Deploy your side-projects at scale for basically nothing – Google Cloud Run - alex-olivier https://alexolivier.me/posts/deploy-container-stateless-cheap-google-cloud-run-serverless <comment><USER2> I have used it for work-related reasons and indeed the service is quite nice. But I don't use Google Cloud Run for personal projects for two reasons:

\- No way of limiting the expenses AFAIK. I don't want the possibility of having a huge bill on my name that I cannot pay. This unfortunately applies to other clouds.

\- The risk of being locked out. For many, many reasons (including the above), you can get locked out of the whole ecosystem. I depend on Google for both Gmail and Android, so being locked out would be a disaster. To use Google Cloud, I'd basically need to migrate out of Google in other places, which is a huge initial cost.

Both of those are basically risks. I'd much rather overpay $20-50/month than having a small risk of having to pay $100k or being locked out of Gmail/my phone. I _cannot_ have a $100k bill to pay, it'd destroy everything I have.

Also I haven't needed it so far. I've had a Node.js project on the front page of HN, with 100k+ visits, and the Heroku hobby server used 30% of the CPU with peaks at 50%. Trying to do the software decently does pay off.

<comment><USER3> I had the same thoughts: even if I like Google Cloud a lot (I use it extensively at work), I don't feel it's safe for me to use it at home, since I don't want to risk having my entire google account locked due to "suspicious activity", whatever that might mean.

In fact, I recently shut down a personal App Engine service I had been using for myself for a few years just because of this paranoia. The service was not doing anything illegal, just crawling a few websites (forums, ...) I like and sending me emails when there are interesting updates. But you never know if they might determine my outbound traffic is suspicious. I also started the long process of moving my main email from a @gmail.com to a @custom.domain that currently forwards to gmail, just in case I get locked out.

It is quite bizzarre that this is the reputation google gained for themselves.

<comment> irq-1 I ordered a phone from Google that's been lost in delivery. I have Gmail/documents/photos/music... Should I do a charge-back? Sue them in small claims court? I should never have done business with them.

<comment><USER4> Absolutely don't do a chargeback. Try to settle it with the package carrier.

Google's algorithm can flag a chargeback as suspicious, leading you to be locked out.

<comment><USER5> This is a delightfully horrifying response... "Don't poke the trillion dollar bear, he might bite you and lock you out of your account!"

(GOOG's market cap as I write this is $985B...)

<comment><USER4> It is horrifying and it should be illegal to provide so little customer service when you encourage deep, irreplaceable investments into your platform.

</comment></comment></comment></comment></comment></comment><comment><USER6> I wont use this for the simple reason that I bought into the Google Appengine stack in the past and it really bit me for several reasons:

They force-upgraded the java version. The problem was their their own libraries didn't work with the new version and we had to rewrite a ton of code.

It ended up being insanely expensive at scale.

We were totally locked-in to their system and the way it did things. This would be fine but they would also deprecate certain things we relied upon fairly regularly so there was regular churn to keep the system running.

Support was extremely weak for some parts of the system. Docs for java were outdated compared with the python docs.

Support (that we paid for) literally said to us "oh... you're still using appengine?"

Finally, they can jack up the pricing at any time and there really isn't anything you can do - you can't switch to an alternative appengine provider.

Certain pages in the management console were completely broken due to a js error (on any browser). In order to Use them i had to manually patch the javascript. Six months after reporting it several times and it was still broken.

Oh, and when we got featured on a bunch of news sites, our "scalable" site hit the billing threshold and stopped working. No problem, just update the threshold, right? Except it takes twenty four hours (!) for the billing stats to actually update. So were were down on the one day that "unlimited scaling" actually mattered to us.

I'm never again choosing a single-vendor lock-in solution. Especially since it's not limited to appengine - Google once raised the fees for the maps API from thousands a year to eight figures (seriously) a year with barely any notice.

<comment><USER7> You're outlining all the reasons why Cloud Run is the successor to App Engine.

App Engine was the very first PaaS, came out before Docker, and did things very uniquely in order to try to only allow scalable apps. App Engine standard has to explicitly create special environments for each of their runtimes, and that's slow and expensive. Services like Datastore and Memcache were tightly coupled.

Cloud Run fixes all that. It's just a Docker container that listens on the PORT env variable. Use whatever runtime you want. Run the same container locally, or on another cloud provider. The other services like Firestore or Memorystore (Redis) are truly optional and external.

Cloud Run is what lets you avoid single-vendor lock in, but still get from 0 scaling.

<comment><USER8> My understanding is that the 'flexible' version of App Engine runs on the same infrastructure as Cloud Run (and GKE for that matter). IMO running a regular node express app on Node Flexible App Engine isn't that different from running on Cloud Run, and I'm not really using any specific App Engine services (e.g. I don't use datastore, just a regular postgres DB on Cloud SQL). Lets me get up and running quickly with the knowledge I can easily containerize it if needed.

</comment></comment></comment><comment><USER9> The thing I really want out of these services is the ability to set a payment cap. It's probably never going to be an issue, but I have anxiety, and I can't sleep easily knowing that if I fuck up, if someone sinister abuses my application or whatever I may be stuck with a giant bill.

<comment><USER10> That's not a bug... that's a 'feature'.

Interestingly, AWS will not cut you off for non-payment (we had an issue with finance and were 250k in the red by the time we got the first 'Is there any issues over there?' email)

<comment><USER11> This sounds like a short term 'thinking'. If there are a few stories on the internet (and there are some in this very thread) about developers getting burned by this 'feature', it would turn off a lot of potential users in the future. It would make sense to be transparent and give tools to strictly control usage/billing - both in terms of trust and money.

<comment><USER12> It is. I'm using free there to build and host my projects. If/when I exceed the free tier I'm not making a billing account unless I can set a max bill. I'll sooner rewrite everything to run on bare metal that has a fixed monthly cost.

<comment><USER10> I pay my $5 for linode (expanded swap to 2GB, it's SSD backed) and just run Caprover... I'd rather not deal with AWS's billing (even their billing dashboards are delayed by 24 hours)

<comment><USER12> I've been using gc/firebase. It's very easy to use, with acceptable documentation. I've been able to get dangerous quickly without even trying to. If I weren't on the free tier I would've racked up unaffordable bills. Instead I exhausted my API limits and had to wait. Perfectly acceptable behavior for development. I'll also add some logic to the finished project to handle resource exhaustion. Should I start exhausting resources,and it's not a bug, I'm not going to continue with infinitely scalable/infinitely billable gc. I guess if target customers are companies with 9-12 figure budgets getting a 9 figure bill wouldn't be the end of the World. If I got a high 4 figure bill I'd have to declare bankruptcy.

</comment></comment></comment></comment></comment></comment><comment><USER13> I've been using Cloud Run for my GPT-2 text generation apps ([https://github.com/minimaxir/gpt-2-cloud- run](https://github.com/minimaxir/gpt-2-cloud-run)) in order to survive random burst, and also for small Twitter bots ([https://github.com/minimaxir/twitter- cloud-run/tree/master/h...](https://github.com/minimaxir/twitter-cloud- run/tree/master/human-curated)) which can be invoked via Cloud Scheduler to utilize the efficiency benefits. It has been successful in those tasks.

The only complaint I have with Cloud Run now (after many usability updates since the initial release) is that there is no IP rate-limiting to prevent abuse, which has been the primary cause of unexpected costs. (due to how Cloud Run works, IP rate-limiting has to be on Google's end; implementing it on your end via a proxy eliminates the ease-of-use benefits)

<comment><USER14> I'm currently serving an api that uses a 500mb resnet v2 model. The bootup takes to long, so now I have a single instance that can't handle any peaks and costs too much. Doesn't your model take to long to spin up before being able to serve a request ?

<comment><USER13> Yes unfortunately, but that's the caveat of services-on-demand. I'm looking more into more efficient/cheap model deployment workflows. (it might be just running the equivalent of Cloud Run on Knative/GKE, backed by GPUs)

<comment><USER15> Does GCP have an equivalent for Aurora Serverless? If so, would choosing that over CloudSQL been cheaper?

If you're familiar with AWS, would using AWS Batch exclusively with Spot pricing [0] (or Fargate with Spot pricing) _and_ Aurora Serverless [1] been cheaper than Cloud Run + CloudSQL?

[0] Say, the service runs for 5 mins every hour for 30 days. The respectable a1.large instance would cost $0.50 per month, the cheapest t3.nano would cost around $0.19 per month.

[1] Say, the service stores rolling 10 GiB/Month ($1.00) and does about 1000 calls per 5 minutes every hour ($0.20) using 2 ACUs ($3.60). This would cost $4.80 per month.

</comment></comment></comment></comment><comment><USER16> Can't you see this article is a paid advertisement for Google Cloud? Just like those 1 hour long videos on youtube - where they show how pilots fly an airplane of a specific company and how well is al organized or a 1 hour long video of a german car factory.

Just reading this line makes you suspicious: "I have built hundreds of side projects over the years "

really? Hundreds?

And then below:

"I am yet to have a side project go 'viral'"

Out of hundreds of projects over the years, none of them went viral?

And if you look at his "blog" you will see it has 3 entries in total: [https://alexolivier.me/](https://alexolivier.me/)

<comment><USER17> Bummer to see comments like this so high up the page after so many hours.

HN guidelines:

> Please don't post insinuations about .. shilling.. It degrades discussion > and is usually mistaken. If you're worried about abuse, email us and we'll > look at the data.

Also: every blog starts somewhere. Plenty of stuff in the author's GH and linkedin, both linked from TFA.

