Give better feedback to designers - <AUTHOR> http://weblog.muledesign.com/2010/12/giving_better_feedback.php

<comment><USER2> _There is no way to design a solution to an internal debate. Nor should that debate be passed along for your customers to suffer through._

I'm gonna file that away

</comment><comment><USER3> What's a comp? Is that when they get someone else to redo a bit of the design?</comment>


ActBlue CSRF Security Vulnerability Responsible Disclosure - <AUTHOR> http://rajk.me/actblue <comment><AUTHOR> Pasting the introduction here.

> Non-technical introduction. ActBlue is a non-profit that organizes > fundraising efforts for Democratic causes; so far they have facilitated over > a billion dollars in donations. This page details a security vulnerability > in the ActBlue donation system.

> tl;dr This vulnerability affects over three million individuals who have > donated to a Democratic cause using ActBlue Express Lane. Specifically, the > ActBlue donation system can be exploited to appropriate false donations > towards either the Hillary Clinton or Bernie Sanders campaigns. Using cross- > site request forgery, previous donors can be tricked into donating to other > Democratic candidates or causes.</comment>


Midesk: One tool for your news, market data and research projects - <AUTHOR> http://midesk.co/ <comment><AUTHOR> Hi, my name is Zuzana and I'm the co-founder of Midesk. I would like to share with Hacker News community, what we have been working on.

Midesk is an easy-to-use online platform that helps you organize your market intelligence work in three powerful hubs.

\- News Hub allows to store your news, connect your news sources and automatically extract metadata. You can add insights, create branded send-outs and easily distribute them with just a few clicks.

\- Baselines Hub gives everyone access to up-to-date validated market data for your organization. You can centralize all your market data and save a source with every data point. Midesk provides a dedicated central place for your KPIs, manage data transformation, source & currency management. It makes super easy to build business profiles.

\- Research Hub lets you consolidate all of your research documents, links and communication. It is one single place to collaboratively conduct all your projects in a research-ready environment.

Today, we're launching a new user online onboarding, making Midesk available to everyone. It means you can try Midesk right here: [https://midesk.co/](https://midesk.co/)

Any feedback is very much appreciated! Thank you, Zuzana</comment>


Exploring Lua Coroutines in ComputerCraft - <AUTHOR> http://spin.atomicobject.com/2013/04/26/lua-coroutines-computercraft/ <comment><USER2> I'm not exactly clear on how he's using coroutines to handle async callbacks. Can anyone help explain it?

<comment><USER3> Sure. I basically take the async callback and wrap it in a coroutine before I invoke it. If the coroutine yields back a function, I assume that that function can be repeatedly invoked until it returns a truthy value indicating it wants to resume. Unfinished coroutines are then kept in a table, and after each event from the ComputerCraft environment, I check the table of unfinished callbacks to see which ones can be resumed.

</comment></comment><comment><USER4> We do this a lot in Python (use co-routines and generators to break out of callback chains and make async code look synchronous). See Twisted, Tulip, etc.

Cool article... didn't know about ComputerCraft. Looks neat. :)

<comment><USER5> In Python terms, Lua is "stackless", in the same sense as Stackless Python (<http://www.stackless.com/>).

</comment></comment><comment><USER6> Has someone implemented the same subset of CSP as in Go, but done it in Lua? Could it be done? Does concurrency in Lua depend on everyone calling yield when they're supposed to?

<comment><USER5> Concurrency in Lua's core language is co-operative (coroutines explicitly yield to each other). This is because the language designers don't want to impose any particular threading architecture -- Lua is intentded to be as portable and non-opinionated about that sort of thing as possible. Its coroutines are intended for the same sort of issues as generators/callbacks/continuations, not for explicit parallelism. They won't do multi-core mapreduce, but they'll let you cleanly factor code that has multiple main loops.

You can get multi-threaded/multi-process concurrency by messaging between separate Lua VMs, using libraries such as Lua Lanes (<http://kotisivu.dnainternet.net/askok/bin/lanes/>). The Lua VM is implemented without static state, so several VMs can run in the same process without a GIL.

There is LuaPi (<https://github.com/LuaDist/luapi>), an implementation of the Pi calculus (a variant of CSP), but I don't really know much about it. I'm more familiar with Erlang-flavored concurrency models (and there's also ConcurrentLua, <https://github.com/lefcha/concurrentlua>).

<comment><USER7> In addition to that you may want to look at <https://github.com/loyso/LuaCSP> \- it is not implemented in Lua but it extends the language with CSP.

<comment><USER6> I wonder why this guy says FSM are non-composable? I've done something that could be termed as "orthogonal" combination of multiple FSMs. It's also possible for one FSM to "freeze" the operation of another and "unfreeze" a 3rd. I know, because I've done it.

</comment></comment></comment></comment><comment><USER8> Interesting. I havent used co-routines before.</comment>


Originality is not the only way - <AUTHOR> https://leveragethoughts.substack.com/p/originality-is-not-the-only-way-it <comment><USER2> True originality will be so different that barely anyone will like it.

Evolution is the way to go.

I'm an aspiring writer and when a random internet person comments on my short stories, they're focused on "oh it is like X Y" "oh it is like Z movie"

They're obsessed with finding which story it relates to rather than enjoying the story (and it isn't like I'm a pathetic writer)

I'm not saying I'm the best writers ever, but why I don't like such morons is that they don't have any otger constructive criticism like "your character sucked ass" or "dogs don't fall in love with cows"

No. Their entire problem is "oh I saw a movie like this and that's why this is a shitty story"

These morons fail to realise that LoTR derives heavily from Mythology, GoT is literally a fiction version of War of Roses

But these snobs will love and swear by LoTR because "that's original" and other books are "copy cats"

The idea doesn't matter, execution does.

Sure Gone Girl came first but girl on the train is also a good book. It isn't "copy cat" just because it has a untrustworthy narrator. Gone girl wasn't the first one to have untrustworthy narrator, I think

<comment><USER3> The Unreliable Narrator is an old trope. [1]

Gone Girl has stellar writing. I don't think commercial success in fiction has much to do with being first to market with a novel idea.

[1] [https://en.m.wikipedia.org/wiki/Unreliable_narrator](https://en.m.wikipedia.org/wiki/Unreliable_narrator)

<comment><USER4> > _I don't think commercial success in fiction has much to do with being first > to market with a novel idea._

Commercial success in _anything_ doesn't have much to do with being first with a novel idea - in general, but also in "first to market" sense.

