR> http://daringfireball.net/2010/08/n92

<comment><USER2> OK this is just foolishness.

Most people don't know anything about Verizon's phone testing process.

It is, by far, the best in the business. Verizon does not ship non-functional products.

However, clearing the typical telco operator handset testing process (network testing, stress testing, etc) takes 3-6 months.

Verizon takes 18 months. They are the most thorough in the business. This is well known in that community.

They (V&A) have a CDMA iPhone. It's in a Verizon lab somewhere. No one knows if it's passing handset testing (it may not be), or if the deal is fouled up on the sales/bd front.

I suspect Apple and Verizon cannot agree to contract terms, largely around branding on the phone.

<comment><USER3> Wait, what? Are you saying that Verizon is given a final version of a mobile 18 months before it is sold? And what does the phone manufacturer do in the meantime?

And wouldn't that mean that on Verizon you would get the same phone that is sold on AT&T (or around the world) one year later? Or is the manufacturer supposed to wait one year after AT&T has approved it but Verizon hasn't, and cannot even sell it to AT&T?

Sorry, you seem to know what you are talking about, could you explain your point a bit better? Thanks.

<comment><USER2> 1) Yes. Verizon gets them earlier than most, so I assume they get early builds that use more of the core network features - most of the testing done is network testing, E911 compliance, etc. They're not making sure 'Angry Birds' works.

There are direct relationships between the spend on QA and testing early in the process to the spend on customer support later.

2) Different large carriers typically get different phone variants. See, for instance, the Samsung Galaxy. In many cases, because of the CDMA/GSM issue, Verizon gets a wholly different phone than AT&T.

Each carrier has a different strategy and is looking for different things. Many carriers even have specific product managers for each carrier, ensuring the phone is in line w/ their unique requirements.

Because of their size and clout, Verizon gets theirs earlier than most (I think - not sure on this).

Exclusivity arrangements are negotiated between the OEM and the carrier. Generally you're working with lots of different SKUs that are relatively similar.

The iPhone turns most of this on its ear, in both a) there's one, and b) Apple is not good at working with other companies, because only one person at Apple's opinion matters. Verizon is also famously difficult to work with and used to dictating terms to partners, generally around making all of the mobile content 'V-Cast' this or that, and putting their logo on everything.

As you can see, there are conflicts. I imagine they've been working on them.

Oh, and as a side note, since I've moved out of San Francisco, I have had 0 problems with my iPhone.

Is that a helpful response?

<comment><USER3> Understood...

It was still not very convincing for the time length though. We are not talking of Verizon getting a phone a few months earlier but a full year.

At that point most chips are not even out yet, nor is the Android OS, etc... 18 months before release seems WAY too long.

</comment></comment></comment></comment><comment><USER4> There is no way the iPhone will not come to Verizon... at some point. Couple this report with the recent SEC filing from ATT and you can see something a little clearer through all the fog.

Personally I've decided to hold off on the iPhone 4 and will instead pick up the new iTouch when it drops this fall. Maybe when I have carrier choice I'll reconsider an iPhone.</comment>


Everyday for iPhone: Make the movie of your face - <AUTHOR> http://everyday-app.com/

<comment><USER2> It would be interesting to track the age-group of this app.</comment>


SSH in Windows  - <AUTHOR> http://max-michaels.blogspot.com/2012/04/ssh-in-windows.html

<comment><USER2> <http://www.bitvise.com/winsshd>

WinSSHD is an SSH server for all Windows NT-series operating systems. Supported platforms include Windows 2000, XP, 2003, Vista, 2008, and 7. Both 32 and 64 bit. Free for personal use.

</comment><comment><USER3> PuTTY. Did I miss something?

<comment><USER4> Yes. He's looking for a server, PuTTY is a client.

</comment></comment><comment><USER5> Some non-Cygwin alternative SSH servers are discussed here:

[http://www.windowsnetworking.com/articles_tutorials/install-...](http://www.windowsnetworking.com/articles_tutorials/install- ssh-server-windows-server-2008.html)</comment>