</comment></comment><comment><USER18> This article fails to mention the issue of needing a database. It doesn't matter how seamlessly your application can scale if your data backend won't scale with it.

They mention Cloud SQL, which is of course instance based and would run into scaling issues if your app got suddenly hammered. Not to mention, the cost isn't $0 if your app gets 0 traffic, you are going to have to pay to keep that running around the clock.

I realize some applications are very heavy on the app side and light on needing to hit the DB, but in my experience, that isn't very common.

<comment><USER19> AWS has Aurora Serverless ([https://aws.amazon.com/rds/aurora/serverless/](https://aws.amazon.com/rds/aurora/serverless/)) for that purpose with MySQL and Postgres compatible engines. But I haven't heard anyone using it for side projects yet.

<comment><USER20> They also have RDS Proxy ([https://aws.amazon.com/rds/proxy/](https://aws.amazon.com/rds/proxy/)) that lets you pool connections from tons of lambda instances in order not to overwhelm your DB when scaling up.

<comment><USER21> I wonder where the threshold is that the proxy is beneficial. MySQL is actually really good at handling new connections.

</comment></comment></comment></comment><comment><USER22> As a noob I have a question as to what advantages I have using docker compared to just a service like Heroku where I just push the application to them... and I don't bother with docker?

To me with my limited understanding this seems like just another step.

Now granted when it comes to work, I'm using docker with specifics that I know why I would want / can specify with docker ... but for personal projects this ever comes up for me.

But otherwise for personal projects it just never comes up.

Yet on the other hand when it comes to various examples I see more and more that involve docker where, I'm not sure it needs to / what the advantage is.

Obviously there must be some strategic choices / advantages I'm missing.

<comment><USER23> The first thing that comes to my mind is lock-in. if you push the application to Heroku and "it just works" then when you need to deploy it somewhere else you still have that hurdle to cross. Heroku's pricing adds up quickly.

<comment><USER24> ... or you just deploy it on any VPS or bare metal with dokku installed: [http://dokku.viewdocs.io/dokku/](http://dokku.viewdocs.io/dokku/)

</comment></comment></comment><comment><USER25> Your liability is not capped anywhere. I better stick to 5$/mo DO for my side- projects.

<comment><USER26> From the article:

> The service will create more and more instances of your application up to > the limit you defined

The docs confirm an instance maximum can be set and the price per instance can be less than $5/month.

</comment></comment><comment><USER27> Interesting. I've been looking looking at options too & opted for essentially the opposite: Get a big(ish) VPS and stack everything on top of each other with docker behind a nginx reverse proxy.

So far so good. Managed to host gitlab, prometheus, grafana and ghost working this weekend, which I'm pretty chuffed about.

Not as clean as OP's, but the intention was learning, so sacrifices on convenience are acceptable.

<comment><USER24> This is the advice I give early stage startups... don't waste cycles learning the AWS stack, and getting locked in. Just pay for a cheap VPS, and scale it vertically as you grow. By the time you outgrow vertical scaling you should have the revenue or funding to figure out your at scale architecture.

You'd be surprised how much you can handle with a single beefy VPS or dedicated.

<comment><USER28> Had a VPS for side project at Vultr. First step first, could not send sign up emails from it.

<comment><USER29> Sounds like the problem was with the networking or application code. VPS can do anything when it's configured properly.

</comment></comment></comment></comment><comment><USER30> What's the advantage of GCR over AWS Fargate/ECS? I've been running an app on ECS for a couple months now and have been pretty happy with the ease of set- up, load-balancing, auto-scaling etc, though there are still kinks I'm figuring out (SSHing into containers to perform database management, for example, or deploying updated tasks without downtime). Is the main selling point of GCR just its price? I haven't found ECS pricing to be an issue (but I'm also not running anything at scale, and I do pay more than a few cents a month — but still under 10 bucks).

<comment><USER31> Disclaimer: I work on cloud run

Another advantage not stated by others is that cloud run (mostly) adheres to the KNative API spec. This allows you lift-and-shift your application from cloud run to a Kubernetes cluster with the KNative plugin installed, a feature you can't find with any other serverless product

<comment><USER15> Thanks. What are the usual cold start and warm start times for Cloud Run? Is there potential for those start times to go down to a few milliseconds in the near-future?

</comment></comment></comment><comment><USER32> AFAIK, PaaS solutions like heroku have a similar way of working, at least for side-projects. Here, you deploy a container and Google runs it somewhere and Heroku containerizes your application every time you push it. Similar to here, Heroku's free hobby containers also go to sleep in ~30min inactivity.

<comment><USER2> Heroku's "hobby" is $7/m while "free" is $0/m. There's no "free hobby":

[https://www.heroku.com/pricing](https://www.heroku.com/pricing)

</comment></comment><comment><USER33> This is exactly the service that Azure needs and doesn't seem to have: while there is a consumption plan for functions, that's about it, and App Service is incredibly expensive for what you get.

<comment><USER34> As @GordonS mentions, Azure Container Instances is about as close as you'll get with Azure, but it's only close on ease-of-use: rather different from a deployment/scaling characteristics POV.

I'm generally very underwhelmed by Azure offerings, but ACI is one of the few that actually lives up to what is advertised.

<comment><USER33> Yeah, I did look at that, and I think you're right on ease-of-use - it's a deploy and done deal, which is nice. I think it suffers from two things:

* the cost seems net-net similar to App Service, but more granular. So I can go this route and get slightly more flexible pricing, but at the cost of some arbitrary limits on assignable CPU/memory.

* it's easy to wander into Azure Container Service stuff accidentally, and that has "deprecated" plastered all over it. Shame the naming doesn't separate them more clearly.

</comment></comment></comment><comment><USER35> If very few people visit a side-project, that's probably bad for Google search. Its crawler will be detecting slow response times and Google can penalize you in search results.

<comment><USER36> What a complimentary business strategy :)

<comment><USER37> More like unintended consequences. Like many real world cases, each of the policies is a reasonable, sound and fair policy by their own right. But when you combine them they might seem designed with exploitive motives.

</comment></comment></comment><comment><USER38> Cloud run is what zeit now was before it moved to v2. [https://zeit.co/](https://zeit.co/)

<comment><USER15> What does it run on today? Or, is it multi-cloud now?

<comment><USER39> yep, multi-cloud [https://zeit.co/docs/v2/network/regions-and- providers/](https://zeit.co/docs/v2/network/regions-and-providers/)

You can specify where to deploy to in a config file. Pretty cool stuff.

</comment></comment></comment><comment><USER40> I was tinkering with it recently. My problem was .. support.

After a lot of double-checking on my part, I was finally convinced that Cloud Run messed things up (in my case: A Content-Type header was changed from ThingsISend to text/html and broke every client). The issue tracker is hard to find and more or less abandoned, SO wasn't helpful (but had people that .. love Google Cloud Run and didn't believe me) and only after tweeting a bit someone looked into it.

The issue is fixed now, which is nice. The way to get there was ... questionable?

</comment><comment><USER41> Excuse my ignorance. if a container hasn't been hit in a long time, how long does it take to serve the first request back? Is it spun up or sort of hot paused?

<comment><USER10> AWS's firecracker can start a VM for your code in under 15ms, but if you need database access and other stuff, you can 'pre-warm' it.

<comment><USER41> Thanks, that's impressive.

</comment></comment></comment><comment><USER42> For personal projects and client work I prefer a VPS with fixed pricing. Many have quoted Digital Ocean on this thread but you get much more for your money with a VPS from Hetzner.com. $11.75/month = 8Gb RAM, 2 CPUs, 80Gb SSD and 20Tb of traffic. That's 4 times the RAM, 2 times the CPU and 10 times the traffic compared with a $10 Digital Ocean VPS.

<comment><USER43> Does Hetzner.com have servers based in the US?

<comment><USER42> No, just Europe. See [https://hetzner.com](https://hetzner.com). No, I don't work for them or receive any commission :)

</comment></comment></comment><comment><USER44> Do the kind of people who have tech jobs and have side projects really need it to cost nothing to run side projects?

I don't understand this obsession with running projects for "nothing" and contorting software architecture to do so.

$5/mo for a digital ocean droplet or $50/month for a a beefier VPS (or even dedicated hardware if you know where to look[0]) is not much compared to the normal monthly expenditure of people in tech on average.

If it was all for convenience/efficiency that'd be one thing, but learning "google cloud run" teaches you nothing about system maintenance, limits your understanding of the full stack, and encourages a myopic view of development, all so at some point when Google/AWS/Azure raises the temperature of the water in the pot everyone starts wondering "how did running software get so expensive?".

<comment><USER45> While I tend to agree, I'm the type to have ~3 projects going at a time. I'm pretty young, but I can see myself spinning up a few projects a year. Each project needs a sql database, hosted by google for a few bucks a year, a server per service, a company email per project per person on the project, etc. I can easily see this being $50/month/project. So let's call it $150/month, $1800/year. If you're not making any money, that's a lot of bare minimum over a life time just to play around with. Then if you assume your side project isn't meant to be profit optimizing, you may never make money.

It really isn't a lot, but some people aren't in SF where they make massive profit. In more rural areas in the US, non-senior engineers can make ~$60k-$80k. In non-US roles, that's even lower. I can see this price range being meaningful.

Also, I know you can get cheaper with this, but if your goal is to spin up MVP's ASAP, you don't care to work hard to optimize ever penny out of your infrastructure. This is a nice breakdown, and I'll probably use it for the current project I'm spinning up as a test.

<comment><USER46> You can do all of that with a $5/month vps assuming you don't get a ton of traffic.