Video games: before Minecraft there was Infiniminer (by none other than Zachtronics Industries). Before Portal there was Narbacular Drop.

Mobile: before iPhone and iPad, there were other devices with a touchscreen on the market (and they had a stylus, benefits of which people are slowly rediscovering today), and the concept dates all the way to Alan Kay's Dynabook, and in parallel to Star Trek (not just 1960s communicators and 1980s PADDs, but Star Trek in 1960s also portrayed tablets with a stylus attached).

Etc., etc.

</comment></comment></comment><comment><USER5> The cult of originality is reinforced by the current (psychotic) reliance of academia on papers, which, structurally, must be original to be considered significant.

Historically, tradition was more important than originality. Logically this makes sense: most new ideas are more likely to be bad than the current set of ideas, settled on in a somewhat darwinian manner.

In many fields the cult of originality isn't too damaging: you get a lot of useless "original" stuff that is quickly forgotten and discarded. Pointless and expensive, but ultimately of little importance.

Architecture, unfortunately, is an area where the cult of originality has done real damage to the actual, physical world. There are power stations built by anonymous journeymen in obscure parts of the US, using pattern books, with more architectural merit than much of the stuff built after WW2. We now put expensive lofts in what were once storage sheds in major cities, because they were built when tradition was still a functioning factor in building.

htmx, to an extent, is an example of something that mixes originality and tradition. It takes the traditional understanding of HTML and web development (itself an original idea!) and adapts that to AJAX.

<comment><USER6> I agree with most of the post but I don't think academia is generally obsessed with originality. A lot of academic work is explicitly incremental by nature, which is determined by the methodology of academic work, which aims to satisfy formalisms and to be reproducible (at least ideally). One just needs to look at the turmoil that the proof of the abc-conjecture caused in maths.

I associate forced originality more with Silicon Valley startup culture, which used to look down on places like China not too long ago for copying on every opportunity it got, and there was probably one blogpost per week complaining about rote memorisation in education and deschooling their kids coming out of that culture.

<comment><USER7> Academia is obsessed with "novelty" which is a weaker form of originality. Very frequently there are ideas which are an obvious next step to everyone in the field, but the first person to actually implement and publish it is the one who will get the credit / future citations. I wouldn't consider those kinds of ideas original because many people already independently conceived them and are working on implementing them, but they are novel in that they haven't been instantiated before.

</comment></comment></comment><comment><USER8> "Your manuscript is both good and original; but the part that is good is not original, and the part that is original is not good." — Samuel Johnson

</comment><comment><USER9> Originality is great and all but if there's already a known, tried and tested approach, and you can't see a way to significantly improve it, you should just use il the known approach and save your ingenuity for problems that _aren't_ yet satisfactorily solved.

<comment><USER10> Depends on the context, trying something just because it's new can be useful. You may diverge from the known methods/apparatus and eventually establish something better (in some dimension) than what's common. You may find you gradually converge on the known methods from a different angle; this can lead to understanding - like now I know why they do it like that!

Context is whether it's appropriate to do such experimenting and exploring.

Most new patents are for incremental improvements. Suggesting most people start from what's known to a high degree.

If you've got the resources though, why not try something ...

<comment><USER9> Yeah, basic research is also important if you have the spare capacity to do it.

</comment></comment></comment><comment><USER11> I don't agree with the author definition on what is original:

Copying Standard Oil solution (different industry) when it was faced with an equivalent problem, was an innovation in meat transportation. It's an original idea In it's own right, nobody did that before, it wasn't tested, there were no guarantees that "oil solution" would work also in meat.

<comment><USER12> An refrigerated transporters are not the most efficient way to transport meat

To transport lots of meat, we can look at the oil industry again and move it up to the next level: meat pipelines

<comment><USER13> I hate to think what the meat equivalent of Cushing, Oklahoma[1] might look and smell like.

[1] [https://en.wikipedia.org/wiki/Cushing,_Oklahoma#Transhipment...](https://en.wikipedia.org/wiki/Cushing,_Oklahoma#Transhipment_point_for_West_Texas_Intermediate_\(WTI\)_oil)

<comment><USER14> Going in the other direction, meat was the original pipeline. Before motor (and then frozen/chilled) transport, meat would walk itself, without needing to load any wagons, from the pastures where it fattened to the butchers near where eaters lived.

</comment></comment></comment></comment><comment><USER15> Loaded premise. No one in my whole life has claimed originality is the only way, except in case of academic publishing, in which case, yes it's the only way.

</comment><comment><USER16> So much of our neural infrastructure is geared towards understanding what other things are doing, and copying them. The fidelity error in the do-it- myself is what we call novel/original behavior. It is the tiny tip of the iceberg residing on top of an enormous copy-paste machine.

</comment><comment><USER17> There seems to be an infinite supply of think pieces like this on Substack. They cover mental models, productivity, startups, why your product should be more like Stripe, tech brain[1], etc.

I guess if you pump out enough pieces like this over a long enough time horizon, you get "1k true fans" or something.

[1]: [https://pycnocline.substack.com/p/tech- brain](https://pycnocline.substack.com/p/tech-brain)

</comment><comment><USER18> Another example is most news articles are just adaptation of AFP or Reuters reports

<comment><USER19> Or direct copies - [https://www.youtube.com/watch?v=ksb3KD6DfSI](https://www.youtube.com/watch?v=ksb3KD6DfSI)

</comment></comment><comment><USER20> This is one of the reason for the success of StackOverflow

</comment><comment><USER21> Part of a series on Cognitive Dissonance</comment>


The No CAPTCHA problem - <AUTHOR> http://homakov.blogspot.com/2014/12/the-no-captcha-problem.html? <comment><USER2> This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite some time for anything but dedicated human-based attacks.

Granted, I think the checkbox CAPTCHA is much better than the UX disaster that is the 'type some hard-to-read letters' CAPTCHA, but it's still adding a burden on the user, rather than a burden on the bot.

(Source: I maintain the Drupal Honeypot module[1], and have used it in a ton of different situations where CAPTCHA/reCAPTCHAs would normally be recommended).

[1] [https://www.drupal.org/project/honeypot](https://www.drupal.org/project/honeypot)

<comment><USER3> The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam.

In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ([http://deathbycaptcha.com](http://deathbycaptcha.com)). What nocaptcha does is only show that captcha (which is already defeated), to a certain subset of the users who haven't been deemed trustworthy. So, the big bot builders will take a day or two and beat the system, and we're right back to where we started.

Honeypots, however, are brutal - especially if you throw a couple in there. When building a bot you build it for efficiency. If your site does anything abnormal (whether it's 'what's n+n?' or 'what popular figure comes through your chimney in December?') a bot is hopeless.

That being said, however, a bot is only hopeless so long as a solution isn't implemented widely enough to be worth breaking through for spammers. If, for example, Wordpress came up with 1000 questions like that, someone somewhere would come up with and sell 1000 solutions.

In some sense it may be the case that Google is one of the worst companies to create a a simple anti-spam API. I'm sure there's something they could do that would be more effective than this, but this won't really move the needle.

<comment><USER4> With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer

"what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia"

"what's 1+1" -> "2"

They only really work if maybe the question is in the market of the site you're registering for "What's <some popular guy on site>'s last name" etc

<comment><USER5> Well the Santa Claus question will defeat bots for now at least... [http://imgur.com/qX8pWrQ](http://imgur.com/qX8pWrQ)

<comment><USER6> That didn't take very long.

</comment></comment></comment></comment></comment><comment><USER7> I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics.

If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third- world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which selects the right pictures. Result: Google will see a single IP and cookie trying out 1000s of captcha's a day, and ban you. Scenario 3: We let the clickfarm send the answer to our own bot, this bot uses a list of proxies that haven't yet been banned. Result: Google will see a single account cookie trying out 1000s of captcha's a day, from different IP's and ban you.

Can anyone come up with a scenario which involves reputation, IP and cookie that does not end up with Google detecting and banning your efforts? Cookie swapping?

<comment><USER8> Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies.

Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong.

For a simpler case, private browser sessions over a VPN would suffer from the same issue.

<comment><USER9> I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.

<comment><USER8> I see where you are coming from, specially considering that spam makes up for a significant volume of the entire internet traffic. However, I'd think it wiser for one spammer to go free than for one person to be denied access to legitimate content.

I'm often being denied access to free content because I'm accessing from the "wrong" countries, and that's infuriating. If I start being locked out of free content due to my privacy measures, I'm probably going to start setting buildings on fire.

<comment><USER10> Do you think content creators should not be able to control access based on their own criteria? Are you somehow "owed" access rights to free content?

<comment><USER11> I'm not probably_wrong, so I can't speak for him/her.

But while _I_ believe content creators should be able to control access, I think it's ridiculous to ban certain countries from access to certain content -- I don't quite see the point.

And also, being "owed" free content != being able to access free content you otherwise would be able to access were it not for a service like TOR or a VPN (e.g. escaping the Chinese firewall using a VPN service whose IP is banned from a website versus wanting to watch a movie but living in Germany instead of the U.S.)

</comment></comment></comment></comment></comment></comment><comment><USER12> I have a hunch that it is Google's attempt to be on every form and know more about a Google user and their accounts on other websites. At least what websites they signed up for. I can stop Analytics but this is now out of my control. This is what a website owner required me to do to access their website.

<comment><AUTHOR> Oh, it's already too late. Google already has enough data about you. I can imagine the future - people train bots like kids, make them visit different websites, google things and pretend to be humans. Your search history will be like your credit score.

<comment><USER13> I wouldn't be surprised if approval for a Visa depended on your search history.

<comment><AUTHOR> Oh yes [http://newsfeed.time.com/2012/01/31/british-tourists- tweets-...](http://newsfeed.time.com/2012/01/31/british-tourists-tweets-get- them-denied-entry-to-the-u-s/)

<comment><USER14> It's a story about american airports it is to be expected. You should probably give your nose hairs a good trim someone might think you're going to pluck the longest one out and strangle the country to death.

</comment></comment></comment></comment></comment><comment><USER15> What is the No CAPTCHA problem? What's being described here are problems that apply to all CAPTCHAs. Whatever 'human' detection system you put in place, humans can always be hired to solve them. The point of No CAPTCHA is not to fix these problems, it's to make it easier for 90% of people who don't care too much about cookie privacy etc. (or most likely have no idea it's even a thing).

<comment><AUTHOR> The problem itself is described in the end: it's about using clickjacking to get a valid token on behalf of "good guys". And this problem has nothing to do with existing systems.

Google could have made it so much easier and more secure: a POST request to google.com/verify_me will have Origin header in it to prevent CSRF (only wordpress.com scripts will be able to get token). Also there would be no need to make a click. No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!

<comment><USER16> "No CAPTCHA looks fancy but the real No CAPTCHA should always have visibility:none!"

I agree, but I suppose they want something that's a Placeholder, if the user needs to type a captcha

<comment><AUTHOR> Why? If no need to type any captcha - do the verification in the background, don't show me anything until you think I'm a bot

<comment><USER16> Because of page layout. Having a fixed size element is better than having something (that is not yours) that might be there or not.

<comment><USER17> There's still no need for a click.

<comment><USER18> IMHO the need for a click is just to lazy loading and thus, reducing server demand

<comment><USER17> Couldn't they just trigger that on form submission, then? "Please wait while we confirm you are human" is better than clicking and then waiting, and then submitting upon completion.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> How many photos are in the universe of possible photos? How long would it take for outsourcing the process to tag all photos so a script could then do the matching?

Is the whole point of this to encourage hackers to get working on this AI challenge of identifying similar photos?

Either they need to hire a lot of people to sit around making these sets or they have an automated way of creating these sets which can be reversed. It would seem to be an arms race where google is paying people, but attackers can have people break it at a cost less than creating them (takes less time to match them up then to find good photos, clean them up, tag them, etc.).

An attacker would also just target the database where this is all stored. With the text recaptcha, it would seem that they have all of these photos and scanned books and you have 8+ character strings of [a-zA-Z0-9], random guessing would not be good enough, so the attacker needed to solve the OCR problem.

However, given the option to select x of 9 images, if you assume that the extremes are less likely of 1/9, 2/9, 8/9, 9/9- then I can hope to get lucky picking 4 or 5 each time, the order does not matter. If you distribute the attack to get around rate limits, etc. - perhaps just picking the first through fifth images gives you a sufficiently high success rate.