</comment></comment></comment><comment><USER47> Sounds quite similar to Azure Container Instances, except ACI seems to be cheaper (at a glance). ACI is also not HTTP-only like this seems to be, but you do need to combine it with a Function App (Azure's serverless offering) if you want to trigger containers using HTTP.

</comment><comment><USER48> We evaluated using it at work to replace App Engine Flex and unfortunately it was not ready for our use case: 1\. There is no liveness/readiness check nor a way to move the traffic between versions, so you'll have downtime at every deployment 2\. The only way to rollback to a previous version is to redeploy, no support from the web interface 3\. There is no way to SSH to an instance (not so important) 4\. You can't connect to Google Cloud MemoryStore (hosted redis)

Scale to zero + instant deploys would make cloud run a great candidate for staging environments deployed on every pull request but it's not quite there yet.

</comment><comment><USER49> For my next side project, I'd like to test [https://render.com/](https://render.com/) It seems like a cheaper alternative to Heroku. Any feedback on this?

<comment><USER50> Interesting. Seems good. I guess the Render free tier is basically competing with Netlify, with the added luxury that you can add paid dynamic services at any time...?

<comment><USER51> Correct.

</comment></comment></comment><comment><USER52> There must be added cost for a managed databases or similar, right?

This sounds a lot like aws lambda (except nicer thanks to just running any container). In AWS's case, you need to pay extra for RDS, redis, and any other persistence.

<comment><USER53> Exactly. And this is why I do not use these services yet. It's great if the app itself only costs like 18 cent per month.. But if you have to pay almost €10 per month for a (SQL) database, all the monetary benefits are gone. I currently pay 7€ for two VPS which perform great, have a lot of storage and enough power to run all my projects.

</comment></comment><comment><USER54> > The service will create more and more instances of your application up to > the limit you defined (currently the cap is 1000 instances).

> As long as you have architected your application to be stateless - <AUTHOR> > data in something like a database (eg CloudSQL) or object storage (eg Cloud > Storage) - then you are good to go.

Won't this just defer the scalability issue to the SQL part of the application? It's nice that the stateless REST part can be scaled almost infinitely, but if the SQL part doesn't offer the same scalability, what's the point? Last time I looked, CloudSQL didn't offer this kind of scalability.

</comment><comment><USER55> Another option is Google Cloud AppEngine. It's a little more limited in terms of languages that are supported, but the free tier is generous enough that I have never paid anything to run backends for side projects.

<comment><USER56> For personal projects I think App Engine is superior due to the included services like Mail API and Memcache API.

There are also features like Firewall API that's lacking in Cloud Run right now.

One downside of App Engine (due to its 10+years of history) is that one GCP project can only have one App Engine app in a single region, and you can't change the region after it's created. You can have arbitrary number of Cloud Run service in one GCP project, each can be in different region.

It's also harder to take a Infrastructure-as-code approach on App Engine as there's no easy way to diff between the deployed version and the intent (in Cloud Run, you can use the container image hash for that purpose).

Disclaimer: SRE working on App Engine and Cloud Run.

<comment><USER55> Thanks for the insights!

</comment></comment></comment><comment><USER57> Is anyone familiar with pros/cons vs. AWS ecs?

I've used ECS a few times, it's pretty nice.

[https://aws.amazon.com/ecs/](https://aws.amazon.com/ecs/)

<comment><USER58> As others have said, this is like ECS Fargate but scales like Lambda. Very nice offering and I hope it's lit a fire under Fargate.

</comment></comment><comment><USER59> I often find myself what "at scale" means. It is used by so many different providers and it gets confusing.

When all you give the service is a container, how dos it know how to scale your project?

I presume it gives it more CPU and more RAM automagically but does that really provide "at scale"

I think of "at scale" to mean really a lot of traffic.

Spinning up new instances if your container is possible, but I think I would like an API where code can somehow interact with the scaling mechanism.

I guess "stateless" gives us some information.

</comment><comment><USER60> I am using this and it is a much better development and deployment workflow when compared to cloud functions. The only thing it lacks is some bigger RAM for ML workloads.

</comment><comment><USER61> We've been using Firebase and one of the issues we had is that methods become "cold": if it's not used for a few minutes, the latency of the next call is unpredictable and could be in tens of seconds. The way Cloud Run is described ('Only pay when your code is running') suggests that it may suffer from it too. Does anyone know if it actually has the problem?

</comment><comment><USER62> started using this... pretty awesome vs the wall of yaml it replaces. Not suitable for all workloads (max 1cpu/2 gigs ram, 4 minute max pod startup time, can't do background work when not serving a request). But it replaces cert-manager, ingress-nginx, oauth2-proxy, k8s service, k8s deployment, k8s secret, k8s configmap, k8s hpa, k8s pdb, helm charts and cluster management.

<comment><USER56> Disclaimer: I work closely on Cloud Run as an SRE.

IF you want, you can still have it by use "Cloud Run for Anthos", and deploy your container to your GKE cluster with the same Knative API. This allows you to have more control on memory/CPU etc.

<comment><USER62> Thanks, although unfortunately I'm not in the price bracket for Anthos (starts at 120k/year or so I believe).

<comment><USER56> I believe there's no requirement if you just want to use Anthos on GKE (I could be wrong though, Anthos is relatively new).

Alternatively, if what you really want is the ease to manage and deploy containers and automatically scale according to traffic, my understanding is you can always use the open source Knative project with your Kubenetes cluster. This provide you the exact same API supported by Cloud Run and makes it very easy to migrate from managed Cloud Run to on-prem K8s cluster (or K8s clusters from other Cloud vendors).

<comment><USER62> thanks, I hope you're right, GCP doesn't appear to be clear on this point, seems to be offering free trial up to May 2020 and then who know. I'm aware of the ability to set it up from open source which is a great fallback!

<comment><USER56> Yes that's unnecessarily complicated due to the naming. I can't find anything on the Cloud Run add-on for GKE by searching "GKE Anthos".

This doc suggest you just need to enable Cloud Run add-on on your GKE cluster to use it: [https://cloud.google.com/run/docs/gke/setup](https://cloud.google.com/run/docs/gke/setup)

</comment></comment></comment></comment></comment></comment><comment><USER63> this has already been said, but due to the fact that this is google you have no idea when it's going to get killed and most things from google get killed.

so i would suggest AWS. API Gateway + Lambda. It's basically free for side- projects and the setup + operating it is trivial. It also scales (and you're going to have to shell out real money) if you were to receive a lot of traffic.

<comment><USER64> Just the other day I wanted to buy a book, but Amazon no longer has it in stock...

Yes, that makes about as much sense as people who can't get over their favourite RSS reader, 13 years on.

<comment><USER63> usually it's the publisher of the book that makes the decision. Amazon can actually (and does) print book on demand. Let that sink in for a second.

if it was just the RSS reader, nobody would bring this up. Reader, Inbox, Wave, Plus, NestAPI, the list goes on. Here: [https://killedbygoogle.com/](https://killedbygoogle.com/)

</comment></comment></comment><comment><USER65> As an illustrative of pricing:

If your deployment can run in 256MB of RAM w/ 1 vCPU, handles an average request in under 250ms, transfers 200kb or less per request on average, and you get 2 requests/minute on average to your site:

The cost is around $2/month USD, which I feel is a more likely scenario for a side project vs the "pennies a month" the OP claims.

<comment><USER13> "2 requests/minute on average to your site" is a bad assumption for a relatively unpopular side project.

More importantly, with those hypothetical numbers, you'd stay _well_ within the free tier for compute.

<comment><USER66> A request is not a visit. Each visit might have a up to a hundred requests (or even more when showing live data and caching a PWA on first visit for example). That would translate to one user per hour or two which even unpopular side projects can get. But you're right about the free tier of course.

<comment><USER13> Fair, although if the app is architected that way Cloud Run might not be the best option.

</comment></comment></comment></comment><comment><USER67> Deploy you side-projects at more than the scale they'll ever need at home on your hardware for actual nothing.

<comment><USER7> This will also cost actually nothing 99% of the time. Coud Run has a 2 million request / month free tier.

And I don't have to worry about accidentally unplugging my server or downtime for OS upgrades.

</comment></comment><comment><USER68> I've been looking for a service like this for a while now. The only problem I'm seeing with regards to my use case is I need powerful GPUs for NLP inference to also scale up and down to demand. Can someone explain if this is possible with GCR and if so what do i need to do to accomplish it?

<comment><USER7> There are Cloud GPUs: [https://cloud.google.com/gpu/](https://cloud.google.com/gpu/) but more generally, there's a whole AI platform: [https://cloud.google.com/ai- platform/](https://cloud.google.com/ai-platform/)

</comment></comment><comment><USER69> Might be a mindset thing but if my side project needed scale I would not think of it as a side project.

<comment><USER70> Probably a mindset thing. Side projects are lottery tickets in my mind. Implementation of an interesting idea hoping for the remote chance that it might get actual traction (and become more than a side project) - at that point it needs scale and it needs to scale fast while people are talking about it. If you take another week rearchitecting your backend while your site is down, you lost your chance. So you shouldn't probably expect huge traffic, but make it ready for the traffic or there is no point if it will fail the moment it starts to get traction.

My 3 side projects got reddit frontpaged (also here) and I got better at handling it. Fortunately I always had scale in mind (at peak got thousands of requests per second) but the first time was not a pleasant experience because I would have to pay more than I could if that kept going on. Fortunately I found a solution while keeping my site online and over the time the project paid me very handsomely. If I didn't plan ahead, those would be dead in the water.