<comment><USER20> I think a good chunk of the images are captured by way of Google's Streetview vehicles [1]. I'm seeing blurry images of house and apartment numbers all the time. So I'd imagine there are always new images popping up that Google can feed into the recaptcha system that haven't been seen before.

[1] [http://www.google.com/recaptcha/intro/#creation-of- value](http://www.google.com/recaptcha/intro/#creation-of-value)

<comment><USER19> Correct, I am referencing the new nocaptcha system. Those images would get stale as opposed to those in the traditional scanned book, street signs, house numbers in the recaptcha.

</comment></comment></comment><comment><USER21> I see this from totally a user experience side. NoCAPTCHA isn't about defeating spam (you're right, the spammers are going to solve it/hire someone to finish the job etc) - it's about making a better experience for the humans, while slowing down the spammers a bit. (contrary to current recaptcha system that slows down spammers a bit or not at all, and makes life mostly more crappy for humans)

</comment><comment><USER22> People love not to think... Google is a business and the primary objective of any business is to make money (the vision/mission and others is for the people who love free lunch) Why captcha? to provide a service in a trade for "free" human recognition capabilities.

Q//But google now is better at recognizing those numbers.... A//Right... that's why they now request the next "way to expensive" to implement "free" service from you, your recognition... and association capabilities.

<comment><USER23> >>People love not to think

O_O

judging by the comment you wrote right after that, I would assume you are one of the people who likes not to think.

They are making people click checkboxes and deviating from the old model of recognition. Your comment makes no sense.

<comment><USER22> Yeah every once in a while... a little bit of heuristics, a little bit of laziness.

</comment></comment></comment><comment><USER24> Interesting perspective on the changes! Our lead designer actually had similar concerns (can read them here: [https://www.funcaptcha.co/2014/12/04/killing- the-captcha-wit...](https://www.funcaptcha.co/2014/12/04/killing-the-captcha- with-black-boxes-and-false-positives/)). You both look to be drawing the same conclusions. What are your thoughts on the metaphorical 'black box' being implemented into the new reCAPTCHA?

</comment><comment><USER25> The picture recognition test is particularly annoying. Even in their example, of "match this" (cat), are we to assume we're matching all cats, or just cats of that color?

If they have to make very careful sets of photos to avoid confusion, then the sets of photos will be small enough to build lookup libraries for bots.

</comment><comment><USER26> I'm reading this page: [http://homakov.blogspot.com/2013/05/the-recaptcha- problem.ht...](http://homakov.blogspot.com/2013/05/the-recaptcha-problem.html)

Why don't they just invalidate the current challenge when a new one is requested? :S

<comment><AUTHOR> There's no session ID for current user. They can try to use IP as identifier. Admins can send remoteip to google to prevent spoofing but that parameter is optional and I suppose they don't rely on it.

<comment><USER26> ... Okay, why not establish a session then?

<comment><AUTHOR> Would require an extra roundtrip... Problem is that you get challenges with client side and solve it with server side. It's _website_ who should go, get a challenge for you, put it in your session cookie and make sure you don't go and get another one. Which complicates it a lot

</comment></comment></comment></comment><comment><USER27> Trigger warning: passing the CAPTCHA on homakov's demo page ([https://homakov.github.io/nocaptcha.html](https://homakov.github.io/nocaptcha.html)) registers an account (blog?) at wordpress.org.

</comment><comment><USER28> Another shameless plug - [https://hashcash.io/](https://hashcash.io/) :)

<comment><AUTHOR> In your demo I'd be more careful with user input

>$url = '[https://hashcash.io/api/checkwork/'](https://hashcash.io/api/checkwork/') . $_REQUEST['hashcashid'] . '?apikey=[YOUR-PRIVATE-KEY]';

hashcashid can change URL completely to something like ../../newpath?newparams#

<comment><USER28> it is always battle between make it simple to understand and bring best practices... in this particular case i chose simply to understand :)

</comment></comment></comment><comment><USER29> The goal isn't to make things harder for bots, it's to make things easier for users.

<comment><AUTHOR> they made it easier for users _and_ for bots :)

<comment><USER29> It's no easier for bots. They still have to answer the old OCR challenge or a computer vision problem.

<comment><AUTHOR> Using clickjacking we can get lots of valid tokens, no need to solve challenges.

<comment><USER29> You don't think Google will figure something out when a bunch of tokens from different IP addresses are all being used by one IP?

<comment><AUTHOR> It can be helpful. There's (optional!) remoteip parameter server can use to send google IP address of current user. As in wordpress demo sometimes we can send requests with the browser.

<comment><USER30> And additionally it's easy to just create empty Google accounts and then use them with the bots. Just create a few dozen accounts, use them with a few hundred bots, and you easily get full verification.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> i think there are big issuses on the horizon here, it's going to get increasingly difficult to find simple problems that humans can solve and not bots. i'm not sure there is a fundemental answer

</comment><comment><USER32> Google New reCaptcha using PHP - Are you a Robot?

[http://www.9lessons.info/2014/12/google-new-recaptcha- using-...](http://www.9lessons.info/2014/12/google-new-recaptcha-using-php- are-you.html)

</comment><comment><USER33> That's quite funny

</comment><comment><USER34> No CAPTCHA reCAPTCHA is not all Google is claiming it is. It only works if you're logged in to the site, so what's the point?

See [http://ur1.ca/iza9d](http://ur1.ca/iza9d)

</comment><comment><USER35> Random blog article destroys entire Google team of high paid professional engineers specifically employed to solve this problem and they did it just using incognito mode.

Upvote FTW.

<comment><AUTHOR> Lol no, i simply found original article too promising with minimum technical details so I decided to dig. And a weakness is a weakness, not a vulnerability. Something to think of.

</comment></comment><comment><USER23> Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time.

Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a whitelist based on your previous online behavior, CAPTCHAs you solved.] and that you believe it, I would question your intelligence.

This is supposed to be tech savvy community at least to some degree, what the fuck.

Now, in the google's blogpost it reads [Advanced Risk Analysis backend for reCAPTCHA that actively considers a user's entire engagement with the CAPTCHA—before, during, and after—to determine whether that user is a human.]

[However, CAPTCHAs aren't going away just yet. In cases when the risk analysis engine can't confidently predict whether a user is a human or an abusive agent, it will prompt a CAPTCHA to elicit more cues, increasing the number of security checkpoints to confirm the user is valid.]