</comment></comment><comment><USER71> I'm just starting to explore cheap hosting for a web app and my initial digging suggests shared php hosting (with MySQL) is promising. It seems much cheaper than ruby, node, etc. Can anyone comment if my initial hunches are correct?

<comment><USER72> If you can save $10/month by using PHP rather than Ruby (which seems optimistic) and value your time at $10/hour (which seems pessimistic) then writing PHP instead Ruby only has to take one hour per month more (or the equivalent in pain) to not be worth it.

<comment><USER71> I get what you're saying and appreciate the perspective. I'm not convinced rails or perhaps Sinatra are really any nicer than say Laravel. But I personally am not a ruby fan.

In this particular case the front end is very rich and the majority of the effort, and for the back end I just need a little bit of crud.

<comment><USER72> Sure, I'm not saying that you should use Rails over Lavarel, but rather that you shouldn't consider differences in costs of hosting much since other factors like difference in development time probably dwarf those.

</comment></comment></comment></comment><comment><USER73> Is there an alternative with similar ease of use, i.e. you just pack the files, create a Dockerfile, and push it live?

(For same reasons as other comments, I don't want to use another Google service for this, risk of being locked out, etc.)

</comment><comment><USER74> What kinds of applications take no time to startup though? I'm curious about the spin up time, 'cause my rails applications take on the order of minutes. I guess you can schedule a keep alive elsewhere though..

</comment><comment><USER75> Can anyone shed light on how this compares with Netlify? (Pricing and tech wise).

Netlify has basic DB/Identity/Lambda support so I'm guessing it could replace this entirely.

I'm using it only to host static websites at the moment.

<comment><USER76> Netlify (without extra features) is simply static hosting. With Lambda, it does add server-side code.

Cloud Run is to run a fully custom server, as in an API. It can obviously do more than Netlify, however Netlify really excels at static + some server code, while Cloud Run is extremely flexible (server in any language, more resources, etc)

</comment></comment><comment><USER77> What do didn't see mentioned is the latency for the first request when it's effectively dealer to zero. To get initial traffic/customers this is very important.

</comment><comment><USER78> Is there an easy equivalent for scheduled tasks in GCP? A background process that executes for a short period of time and then exists only charging you for the time it ran?

<comment><USER79> [https://cloud.google.com/scheduler/](https://cloud.google.com/scheduler/) ?

</comment></comment><comment><USER80> This doesn't seem all that different from app engine or any other PaaS.

Even the example he wrote is similar (probably longer) to a small guide I wrote for deploying to gae.

</comment><comment><USER81> Nice post! But this is a big hurdle for some, no? Are all your side projects fully stateless?

> As long as you have architected your application to be stateless

</comment><comment><USER82> Would be cool but I don't trust Google enough. I rather pay more than to host on Google's infrastructure.

</comment><comment><USER83> I'm not sure that "at scale" means anything if the author has never had one of their projects scale.

</comment><comment><USER84> Of course, the downside to doing anything with a Google product is that it could be deprecated next year...

<comment><USER85> It's slready like a meme: the typical comment on the google cloud that it could be closed tomorrow.

When will everyone understand that google cloud (money earning product) is different to all the other free products

<comment><USER86> > When will everyone understand that google cloud (money earning product) is > different to all the other free products

When Google demonstrates it. They've already discontinued various parts of their cloud product.

True, they are unlikely to shut down gmail, search, or Android.

On the other hand google's cloud is a money loser that has slipped to a distant #4 in the cloud rankings.

But like many of Google's revenue-generating products it exists to show Wall Street that they have an increasingly diversified revenue stream (I think advertising is "down" to around 87%). They have lots of bets to try an improve this but little to show for it.

They did recently commit $2B to making GCP a player but I suspect that if that doesn't show results by the end of 2020, investment in this sector will fall precipitously.

<comment><USER85> Do you have examples of discontinued Google Cloud Platform products?

<comment><USER86> You don't need to ask me: Google provides their own handy list of examples (some like messaging API show up under other names like XMPP; others don't appear on this list because they were marketed differently, e.g. Google Print):

[https://cloud.google.com/appengine/docs/deprecations/](https://cloud.google.com/appengine/docs/deprecations/)

<comment><USER87> Those are just features of a single product (appengine) which has been around for more than a decade and through several generations. Every product under every cloud vendor has API and feature changes over the lifetime.

GCP has never had a major product line shutdown. The only thing that comes close is Google Maps API pricing changes, but technically the service is still there and has even more functionality.

</comment></comment></comment></comment></comment></comment><comment><USER88> YES with serverless you can really deploy your side projects at scale paying basically nothing if they don't get visited.

The Serverless Framework on AWS Lambda though are more mature to do that. One of the biggest gotchas is using just one aws lambda function with the entire web server instead of doing one aws lambda for each endpoint.

</comment><comment><USER89> Isn't this exactly the same model as Amazon ECS(Elastic container service)?

</comment><comment><USER90> He mentions CloudSQL for storage. Anyone know if it's also on-demand?

<comment><USER13> No, you need a persistent instance unfortunately (min $7/mo): [https://cloud.google.com/sql/pricing](https://cloud.google.com/sql/pricing)

</comment></comment><comment><USER91> Your side projects don't need scale :D :D

</comment><comment><USER92> this is misleading, as cost curves are usually exponential for these types of managed services

<comment><USER93> How so?

I don't understand what would make it exponential as opposed to merely linear with traffic.

There's nothing in their pricing documentation to suggest this.

<comment><USER18> It's not. But the cost difference between servers and serverless is maybe exponential. As traffic gets really high, serverless is going to be extremely expensive compared to a dedicated box.

</comment></comment></comment><comment><USER94> What will the bill look like if your website suddenly hit a big traffic (e.g. someone post your site on HN)?

<comment><USER95> It goes up of course. Nothing's for free. Don't expect DigitalOcean level of pricing, the premise of cloud is on efficiency and scale, not necessarily being the cheapest raw computing provider when compared to traditional hosting. In other words it increases the elasticity of computation, but the price per unit of computation goes up. (Of course there are cost-savings like ops, security, uptime etc. But if you are talking about one-off side projects or something ML-related then the raw compute/bandwidth costs far outweighs everything else.) For PaaS the free tier is subsidized by your enterprise and other paying customers.

<comment><USER96> > It goes up of course. Nothing's for free.

Not sure why you write "of course" and "nothing's for free". If you use dedicated hosting with something like Hetzner, "suddenly hit a big traffic" doesn't automatically mean more costs for you. The website might get slower, or even crash, but your pricing will still be the same as it was before.

<comment><USER15> [https://scaleway.com](https://scaleway.com) prices their base compute _very cheap_ [0]. They have got DCs in AMS and CDG, but unfortunately, I've not got to use them since their DCs are a bit far from customers.

[0] €2.99 for 2vCPU, 2GB RAM, 200Mbits/s bandwidth.

<comment><USER97> 75GB object storage free??? Am I reading this correctly or am I stupid?

<comment><USER98> Outgoing traffic counts as well. So for example 5 GB storage + 70 GB outgoing traffic and then you start paying.

See section "Traffic" on [https://www.scaleway.com/en/object- storage/](https://www.scaleway.com/en/object-storage/)

</comment></comment></comment></comment></comment></comment><comment><USER99> Out of curiosity, how are people thinking about GCP platform risk after the '2023 deadline fiasco'[1]? Is it still a good idea to use GCP at all in the aftermath of them articulating that it could experience budgets cuts or even be axed entirely (though that latter seems much less likely)?

[1] [https://news.ycombinator.com/item?id=21815260](https://news.ycombinator.com/item?id=21815260)

</comment><comment><USER100> If you already have an EC2 instance reserved on AWS for a year, you could just throw all those small projects there.

If they are truly stateless then the bottleneck will probably be the database, anyway.

For anyone starting a new app I recommend just building apps that are TRULY serverless. Then you can make them client-first, work offline, not tied to on one particular domain name, support end-to-end encryption, be embarassingly parallel and scalable, and take an _activist position_ against continuing centralization.

A fuller exposition is here, so I don't have fo write a whole mountain of text: [https://qbix.com/blog/2020/01/02/the-case-for-building- clien...](https://qbix.com/blog/2020/01/02/the-case-for-building-client-first- web-apps/)</comment>


Ask HN: Solo founder and MVP. New co-founder equity split? - <AUTHOR> I am a solo founder looking to bring on a co-founder. My original idea came to me over a year ago and I've worked on it evening and weekends. Four months ago, I left my job to work on my startup full-time.
I'm in my early 30's and my background is in investments and software. After college, I was a software engineer for two years before moving into asset management in a front office role. My product is built on the domain knowledge I gain in this area. It's B2B SaaS with target ~$15k-$100k p.a. revenue per customer. I've finished my MVP and am about to go full tilt into sales mode.
I would love to bring on someone to do sales. I'm in early stage discussions with a potential co-founder who is a friend and someone
 I have worked with. He's in his late 20's and recently completed an MBA at a top school. His background is in business strategy and analytics (sales focused). He hesitates when it comes to sales because he does not see himself as a sales person. Having said that I think he could do it and his role would evolve over time away from direct sales into more of a management role.
I feel like he would be a good fit because we get on well, he's smart and has decent experience. He is interested in startups and told me he wants to jump in with both feet. He doesn't want to make a rash decision so is holding back a bit.
His initial thoughts are he would work one day a week + weekends (his work situation is flexible) and eventually go full-time. I would love to have him full-time. He has a one month notice period on his contract.
Equity vesting would start once he is full-time over a 4 year period.
If he starts full-time in one-month, how much equity could I give him?
If he continues to keep his full-time job and goes full-time with me in X months, how could I think about the equity split? <comment><USER2> He is not a cofounder, he is (potentially) employee #1.