So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements, time it takes to type out the words, spelling mistakes corrected and whatever else humans do differently than bots - and only then combine that with your historical cookies. Maybe it is much more complicated than that, I, as well as you, don't know the details.

Do you really think that they would go ahead and implement a such system without rigorous testing of effectiveness? I am sure that they tested it extensively with users, AND with bots, and decided that it is better than the current system, and ONLY then deployed it. Rant off.

<comment><AUTHOR> >So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements

If they can track mouse movements why in incognito mode i'm not a human for them anymore? I was expecting same but from what I see it's just a whitelist. And it's OK. Problem is, which you probably didn't care to read, is it's vulnerable to simple clickjacking which opens another weakness - i can use your click on my page to get your reCAPTCHA token and feed it to my spam bot.

I'm actually happy with No CAPTCHA, because it's making progress. But it's not good enough (see the rest of comments, it could be a background AJAX request instead).

<comment><USER23> >>which you probably didn't care to read

I did read it. My point is, you, or I, or anyone for that matter does not know the inner details of how it works.

>>If they can track mouse movements why in incognito mode i'm not a human for them anymore?

Maybe having a clean cookie history is not good enough during the risk assessment.

Look, my entire point is, google is not a joke company. I am certain that they tested it for effectiveness before deploying.

<comment><AUTHOR> > I did read it.

So what do you think about clickjacking issue? I made an assumption about their algo and maybe I'm wrong and they do track your mouse, but there's _exploitable_ weakness. My post is 1) your algo seems simple 2) here's a bug in it.

<comment><USER23> The curious thing is, I could not replicate the clickjacking issue. Everytime I make a click on original wordpress registration page, I am verified as a human immediately.

If I do the click on your github page, I get a challenge. My clicks were never accepted as human on your github page. My clicks were always accepted as human on wordpress page.

<comment><AUTHOR> No incognito tab? Maybe they fixed it</comment></comment></comment></comment></comment></comment>


Kubernetes 1.4: Making it easy to run on Kubernetes anywhere - <AUTHOR> http://blog.kubernetes.io/2016/09/kubernetes-1.4-making-it-easy-to-run-on-kuberentes-anywhere.html <comment><USER2> Huge congrats to the team - \- Incredible simple setup [1] \- Stateful application support with integrated Helm [2] \- New cross-cluster federation features (secrets, events and namespaces, and lots more in alpha) [3]

And lots more... please let us know if you have any questions!

[1] [http://kubernetes.io/docs/getting-started- guides/kubeadm/](http://kubernetes.io/docs/getting-started-guides/kubeadm/) [2] [https://github.com/kubernetes/helm/blob/master/docs/charts.m...](https://github.com/kubernetes/helm/blob/master/docs/charts.md) [3] [http://kubernetes.io/docs/user- guide/federation/](http://kubernetes.io/docs/user-guide/federation/)

Disclosure: I work at Google on Kubernetes

<comment><USER3> Well yeah it looks great. However for ease of use in "small" scale. it would be cool to have a built in Load Balancer (a pretty pretty simple one, just http, maybe https via LetsEncrypt).

At the moment adding a Cloud Load Balancer per Project is probably not affordable in the smaller project scale (and it would make any PaaS useless). (I mean that is not a "big" problem, it's ok to build it myself (with less quality than you can ;))

But I wanna say Kubernetes is extremly good designed and the amazing part is, is that you can start with a really really really really small cluster (like 1 master 1 node) and later you can raise that pretty easily

<comment><USER2> We've heard this quite a lot - there's actually a few ways to tackle this, one of the most common is to either use Ingress (which is a built in L7 load balancer) or run an nginx instance in a pod on the cluster ([https://github.com/nginxinc/kubernetes- ingress](https://github.com/nginxinc/kubernetes-ingress)), and, in either case, direct all traffic to your node port across your cluster.

It's really one command to do either - if you have trouble, please ping me (aronchick (at) google)!

Disclosure: I work at Google on Kubernetes

<comment><USER4> Is there a way to do this properly in AWS without nginx? It would also be great to have features to switch only percentage of the traffic to an app when doing blue/green deployments.

<comment><USER2> The best way to do blue/green is put them behind a single endpoint. So, if your endpoint is 'app: node-app', then you put the label 'app: node-app' on BOTH your existing version, and your future version, and target all traffic to a service with the selector 'app: node-app'.

Then, you slowly start to spin up your new instances from 1 -> 10 -> 100 (or whatever). The traffic will split automatically because both apps have the same label/selector, and you control the amount by how many instances of each you have.

Disclosure: I work at Google on Kubernetes

<comment><USER5> does kubernetes take care of 'connection draining', ie making sure requests in flight are completed before killing traffic to an instance?

<comment><USER6> Sort of a blend. It will send a sigterm to your process first which should be your signal to start draining and exit when they are done. If you don't finish within a configurable timeout then sigkill is sent.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I feel that the homepage at kubernetes.io is a poor introduction to the project. All the keywords and short descriptions don't add up to a complete picture of what Kubernetes does and why someone would want to use it. The opening tagline "Kubernetes is an open-source system for..." seems like a complete description of the project, but to a _newcomer_, the sentence is not easy to parse.

The "What is Kubernetes?" page [1] gives a very clear overview of Kubernetes that will make sense both to people who already know about containers in general and those who are new to the concept.

Can someone help me understand what type of person the homepage is targeted at? It just doesn't do anything for me. I'm mainly interested because I find that a lot of projects have very poor home pages, even if the rest of the project is awesome.

[1] [http://kubernetes.io/docs/whatisk8s/](http://kubernetes.io/docs/whatisk8s/)

<comment><USER8> Absolutely – as someone looking to enter the container orchestration space, I have been spending time evaluating Docker Swarm (1.12) and Kubernetes. While consensus seems to be that Swarm is immature and "productionability" is questionable, Docker's documentation, while by no means perfect, was by far more approachable than whatever Kubernetes has thrown together.

Perhaps that comes as consequence of Docker shooting for the all-built-in approach, but I'd like to see a better overview and ramp-up in the Kubernetes space – their "101" and "201" docs are laughable.

<comment><USER9> We are trying to improve the documentation and developer experience. Please try the new kubeadm install docs and let me know what you think.

[http://kubernetes.io/docs/getting-started- guides/kubeadm/](http://kubernetes.io/docs/getting-started-guides/kubeadm/)

Disclosure: I wrote the doc (but don't work at Google) :)

</comment></comment></comment><comment><USER10> I've been looking at moving our system to Kubernetes, as it seems mostly cloud agnostic and should work well for our use cases. However, I was put off by the somewhat ad-hoc set of installation methods which mostly seemed to boil down to "Run a big opaque script that does a thing to specifically work with your provider".

Really glad to see a dead simple setup - I'm not exactly unfamiliar with operations or containers or Linux or anything, but a turnkey setup so I can play on my DO effortlessly to get an idea is really nice! And I only started looking recently, so having `kubeadm` available now is quite convenient.

<comment><USER11> If you want a completely non-opaque way (or just see the steps in general) of installing Kubernetes, check out Kubernetes The Hard Way [1].

That said, `kubeadm` is a great addition!

[1] [https://github.com/kelseyhightower/kubernetes-the-hard- way](https://github.com/kelseyhightower/kubernetes-the-hard-way)

<comment><USER12> Note that "Kubernetes The Hard Way" is mostly focused on teaching you what happens during cluster bootstrap.

It is NOT a production-ready setup in any form. You should investigate which alternatives exist for your platform (e.g. GKE for Google Cloud, kops for AWS).

</comment></comment></comment><comment><USER13> Recently I was at a docker meetup and one speaker really embraced Docker for everything. So his only prequsite was an installed docker daemon.

The setup scripts to turn a daemonized docker server into a cluster were all published as a docker image themselves.

So installation was mainly a docker run away whereas he used the shell evaluation of a subshell to start the actual docker run, e.g. $(docker run ...imagename) would print the actual docker command which will in turn contain volume mount options to the docker socket to help setting up the whole machine.

It was quite fascinating to watch this bootstrap method without relying on any package manager but solely a docker engine deployment.

So what I am saying this that this would be an interesting deployment approach for Kubernetes as well.

<comment><USER14> Something like this? [https://coreos.com/blog/self-hosted- kubernetes.html](https://coreos.com/blog/self-hosted-kubernetes.html)

<comment><USER13> Thank you

</comment></comment></comment><comment><USER15> Would anybody like to shed some light about how openshift origin relates to K8S in general? I would like to better understand which path to follow. Which advantages has openshift origin over "pure" K8S? Thanks!

<comment><USER16> OpenShift adds a lot of features around building applications from source and authoring those applications as pods in Kubernetes. If you already have a build pipeline set up you may want to stick with pure Kubernetes.

They also have an ansible based installation process that makes your cluster a lot more production ready than the basic Kubernetes scripts.

For me OpenShift is comparable to Heroku or Elastic Beanstalk where developers can deploy applications from source without knowing a lot about the underlying infrastructure. Of course you still need an ops team to manage OpenShift.

<comment><USER17> Another significant scenario is tenancy - if you are just using Kube for a single team / set of apps, most of the security and policy in OpenShift isn't useful for you. But if you want to share access to that cluster, the security and policy and integrated rbac can allow many teams to collaborate on their own applications and self-service. So platform for others vs platform for ops.

(I work on OpenShift and Kubernetes)

<comment><USER18> Isn't much / most of that RBAC upstream in k8s 1.3 (code from Openshift written by redhat engineers like yourself)? What is still in Openshift related to AAA that isn't upstream now?

<comment><USER17> Still a fair amount of the glue and interspersed code that wires it together sits outside, plus the user management code (user, group, identity integration to all the various providers). Also all the out of the box default security. Part of the benefit of being slightly apart from Kube initially (which we did because we had way too many things we wanted to bring together to put into Kube at the time) is that we could be opinionated and say things like:

* every component will use client cert + TLS + specific authorization roles to interconnect

* no ability to configure the cluster without those on

* default to secure by default, be opinionated about authz/n

* lock down _everything_ that could be abused (like letting end users change ingress IPs on services, or direct volume mounting)

* make namespaces the unit of tenancy and restrict regular users from modifying most things in namespaces that impact policy

The raw pieces are in Kube now, but effecting the same opinionated defaults while still preserving the flexibility many in the community want (like direct Keystone integration, or no restrictions on pods by default) will take some time. Our goal is to get there in a way that also makes Kube more extensible and flexible - I don't believe everyone _needs_ everything we believe in, but by doing it in pieces we do get to ensure it's possible for someone else to do it.

<comment><USER18> Nice! Well I'm a huge fan and follower of your work, so do please keep it up. I appreciate your willingness to eradicate ignorance (mine!).

</comment></comment></comment></comment></comment></comment><comment><USER4> Great stuff, happy to see this, especially the part that concerns the setup of the cluster, but still too much in early stages. Currently I'm learning a lot on how to get started on AWS and it is still a bit too painful... after using GKE you just don't want to deal with the manual setup.

<comment><USER19> You should check out kops. It seems to me like its one level of abstraction above kubeadm, and makes creating clusters on AWS _ridiculously_ easy (one command).

<comment><USER20> I'd like to try out kops, it sounded good. But step one was setting up a zone on route53, we don't use route53. Kube-aws from the coreos folks makes the same assumption, but is still useable, however it doesn't have multi-az capability.

I love kubernetes and I can't wait for the tooling to mature. I'm about to give 1.4 a spin and see where things stand.

<comment><USER21> You can use Route53 for just a subdomain even if your parent domain is not done through Route53, see [https://github.com/kubernetes/kops/blob/master/docs/creating...](https://github.com/kubernetes/kops/blob/master/docs/creating_subdomain.md)

</comment></comment></comment></comment><comment><USER22> So you want to be a devops hero? Obtain google borg inspired container scheduling and management? It's a powerful abstraction, and I've enjoyed using K8s over the last year. However, like most freely available software, there is work to be done.

Here is my take on the state of things:

1\. Still very much in rapid development, with features coming at a breakneck pace. I think Kubernetes is sold as production ready a bit too hard - it takes a good amount of effort to make a cluster production ready for anything non- trivial. Expect to contribute PRs to fix the issues you run in. It's probably easiest to use GCE since this has the most active development, I think. Otherwise, Openshift (Redhat's production fork) for on-premise installation. AWS is in a somewhat working state, with many improvements coming (what I'm using).

2\. The maintainers are very open to contributions and discussion. PRs are generally accepted within a couple weeks (and given the volume of issues/PRs this is quite amazing). kubernetes.slack.com is a great way to talk to many of the core developers. I wish they had a slack subscription, so we could search the very rich chat history. A lot of stuff is missed unless you read the chat rooms daily.