Cofounders don't get brought on to do sales. Employees do.

Treat him like a good salesman- give all kinds of incentive payments (commissions, bonuses) contingent on sales performance, but be very shy with the equity. Plan on firing him as a default unless he exceeds expectations quickly.

Equity corresponds to risk and skin in the game, and it sounds like he has contributed (and will contribute) very little to either.

Bonuses are paying him for what he accomplishes, equity is paying him for what you have accomplished. If he's any good, he'll make more from bonuses than even a 50/50 equity split. If he's not any good, then equity will be far more important to him, locking it in before performance is known.

And having just reread your comment, a salesman who doesn't want to do sales but wants to do management? You need to interview more sales candidates. HUGE red flag.

Have a beer with this guy and have a good time, but don't bring him on. The world is full of salespeople who can't sell and can't do anything else either. They get by through others' hope triumphing over experience.

Say, while you're giving away your equity for free, can I be your cofounder too?

<comment><AUTHOR> Why would he not be a cofounder?

At the moment, I have an idea and an MVP. I have three advisers who I brought on in a semi-formal capacity. Two are senior investment managers and one is a serial entrepreneur having started companies in the same area. I speak to them maybe 1-2 a month to get advice and they are listed on my website.

In reality I have zero revenue and it will take 5+ to build this company. I've barely started.

I also read this article on YC: [https://blog.ycombinator.com/splitting- equity-among-founders...](https://blog.ycombinator.com/splitting-equity-among- founders/)

<comment><USER3> In the U.S. & around the world sales pro's earn multi-six & 7-figure incomes (Read: more than most physicians, attorneys, engineers, etc.), yet most founders fail to recognize their import. For example, startups regularly task a co-founder or, gulp, initial admin hire to engage a prospect list or subset thereof. It is an enormous mistake that yields suboptimal adherence to best- practice and crucially, a flawed data set that a founder may clumsily use to forecast growth, churn etc.

The sales talent required to build processes, identify most promising inbound/outbound prospect funnels, execute script/price-point analysis & closing ratio's, etc. to bring a v1 to market is immense. Respectfully, your friend is woefully unqualified to serve your startup well. A B2B with pricing model you've suggested requires a 10x pro.

Where are you located? Website?

<comment><AUTHOR> I completely agree that an excellent sales person is worth their weight in gold. Right now I don't know any. I would love to meet some.

I'm based in London but I was in the US for the last 4 years. Moved back because of with the visa situation it was just easier.

<comment><USER4> B2B enterprise sales is all about networks and contacts. A late 20s MBA will have none of these. You need someone who can work their existing extensive network as well as cold call, and get you in the door in front of real budget holding decision makers. I've worked on rates & FX trading systems in London for 20 years and know several guys like that who all do commission and equity points comp deals. PM me via contact details if you want to connect.

<comment><AUTHOR> Thank you for the offer. Do you know anyone in the alternatives space? with domain knowledge of private equity?

</comment></comment></comment></comment></comment></comment><comment><USER5> > He hesitates when it comes to sales because he does not see himself as a > sales person. Having said that I think he could do it and his role would > evolve over time away from direct sales into more of a management role.

I've made this mistake before. Just because that person is super smart, doesn't mean he/she can pull of what you want from the person. To find out, you MUST try working with the person for a bit.

What you need right now as you say is a sales role. Then you need to find a sales guy. You can always bring in your friend later on when you need a "management role".

If you really want to try working with him, one way to try this out is to NOT bring him in as co-founder but bring him in as an employee and pay him based on commission. That's how sales people mostly make money anyway.

Then after a while if you think he really is someone you are looking for, then you can "downgrade" his salary and propose equity instead.

<comment><USER6> > You can always bring in your friend later on when you need a "management > role".

Also worth keeping in mind that general purpose managers (as opposed to subject matter specialists taking on managerial tasks) is probably _at least_ ~25 hires out. There's simply not enough to manage to sustain a full time position before then.

</comment></comment><comment><USER7> -fresh MBA -no existing network -hesitant to join -wants to moonlight

All bad signs but you seem to think he would be a good person to work with so ultimately you have to decide. It sounds like what you need is 1 or 2 rich angels who have the connections to get your first few contracts, or an old guy like 50+ with actual connections and sales experience. (Pay him commissions.) Ideally you should be able to land your old employer as customer #1. Let your MBA friend strike while his job ticket is hot and get a stable job somewhere. Honestly sounds like you don't know the industry too well either btw.

<comment><AUTHOR> I know the industry fairly well but I have never done sales before. Mostly out bound calling / research where I've been the investor.

I know potential clients or can get intros through my network. I have three advisers who I brought on in a semi-formal capacity. Two are senior investment managers and one is a serial entrepreneur having started companies in the same area. I speak to them maybe 1-2 a month to get advice and they are listed on my website.

<comment><USER7> Then you're good to go! (Although you should make them formal advisors with incentives.) If you can't land clients based on that network, fresh-MBA no- network-or-experience guy is not going to help.

</comment></comment></comment><comment><USER8> We've had lots of sales people come through our doors and I highly suggest you interview several more here. A few reasons:

\+ MBA degrees prep you for corporate success, and rarely teach you how to sell or create sales collateral

\+ Hesitation re: sales means he will never be a sales person, at least with that attitude. Many (most?) sales people fail because they are afraid to cold call, prospect, do the grunt work, etc. This candidate sounds just like that.

\+ Given this is your project and you are the expert, you'll likely have to teach him how to sell it or spend a lot of time working with him to get him up to speed. I don't think that's possible on a part time schedule

Saastr is a good resource on this.

Happy to share more thoughts if you'd like.

<comment><AUTHOR> Thank you for your thoughtful response.

I agree with you on MBAs.

I think when it comes to sales, he is not very confident so he talks himself down. I suggested a sales book for him to read and we shall see where he comes out on that.

I feel like he is personable and gets on well with people. He's also a hard worker. So I think it could work but I acknowledge it's a risk.

Also I don't want him just for sales. I have a lot to do between tech, finance, legal, sales etc. If he could come in and lighten the burden that would be great.

He doesn't have domain knowledge so I would have to get him up the curve on the industry and the product. Good point.

<comment><USER9> If he doesn't see himself as a salesperson because he's not very confident (as opposed to because he thinks he can do other stuff as well) he's unlikely to an answer to your sales problem. Even if he's competent at the business analysis side of stuff, selling in the $15-100k range is going to take a certain amount of persistence and judgement.

If he can do the other mostly less critical stuff then the fact he wants to keep his current job is actually a good thing for you: pay him for his time and expertise when you need it and offer him a salaried job with options if/when you have revenue, funding and a proper position for him several months down the line.

</comment></comment></comment><comment><USER10> "He hesitates when it comes to sales because he does not see himself as a sales person."

isnt this a warning sign to you? at such an early stage you simply dont want just a "strategy" person who doesnt want to get his hands dirty

<comment><AUTHOR> Fair point. I think when it comes to sales, he is not very confident so he talks himself down. I suggested a sales book for him to read and we shall see where he comes out on that.

I feel like he is personable and gets on well with people. He's also a hard worker. So I think it could work but I acknowledge it's a risk.

I also think two pedigree guys from XYZ asset management firm launching a SaaS company will find it easier to raise capital from VCs than a solo founder.

<comment><USER11> Which book did you recommend? Maybe others can make suggestions as well.

<comment><AUTHOR> The book is: New Sales. Simplified.: The Essential Handbook for Prospecting and New Business Development

[https://www.amazon.com/New-Sales-Simplified-Prospecting- Deve...](https://www.amazon.com/New-Sales-Simplified-Prospecting- Development/dp/0814431771)

I read it in January and found it really helpful

</comment></comment></comment></comment><comment><USER12> What I've learned burning through about 5 co-founding relationships over the years is that, whatever you do, you need to have a 3-month probationary period where both parties understand they can leave with minimal loss and no hard feelings. Moonlighting is fine over this period (see the point about minimal loss). If he's good and really sees value in your idea, he'll get a LOT done over evenings and weekends, if not, he's not co-founder material, period.

A cofounder needs to be ridiculously motivated, self-aware, and hard working. 95% of people who would make good employees wouldn't make a good co-founder.

Another tip: if someone is hesitant about sales, he is not for sales. Good sales requires genuine enthusiasm and persistence. Especially in the early stages, where it's all about winning hearts, and less about "sales playbooks" or established processes. I heard Dharmesh Shah (CTO at HubSpot) describe early stage sales pipelines with two words: non existent.

</comment><comment><USER13> I'd echo the sentiment around him being a top-level employee, not a co- founder. I had an option agreement as a CxO for 2.25% (never vested as I left before my cliff).

I'm not deep in the tech space, so don't know about the whats/what-ifs of it all, but would think single digits would work?

However, he doesn't sound like a good sales fit. If you value his strategic chops, can you cut him a much smaller percentage for strat work instead of sales?

<comment><AUTHOR> What is your reasoning for top-level employee vs. co-founder?

<comment><USER13> To my mind, a co-founder is someone who directly contributes to not only developing the solution to the problem you're facing, but choosing the problem as well. You've already decided on the problem domain (investments), how you're going to solve it (SaaS), and have an understanding of the potential growth models you'd look for (bringing someone in to ramp up sales).

Of course, if you're open to someone only working one day a week on it to come in and challenge all of that and potentially pivot into something else, then they might be a co-founder. But from what you've described, they're a very senior hire (and might not be right, with sales you want to hire for passion, rather than academic smarts), rather than your co-dependent.