3\. My impression, which could be totally wrong I admit, is that much of the discussion for big changes seems to happen among the core Google & Redhat engineers offline. I wish the project used an open mailing list for these discussions, or did it in Slack (with a slack subscription, so history is available), or some other recorded text means. I don't think the current mechanisms scale to the size of the project and needs of the users.

3b. A lot of time seems devoted to things like scaling to 1000+ nodes, when fundamental things like kube-proxy are broken for basic use cases, in my opinion (kube-proxy uses an iptables hack for VIPs which leads to problems like the connection tracking table filling up and broken keepalive connections during deployments).

4\. The provisioning scripts provided were traditionally pretty poor, kube- addons is a broken shell script mess. Fortunately, this is improving quickly. kops/kubeadm help with the provisioning, coreos is doing lots of work here as well, daemonsets to replace kube-addons, and so on. So this area is improving quickly. But expect to do work here if you're serious about using Kubernetes for prod. I'm using ansible/terraform for this.

5\. Ingress (external access to your cluster), is still adhoc. This requires custom dev and testing to setup.

<comment><USER23> Just a few comments.

1\. GKE (Google Container Engine, GCE is compute) lags weeks behind any k8s release so if you're looking for bleeding edge it really isn't the best system, you're better off managing the cluster yourself. GKE being bumped to a recent version seems to be a private matter decided by a few Google employees, so you're never sure at all when you're going to get 1.37 or whatever version that is multiple sem-minors behind. It seems like it's usually about 2-3 weeks but I've never found any discussion or issues about its status so I wind up just checking every few days to see if it's been released. I have a mission critical feature that's being released (I hope) with 1.5 (IP persistence for sockets) and it'd be really nice to be able to follow the decision making process. Or at least have some understanding of what it entails (3 weeks of no major issues? GKE specific bugs? someone comfortable enough to release the hounds?)

5\. I've had nothing but headaches with Ingress deployments. I'd wager it's by far the most brought up topic on the k8s slack. The documentation is all over the place and it seems like every example is completely different from the last, albeit there's never any explanation as to why exampleA is different from exampleB but does the same thing. Then you throw in annotations that might be required and IIRC unless you're reading the go docs you wouldn't know anything about them.

<comment><USER24> GKE is currently 4 days behind OSS. That's hardly "weeks behind". 1.4.0 is available in GKE _right now_.

<comment><USER23> Yeah, that's a recent change and much appreciated. I was on 1.36 for quite awhile. The milestone mentioning the release dates to various regions is great, too. Not sure if that's always been there and I overlooked it, though.

</comment></comment></comment></comment><comment><USER25> I saw the mention of "Curated and pre-tested Helm chart", I am curious if anyone is running databases on Kubernetes?

<comment><USER26> Yeah, you mount them on a pvc and they'll get their storage reattached.

</comment></comment><comment><USER27> Great work. What should I make of that ScheduledJob is in alpha?

<comment><USER28> It means it's new; the API might change before it makes it through beta and into stable.

</comment></comment><comment><USER29> I was trying to write a tutorial about how to setup Kubernetes on bare metal. I have created etcd cluster of 5 nodes that checks certificates of clients that communicate with it for security. Sadly I found that at least one command in Kubernetes is either not using provided certificates or I am doing something wrong. I can see that entries get created in etcd, so certificates are definitely correct, but kubectl get cs shows that etcd cluster is not healthy. Given that I see some parts of Kubernetes talk with etcd fine, but I am not able to tell the scope of correctness I am kind of blocked. I don't know whether this is something being worked on, or maybe should I look into it and possibly fix. Tried to ask on Kubernetes Slack, but nobody seemed too interested in this. I am guessing everyone is running etcd without checking certificate validity? Because I was able to run it this way, but that kind of feels wrong. I also wanted to check if problem exists with Kubernetes 1.4, but I couldn't find any migration guides. Maybe I'll just start again...

Said article:

[https://medium.com/@elcct/kubernetes-on-bare-metal- part-5-ku...](https://medium.com/@elcct/kubernetes-on-bare-metal- part-5-kubernetes-master-b6a0388fa993)

and the ticket:

[https://github.com/kubernetes/kubernetes/issues/29330](https://github.com/kubernetes/kubernetes/issues/29330)

</comment><comment><USER30> I was under the impression k8s already did these things, but it seems like a lot of these features are just now entering beta.

</comment><comment><USER31> "No guys stop complaining that google doesn't give support to kubernetes, we are not Google, we are the Cloud Native Computing Foundation." \-- Some kubernetes developer.

Release blog of kubernetes brought to you by: -- Aparna Sinha, Product Manager, Google.

Seriously though those new features are really neat, and seems to compete with the ease of setup of docker 1.12(though swarm was a bit of a mess when I last tried to make something useful of it (docker 1.12.0)), I hope I can test them at work soon.

For now I'm having a great time with rancher.io and cattle.

<comment><USER2> Sorry, can you say more about your issue? We've always said we contribute (a ton!) to Kubernetes, but it's definitely not a commercial product, so we don't have a support for on-premises/non-Google Cloud deployments. That said (!!), if paid support is what you're after, please use one of the MANY organizations who DO offer support ([http://kubernetes.io/community/](http://kubernetes.io/community/) \- about halfway down the page) and are huge contributors to the community.

Disclosure: I work at Google on Kubernetes.

<comment><USER32> The problem is, if the supporting organization is not the same as the developing organization, there's no obligation for the developing organization to respond to feedback from the supporting organization -- the developers are free to accept or reject feedback as they deem fit.

There could even be a conflict of interest: the Kubernetes developers are primarily sponsored by Google, which has an interest in promoting its own cloud offerings over those of their competitors. (Note the relative difficulty of setting up K8S on EC2; even if you can set it up, K8S assumes the ability to create a network topology that's unique to GCE; otherwise you have to use overlay network hacks.)

<comment><USER2> A few items:

1) The people on that page all contribute mightily to the project in various ways - we wouldn't be where we are without them. We take feedback from everyone (we have over 15 special interest groups, many led by non-core team members). 2) K8s developers are most definitely not primarily sponsored by Google - more than 60% of K8s devs are NOT Googlers. 3) Overlay networks are definitely not a hack - many partners set them up with great benefit. The fact is networking is hard (tm), and unless you're just looking for a flat network, then you're going to have to use SOMETHING.