I was employee number 3, but I certainly wasn't a co-founder.

</comment></comment></comment><comment><USER14> It sounds like you are trying to get a sales person onboard without having to pay him up front and you're trying to pay a friend with equity. Either you business is viable in which case this a a horrible idea or you business is not viable in which case it's a horrible idea.

Find an employee that is willing to do high cut sales with a low salary. You don't need a partner for that. If you don't feel like setting up the sales engine is up your stream find a partner who's experienced in running sales for a startup and suggest a partnering deal with him. The first thing he'll do after getting a big equity cut is find a sales person who will do medium cut sales with a lower or nonexistent salary.

</comment><comment><USER15> I've worked with plenty of startups that bring on a top-flight sales person who is referred to as a co-founder, but typically the equity grant is much lower than a typical co-founder (more in the 5% or so range). There are a number of reasons for this, one of which is that the typical first salesperson comes on board after months if not longer of product development work.

That being said, there is a reason that salespeople are traditionally paid on a commission basis. Is there a reason you want to ignore that convention and, instead, detach compensation from being directly tied to each sale? This seems like an odd move, particularly when the prospective co-founder does not see himself as a salesperson.

You can grant equity on a non-time-based vesting schedule (i.e. performance- based vesting based on sales performance), if you are not ready to start paying cash or want to grant equity for some other reason.

But this person is simply untested in this role and you will not know in a couple of months whether he should have a significant equity stake in your company. So, traditional time-based vesting (and particularly with a magnitude of shares like that that would typically go to a co-founder) is a choice you are likely to regret.

</comment><comment><USER16> Instead of a fixed equity allocation, have you considered a dynamic allocation system instead?

All contributions (cash, time, relations etc.) are converted into "slices", with a certain multiplier for risk. For example:

* if someone contributes $X cash, they get 4X slices

* if someone contributes work that normally has a $Y hourly rate, they get 2Y slices for each hour

* if someone brings in a client for which they would have normally charged a $Z commission, they get 2Z slices

You freeze the pie when you are bringing in sufficient revenue to afford paying everyone a market salary.

% equity = slices owned / total number of slices

You can learn more about this method at [https://slicingpie.com](https://slicingpie.com) (not affiliated, just think it's a better way of going about this)

</comment><comment><USER17> Mistake.

A "co-founder" with what sounds like ZERO experience that is shy to do sales and get his hands dirty is almost certainly going to be a failure.

These type of people are a dime a dozen and it sounds like you want to bring him in just cuz you like his personality. BIG MISTAKE.

If you ask me, bring in another technical guy and/or pay someone to help you with some market validation via sales (or do it yourself)

Trust me on this (you probably won't).. i've learned this the hard way. I've been a solo founder three times in both successful (30k customers) and unsuccessful startups.

</comment><comment><USER18> Your ARR per annum per customer is upto $100k, trust me this is not going to be an easy sales to make, your sales cycles will be longer and will be challenging for even professional sales people. Given these conditions the credentials for the gentleman doesn't look up to mark and you should see more people, go to LinkedIn find seasoned sales people and engage them on target/comission basis before offering something as permanent amd valuable as equity.

</comment><comment><USER19> Sales guy here. I like being paid in cash because having ownership runs counterintuitive to my work.

Better, I get cash compensation and other benefits but not ownership/equity.

<comment><USER20> What would you view as a reasonable compensation structure for a guy like this for his first few sales?

50% cut on the first sale? Higher?

<comment><AUTHOR> I was advised:

* 20% of first year revenue on a cold call (deeded to be generous) * 7% of first year revenue on warm lead (incoming from website) * 2.5% of year revenue on a renewal

<comment><USER20> Interesting, thanks.

With or without base salary though?

<comment><AUTHOR> With a base salary. With the comp above, ~£25k (~$35k) in base salary so fairly low with the expectation that a good sales person can earn well over 6 figures.

This is in the UK so expect the US to be higher.

</comment></comment></comment></comment></comment><comment><USER21> If you want to go "full tilt into sales mode" (your words) hire a professional sales person, pay them a tiny salary and very decent commission on completed deals.

Anybody who doesn't see themselves as a sales person is simply NOT a sales person ! True sales professionals are proud to be professional and are motivated to be successful selling an excellent product. I presume that you MVP demonstrates that your product is truly excellent.

</comment><comment><USER22> > who is a friend

Do not cofound with a friend, as simple as that.

If you really want to be that generous with your work, get him on on commission and no flat until he can put in full time. Make it generous if you wish, even up to a third if it is sustainable, but never share ownership/voting power with family and friends.

Also, two cofounder is a good way to get stuck in decision bickering. Aim for three or one, any even number managing product direction is not going to work.

</comment><comment><AUTHOR> I feel like there is a general sentiment around my question which says "you shouldn't bring him on as co-founder but an employee". Why is that?

Paul Graham advises founders to "get a co-founder"

[http://fortune.com/2014/02/25/y-combinators-paul-graham- get-...](http://fortune.com/2014/02/25/y-combinators-paul-graham-get-a-co- founder/)

<comment><USER23> I do not feel like you convince somebody to be a cofounder, they convince you they must be one.

If you're talking him into it and it turns out he just doesn't have the capacity or passion for it which you'd like him to have, you're in for a huge disappointment.

Look at it another way—you're trying to seal a larger commitment on paper so you're buying into risk without getting anything tangible back on that investment compared to investing in him as employee #1. Fallout from a bad first employee will never be as bad as fallout from a cofounder you want to remove.

</comment></comment><comment><USER24> I wouldn't take on anyone who does it part-time, as a cofounder. Startups require a lot of focused energy. And I've never seen any succeed from part time founders.

If he's holding back, then don't take him as a cofounder. He doesn't believe in the idea or the team enough. You can still give him an employee deal, e.g. salary + up to 5% or so.

</comment><comment><USER25> My bigger question is why do you want to bring in a co-founder? Admittingly I didn't read every response here, but bringing in a co-founder entails lots of specifics and has a ton of good, but also a lot of baggage (not all baggage is bad, it is just there).

Are you trying to get external financing? Are you expecting to apply to an accelerator? Do you just not have the cash so giving equity is easier right now? Are you wanting to break up the load? How does employee #1 differ from co-founder in your mind?

My 2 cents. MBA's are fine degree's (and people usually), but in a startup I generally avoid anyone with an MBA unless they have been in industry for quite a while (5-10 years and at multiple companies). And as an early employee or co-founder an MBA is a red flag to me unless that person was part of the original team.

Honestly he sounds more like employee #1, but if you are looking for a co- founder to help offset the load you can absolutely bring him in as a co- founder. Just remember if the company is already legally formed there are a lot of little details you'll have to go through on the stock issuance/vesting/taxes etc -- e.g. get an attorney & CPA to help you.

Also, if you just need sales help that is much cheaper and easier to find than going down this path. If he isn't interested in sales you really should figure this part out. That said, co-founders have to do jobs that they wouldn't normally do until companies grow, so it isn't the end of the world. But in the case of sales, it is literally the lifeblood of the company, so it is pretty critical.

My last point. A Co-founder is essentially someone you will spend more time with than a spouse for the next 10 years. You will literally be seeing and talking to this person daily for hours everyday (at least in most situations). You are essentially married to this person, and they will call you at crazy hours and you them and you'll be under stress together and separate which means you have to support each other. If you have any questions as to this person get them out and into the open and make sure they do the same before you sign any agreements. If they smack their lips when they eat and that bugs you, get it out now cause when you are stressed and pissed and on the fourth meal of the day for the third straight day you'll eventually blow (I know stupid example but hopefully you get the idea). Personally, I'd rather keep a friend and not have a co-founder than think I got both and than lose them both in a year.

</comment><comment><USER26> "He hesitates when it comes to sales because he does not see himself as a sales person".

"... is holding back a bit"

"he would work one day a week + weekends (his work situation is flexible) and eventually go full-time"

HUGE red flags right there. Do not give him equity.

</comment><comment><USER27> _He is interested in startups.._

That's nice and all, but unless you're selling software to startups it's completely irrelevant. You need a salesperson who is interested in the verticals your business is in.

</comment><comment><USER28> If you want a salesperson, hire a salesperson. This guy sounds like he a) doesn't want to do sales and b) isn't qualified to do sales.

Forget about making your sales rep a cofounder. Just pay him for selling.

</comment><comment><USER29> [https://blog.ycombinator.com/splitting-equity-among- founders...](https://blog.ycombinator.com/splitting-equity-among-founders/)</comment>


'It's not ours': Government denies knowledge of strange UFO over Japanese city - <AUTHOR> https://www.livescience.com/japanese-ufo-weather-balloon-shenanigans.html <comment><USER2> Sometime in 1990, a group of young persons launched a "signal balloon" (smaller than a weather balloon) filled with helium and tied to a 2 mile spool of package tying twine. No reason other than to watch the string fly, really.

I doubt this incident is really any more newsworthy.</comment>


PageFair: Economist hacked - <AUTHOR> http://www.economist.com/help/pagefair <comment><USER2> I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement rather than a creative work:

 _On Oct. 31, 2015, one of economist.com's vendors, PageFair, was hacked. If you visited economist.com at any time between Oct. 31, 23:52 GMT and 01:15 GMT, Nov. 1, using Windows OS and you do not have trusted anti-virus software installed; it is possible that malware, disguised as an Adobe update, was downloaded onto your PC._

<comment><USER2> This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked.

I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.

<comment><USER3> Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud:

[http://blog.pagefair.com/2015/halloween-security- breach/](http://blog.pagefair.com/2015/halloween-security-breach/)

"If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"

<comment><USER4> I would rather say we should be not so much impressed with pagefair.

Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.

</comment></comment></comment></comment><comment><USER5> Ugh. To paraphrase PageFair's website, ads keep the internet free, but the way ads are implemented today also keeps botnets around.

<comment><USER6> Why is this so? Is this because of their use as fake traffic?

<comment><USER5> That's true, but not what I was thinking of. Even big websites of some repute (like The Economist) are in the habit of letting a multitude of external agents run unrestricted JavaScript on their pages. As in this case, that power can be used to distribute exploits.

<comment><USER6> Ah, very interesting...

</comment></comment></comment></comment><comment><USER7> Damn, they won't even show _this_ page without subscription ;)

Edit: Maybe I overreacted. I just tried the direct link again, and it loaded. The first time, loading stalled with a blank popover.

<comment><USER8> I have a paid Economist subscription but it's less hassle to not login and use a combination of expiring cookies, self-clearing cache, and some specific AdBlock rules to read their content...

<comment><USER9> I've spoken to some devs who used to work for them. They have said the working environment ther for devs is terrible and retention of quality is a big issue.

Their site is awful and has been awful for ages. Theh are also usually a good 3 to 5 years behind the times with their magazine technology. Late to deliver apps, poor user experience on the site, terrible mobile pages, etc.

I say this as an avid reader (andnow listener) to their magazine for over nearly 15 years.

<comment><USER10> Even their subscription management site is terrible, it's really much more complicated than it needs to be.

I love the paper version of The Economist, but I never read their online content. Partly because I can't be bothered to login.

</comment></comment></comment></comment><comment><USER11> > it is possible that malware, disguised as an Adobe update, was downloaded > onto your PC.

If you weren't affected by this you can still download genuine Adobe malware from:

www.adobe.com/creativecloud.html

</comment><comment><USER12> Another attack that disabling javascript would have defeated.

<comment><USER13> Another attack that unplugging your computer and going to live in the woods would have defeated.

More and more of the web is built on javascript, so opting out of a chunk of what the web runs on will naturally limit your exposure to the dangers (and joys) of the web.

<comment><USER14> > More and more of the web is built on javascript

Yes, you should definitely allow arbitrary code to run in a Turing-complete interpreter on your personal computer to read some text in the Economist.

This isn't some advanced app or game pushing the limits of web technology, it's words and a few charts.

</comment></comment></comment><comment><USER15> with dnsmasq

      address=/pagefair.com/127.0.0.1
      address=/pagefair.net/127.0.0.1

seriously, this only strengthens my argument for blocking all sorts of 3rd party crap

</comment><comment><USER16> I think it needs to be said that while external ad networks can increase the surface area of a hack like this, the major issue is email security and having tight access controls and MFA in place for all major services.

The same thing could've easily happened to economists own website and CDN.

There have been dozens of stories including major studios, politicians and the CIA that show how losing access to an email account can cause major damage or even cripple a business, if not get them shutdown completely.

It's something that seems to be overlooked a lot but with the prevalence of email access everywhere on mobile devices and the amount of phishing attempts and surveillance, this should be one of the highest priority security issues.

</comment><comment><USER17> Hold on... Economist wants both subscription fee _and_ to serve 3rd party malware (a.k.a. ads) to me?

<comment><USER18> Just like cable TV? Just like any sports broadcaster that charge for tickets AND have billboards?

How long is it going to take people to realize that ads vs paid content is not an either/or proposition, and that we should get rid of any ad-supported economy?

<comment><USER16> How long is it going to take people to realize there is nothing wrong with an ad supported economy and many products, services and media would go away without it, even if relying solely on subscriptions.

<comment><USER18> "Nothing wrong"?

\- The ads are almost never useful for the consumers

\- Companies keep shoveling money into ad campaigns just so that marketing teams can justify their budgets

\- Ad publishers are incentivized to completely undermine the idea of private data

\- Thomas Watson is often mocked for saying "I think there is a world market for maybe five computers". If we look today at Google, Facebook, Amazon, Microsoft and Apple, we are not that far from that reality. The "ad economy" is at direct odds against an open web.

I'll give you that Google's breakthrough came because they could find a way to revenue, and that without ads they would never bring many useful things for fruition. But the best way to justify their wealth creation is that they manage to make the social function of advertising (connect producers and consumers) and make it more effective.

There was almost zero progress in that regards afterwards. It is just a race to the bottom. I can actually bet that we would be better off without these products, services and media if they were gone. Case in point: one of the links on the front-page right now is [http://www.thedailybeast.com/articles/2015/11/04/no- spooning...](http://www.thedailybeast.com/articles/2015/11/04/no-spooning-isn- t-sexist-the-internet-is-just-broken.html)

<comment><USER16> I've heard all this arguments and more a 1000 times, it's nothing new and usually based on emotions and opinions rather than any objective study.

1) Ads are useful for consumers as it leads to them solving their problem. Whether that's a discovering a new service or buying a product, they needed something and they got it. It's still ultimately their decision.

2) Do you know the best thing about digital ads? It's the data. These aren't billboards that are bought without any idea who's seeing them or giant print ads bought on ego, we can tell exactly who's clicking on what and what they do after all the way to purchase. It's not just money thrown around, it leads to real bottom line results. The ad industry is one of the biggest data-driven industries in the world, contrary to what many might think.

3) Not sure how you came to this conclusion. There is no such thing as the "ad economy"... it's just a business model and industry, not some major paradigm of society. It will always exist because it works and serves and need, and outside of the direct monetization, it's the best form of payment there is. It's quick, passive and requires no decision willpower and is the primary reason for so many websites and such a large open web. We wouldn't have nearly as many sources on the internet if it weren't for ads. The monopolies you mentioned exist in every industry because that's the most efficient way to scale and run a business, it's got nothing to do with ads specifically.

4) I don't get the last point - are you saying that article isn't worth anything? Why? because you don't like it? So you're the judge of good content? I'm not a fan of celeb news but it's a huge market and draw for readers online so who am I to judge? There are billions of people with their own interests and needs, nobody get's to just set the baseline here. Yes there are scams and fraudulent stuff and arguably 'low-quality' bits out there but this exists in every field and is a constant battle. It doesn't mean we devalue everything because of it.

<comment><USER18> 1) What I was talking about Google being one exception to the rule. The thing is that at least with AdWords you get related to your search. When I am reading some news, the last thing I care about is if I could be missing some opportunity to buy a car, or if be bombarded with ads from Coca-Cola, or some possible tourist destination.

Ultimately, there is no problem to be solved when people are visiting whatever source of content they are going for. That people that tolerate ads in web pages do it only because they think it is the only way to get the content for free, not because of the value-add of the promoted advertisement.

2) Yes, the best thing about digital ads is the data... _for the marketers_. The producers get very little real benefit from it and in the end are put in an arms race by the marketing companies that tell them that the only way to keep their market share is by outspending the competition.

3 and 4) "We wouldn't have nearly as many sources on the Internet if it weren't for ads." That would be great, actually. We need more quality, not quantity. What you list as qualities ("quick, passive and requires no decision willpower") is _exactly_ what brings the quality of the content down.

And yes, I am saying that the linked article is worthless. Not because I just don't like it, but because I seriously doubt that the "huge market" would actually vote with their wallets to get that kind of content produced.

We don't need ad money to fund something like Wikipedia. Conversely, ad money is what makes Buzzfeed, Gawker and Jezebel to pass for journalism nowadays. And these are not even the worst around.

\--

I truly believe that people accepting ads as a way to get content is one of the largest disgraces for society in the digital age. I like to make the analogy with the corn industry and the government subsidies since the 70's. People wanted to get "cheap" food, and all they got was externalized costs. Years later we got an obesity epidemic, huge costs in healthcare and corn- ethanol, which is energy net-negative. The Advertisement industry does the same thing for our culture, our education, our civic values (slacktivism) and the economy at large. This "just a business model" is morally bankrupt.

<comment><USER16> 1) Ads work whether you care about them or not. Google isn't an exception to anything, they run ads and you either have a problem with ads or you don't. You're just more accepting to ad suggestions when searching since you're in a natural discover mode and Google is extremely relevant because you type your intent right into the search box, that's about as good as it gets.

2) The producers/manufacturers get all the data they want. Don't you think they know who's buying their stuff? The money comes from them to the agencies and ad networks so they will always know the most. And yes, marketing is a race because it works. They have to spend to get people aware and interested in their products and services. There's always a user acquisition cost, especially if you're competing with another company for the same user. It's not some made up thing. These companies aren't stupid. If they could do it without it they would.

3) Have you read the journalism that Buzzfeed puts out? They have an acclaimed hard news section and are partners with even the White House. They have several levels of content in depth and coverage, much like many other media companies. Again YOU are not the judge of quality and the mass market already spends lots of money on tons of things that are similar to what you claim is low quality media. It's just not that simple to suggest that certain things somehow don't value to someone else.

4) Wikipedia isn't a business. They don't do anything except host servers and have some developers building features. ALL of their content is user generated. No real business can work that way.

\---

It's FAR better to have democratic and free access to content rather than tying it to direct payments and vastly limiting access and amount. That is going backwards to the entire intent of the internet and the spread of information.

<comment><USER18> You misunderstood what I said about Google. I still don't care about the ads shown by Google (I run my ad blocker just the same). What I meant is that at least you have a point that Google can be more effective, for the reasons you mentioned. And if that is "as good as it gets", why should let other business take for granted that all they need is to get eyeballs and the ad money will come? It makes no sense.

Also... please, Buzzfeed _partnering with the White House_ is a sign of "quality news"? The quote "If you want something in the paper, that's advertising; you want something kept out, that's news" comes to mind.

> It's FAR better to have democratic and free access to content rather than > tying it to direct payments and vastly limiting access and amount. That is > going backwards to the entire intent of the internet and the spread of > information.

That is a false dichotomy. You can get free access to content without relying on ads as your revenue stream. Wikipedia is not a business and does it. Stackoverflow _is_ a business and uses the careers site as the main revenue source. We don't need an "Ads industry" to have quality content.

<comment><USER16> 1) Eyeballs = attention = what advertising is all about. Relevancy is a way to target to make best use of that attention but it's not required.

2) Why don't you actually read some of the BuzzFeed news: [http://www.buzzfeed.com/news](http://www.buzzfeed.com/news)

They have writers from NYT and WSJ amongst others on their staff. Put aside your prejudice and actually see for yourself.

3) Wikipedia isn't a business, but their business arm Wikia makes all their money on advertising. StackExchange makes all their money on advertising (those job postings are ads and other banners on their site). However both companies are not in the content business because all their content is user generated. That's why they have no costs other than technical upkeep.

A real content business requires people to actually create that content so your examples aren't relevant. Sure we can replace everything with direct subscriptions but that doesn't scale and severely limits the access to and quantity of content available. Those are the facts in the industry, there's no denying that, no matter how much you hate ads.

<comment><USER18> _> > Why don't you actually read some of the BuzzFeed news: [http://www.buzzfeed.com/news](http://www.buzzfeed.com/news) _

I did. Sorry to tell you, but they seem as "hard news" as CNN. It is infotainment. Most of the topics are still about what is popular, what can generate clicks and what can polarize. There is nothing in there that I feel I would pay to see investigated, studied or analyzed.

(1) and (3) The point I am trying to get across is that any kind of business is supposed to exist to support some kind of need for society. The "advertising industry" only fulfills any social utlity when it manages to efficiently connect producers to their target consumer.

If to do that, it needs to steal attention from people, it is not doing its job properly.

If the "advertising industry" ends up providing a system that makes people consume only things from the producers with more capital, instead of the best product, then the industry is not doing its job properly.

If the "advertising industry" ends up creating by collateral a huge mass of well educated people that depend on this "meta-work" of producing content that can be pass for journalism or entertainment, then it fails to fulfill its social function.

 _> > Wikipedia isn't a business, but their business arm Wikia makes all their money on advertising._

Society benefits from something like wikipedia. I can donate $25/year like I do to Wikipedia, and hope that enough people will contribute to it to keep it running. Good thing that Wikia can bring some funds and not have to rely on many more people. But if Wikia ceased to exist, people can still find ways to keep wikipedia around. If society loses wikipedia, we would lose a lot.

Now, if for some reason Wikia was not being profitable, do you really think society would be worse off? Perhaps for historical and cultural reasons, it would be bad to lose it - just look at all the work from the archive.org people. But look at Geocities: do you think society is that worse off without it? Would we be worse off without Wikia?

 _> > Eyeballs = attention = what advertising is all about._

To come back to my point: I do believe that there are cases where business manage to provide the social function of advertising (establish a communication channel between producers and consumers), but this "produce content and try to monetize it" with ads is not one such case.

\- The content that gets produced is of dubious quality (because the focus of the content producer is not in the quality of the content, rather how much of the people's attention it can grab)

\- There is no real connection between content producer and the producer paying for ads. So content producers may end up becoming crap-pushers without even knowing.

\- It makes for an uneven field for smaller producers. We live in an era where the cost of producing, processing and distributing information is almost zero. The balance of power could be completely in favor of the people. We HAVE the means of production of wealth in our hands. But because of advertising, we give this power back to the Capital owners. You describe your work as a "marketing platform for top brands". Let me tell you one thing: I WANT BRANDS TO BE DESTROYED. There is no real value in brands, except for the brand owners. They stiffle innovation. They created consumerism as a lifestyle.

I am all for free-market and minimal intervention on business. But you state a equation like this one where "attention" as something that can be extracted value from WHEN IT IS NOT FUCKING YOURS! It is immoral and you don't even see it.

<comment><USER16> I'm sorry but at some point I can't take it seriously if you just discount everything as bad. So what's "good" quality then?

You also seem to have some idealistic idea of what advertising is. It's not some efficient marketplace to connect people. It is an industry about attention. And no it's not "stealing" as everything in the world competes for attention. It's more of paying to capture that attention as best it can. There is no greater "social function" here.

Society benefits from all things. Again YOU cannot judge this based on some random questions about Wikipedia vs some entertainment publication. The careers of those mentioned in that publication and their livelihoods and families certainly benefit from it so it's all relative and there's no right or ideal.

There might be misaligned incentives for some publishers choosing to maximize revenue (that's not the bad thing since they are businesses) by focusing on improving ad load rather than content. That doesn't mean there's something wrong with advertising, only that that business has become focused on selling ads rather than producing content.

The whole last part of your statement makes no sense to me. Destroy brands? Why? What's that do? Do you know what brands are? They are just reputations, but at a higher level for corporations and product lines. You should read this: [http://www.economist.com/news/business/21614150-brands- are-m...](http://www.economist.com/news/business/21614150-brands-are-most- valuable-assets-many-companies-possess-no-one-agrees-how-much-they)

Attention can absolutely be extracted, it doesn't have to "belong" to someone because it's an abstract thing in itself. There is no "attention" tangible good. You have as much of it as you want. It's just a way to think of the value exchange. I'm not sure what you're so confused about but calling others immoral certainly isn't the way to prove your point.

<comment><USER18> > You also seem to have some idealistic idea of what advertising is.

When I mention a "social function", I don't mean a "public service". I mean in the utilitarian sense. Every economic activity has a social function. If you consider yourself to be living in a free society, for every kind of activity you do you are expected to provide some kind of good or service that is of interest of others. If it is considered to be beneficial only to one of the parties, it is not going to happen (unless it is done by force, but then we don't have an actual free society)

From brick layers to gas stations, from restaurant chefs to prostitutes, from Venture Capital Fund Managers to shoe makers to Hollywood. That is the case even to advertising. Advertising's "social function" is to inform the consumer public about what is available in the market at large, and to give to producers a chance to showcase their offerings. This may sound "idealistic", but it shouldn't be.

You seem to be focused on the "business" part of the things. As in "how to make money to keep that activity?" For society, this doesn't matter. If there is any other way to fulfill that need, the business is obsolete and can (should) go extinct or adapt into something else.

You have the arrows reversed: you want society to accept that the business needs to exist, and that it should change to support it. In fact, it is the business that needs to change to always support the needs of society.

Yours is the corporatist view. This view is what brings us the continued influence of RIAA and MPAA and DRM. It's what brings us poor-quality American cars. It is what brings "Food, Inc" thanks to subsidies in the corn industry. It is what brings us a society that is so drowned in "cheap" entertainment that leads to this dystopia we live in ([https://en.wikipedia.org/wiki/Amusing_Ourselves_to_Death](https://en.wikipedia.org/wiki/Amusing_Ourselves_to_Death))

> Destroy brands? Why? What's that do?

I don't say in the sense of setting corporate places on fire. I mean in the sense of being able to convince people that most of the time, there is a "brand-free" version of a product that is of equal or superior quality but that costs less.

Think of things like consumer electronics: most of the audio equipment or LCD panels can be virtually the same, yet people are so bombarded by ads from the "reputable brands", they can't even conceive or looking for an OEM factory.

Another example: at least in São Paulo I remember going to the mall and seeing "designer" jeans that would cost $100. Those jeans were produced in many different small shops around the city, spec'd by the "designer". The uncle of a friend of mine ran one of those shops. He would sell the "unbranded" version of the jeans for $15.

Another example: Go to any supermarkets, and you find "white label" products that are sometimes produced by companies that produce the very same "branded" version. The contents can be the same, yet the branded one will cost more.

What is the benefit of "brands" in these examples? How are the advertising companies helping people in making better informed decisions?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> There must be an error on that page. It is missing the part where they apologize and explain how they'll make sure that this never happens again. Oh, that part isn't there? Well...

<comment><USER20> As linked above:

[http://blog.pagefair.com/2015/halloween-security- breach/](http://blog.pagefair.com/2015/halloween-security-breach/)

So, that part is there. Note that the site posted is not the site that was affected by the breach.

</comment></comment><comment><USER21> This is why you own your infrastructure.

<comment><USER5> For the Economist, yes. The attack on PageFair was by spearphising an employee's email, so there isn't much owning your own infrastructure can do for that.

<comment><USER4> Sure it is... their external CDN account was compromised - no 2FA in place. Proper 2FA (read: 2FA reset key stored offline and safe, not done via mail) helps against spearphishing.

<comment><USER5> So for a business with their traffic needs, you'd recommend they do what? Buy up a bunch of physical locations all over the world and get some of OC lines?

I'd be shocked if they could stay out of the red, even at their size. Your proposal would also kill virtually every startup that needs a website.

<comment><USER4> No, that is not what I would recommend, so please don't label it "Your proposal".

My recommendation was already stated: if you use any external CDNs, make sure you don't fuck up those accounts. 2FA is one thing to safeguard against account compromise. Subresource integrity would be the next step, it's coming soon or is already here.

[http://caniuse.com/#feat=subresource- integrity](http://caniuse.com/#feat=subresource-integrity)

<comment><USER22> The problem with subresource integrity is that it ties you to one version of the code. That's fine for something like jQuery, but doesn't work in this case where you expect the code to change relatively frequently.</comment></comment></comment></comment></comment></comment>