Disclosure: I work at Google on Kubernetes

<comment><USER33> Where are you getting the 60% number from?

From an analysis of all commits in the k8s (main) repo this is the data I am getting about domains and the breakup of which users under which domains commit/author the most.

      </comment></comment></comment></comment></comment><comment></comment><comment></comment><comment>-----
      Top 20 author (domains)
      </comment><comment></comment><comment></comment><comment>-----

      google.com => 16825
      gmail.com => 8220
      redhat.com => 4051
      fathomdb.com => 501
      bedafamily.com => 420
      coreos.com => 398
      huawei.com => 352
      raintown.org => 269
      zte.com.cn => 183
      mesosphere.io => 172
      zju.edu.cn => 140
      apache.org => 126
      mirantis.com => 72
      hotmail.co.uk => 67
      amadeus.com => 67
      163.com => 64
      us.ibm.com => 64
      tmrts.com => 44
      box.com => 43
      canonical.com => 42

      </comment><comment></comment><comment></comment><comment></comment><comment>--
      Top 20 committer (domains)
      </comment><comment></comment><comment></comment><comment></comment><comment>--

      google.com => 16655
      gmail.com => 7130
      redhat.com => 4065
      fathomdb.com => 493
      bedafamily.com => 419
      coreos.com => 388
      huawei.com => 348
      raintown.org => 268
      zte.com.cn => 180
      mesosphere.io => 174
      zju.edu.cn => 131
      apache.org => 121
      amadeus.com => 66
      163.com => 65
      us.ibm.com => 64
      hotmail.co.uk => 63
      mirantis.com => 63
      ebay.com => 53
      box.com => 43
      tmrts.com => 42

Btw you (google?) should really invest in something like [http://stackalytics.com/](http://stackalytics.com/) if the community wants to have good transparency around this type of data.

Crappy script to generate that data @ [https://gist.github.com/harlowja/aca0b3c7d94c78014798fd9eb88...](https://gist.github.com/harlowja/aca0b3c7d94c78014798fd9eb8887dff)

<comment><USER2> There's no question Google has the most code checked in, but this can be a faulty metric (generated, rebased, etc can mess up authorship).

We think it's more important around # of unique contributors, where we (Google) are <50%.

For Stackalytics - [http://stackalytics.com/?project_type=kubernetes- group&metri...](http://stackalytics.com/?project_type=kubernetes- group&metric=commits)

Looks like my 60% number is out of date - looks like we (Google) are up to 44%. I'll have to figure out why.

Disclosure: I work at Google on Kubernetes

<comment><USER32> In my experience, the question of who the contributors are and how much they may contribute is less important than the question of who has control of the project.

If you're claiming that Google has delegated authority over Kubernetes to the open-source community, and therefore is not in a position to place its needs over those of the community, please say so explicitly here.

Why quibble over statistics when we can get an official statement?

<comment><USER2> We, Google, have contributed 100% of Kubernetes to the Cloud Native Compute foundation, and, therefore, are not in position to place our needs over those of the community.[1]

That is not to say we (Google) do not continue to be deeply invested in its success (it's the core of our Google Container Engine), and, further, human beings who are also employed at Google _are_ core contributors to the project, but Google is not associated with the project.

[1] [https://www.linuxfoundation.org/news- media/announcements/201...](https://www.linuxfoundation.org/news- media/announcements/2016/03/cloud-native-computing-foundation-accepts- kubernetes-first-hosted-0)

Disclosure: I work at Google on Kubernetes

</comment></comment></comment></comment><comment><USER34> Anyone else lament fleetd and the promise of a simple tool based container orchestration?

Yet another complex framework.

 _sigh_

<comment><USER26> Yeah, sure.

      Fleet for dnyamic scheduling
      Consul for k/v service discovery
      Registrator to actually populate consul
      Confd to talk to consul so you can configure your containers

      ...

Oh wait I seem to be building a crappy more involved version of kubernetes.

p.s. I actually did the above. kubernetes is a better solution.

<comment><USER35> Can confirm; did similar and kubernetes is a better solution.</comment></comment></comment>


How to Outmarket and Dominate Your Better Funded Competitors - <AUTHOR> http://insight.io/blog/2011/01/how-to-outmarket-your-better-funded-competitor/

<comment><USER2> I am working on a startup that will compete with many well-funded billion dollar startups and we need all the advice we can get.

<comment><AUTHOR> You're probably not the only one.

Shoot me an email- I have some data for your space that might be tremendously useful.

<comment><USER2> Thanks Ilya, just sent you an email. We are entering the already crowded market of local deals. Any advice is greatly appreciated.

<comment><USER3> Would you mind if I ask why? I'm honestly curious about whether you guys either (a) have a competitive advantage over the likes of Groupon (and Google too, apparently, after today), or (b) with the $6 billion offer, just want to get a slice of the pie. For the record, I don't think there's anything wrong with either one -- just curious.

<comment><USER2> Because there is one service I would use everyday nobody offers today, not even groupon, google, etc.

No matter where I am, I want to look at my iPhone and see what deals for lunch at the nearest Chili's, Cheesecake Factory, Houstons, etc. based on geolocation. If I am looking for the newest pair of Nikes, know who's got them around me for the best price.

Local deals, long tail, one to one, geolocation, all in one. That's a multi billion dollar business, untamed...

<comment><USER4> In case you haven't seen it, I'd look at <http://milo.com> . Not quite what you're describing, but based on similar premises. They were acquired by eBay not too long ago for $70 million. At least eBay sees value in local shopping as you described it.

</comment></comment></comment></comment></comment></comment><comment><USER5> This is a really interesting blog. I've e-mailed you, and from a dev who has never really made a site popular (other than getting some Chinese restaurant site to the top of google search by pure chance), it's given me some wicked ideas already.

I've e-mailed with a few specific questions, just my parents aren't doing too good right now, and while I can't help them financially, I can possibly use the skills to bring my stepdad more business.

</comment><comment><USER6> I like the quote from Macchiavelli about entrepreneurship. Gives you a clear heads-up about the level of drivel to follow.

<comment><USER7> I highly doubt that this quote is really from Macchiavelli, as in his writings entrepreneurship is not touched in any way.

</comment></comment><comment><USER8> That's a clever tactics. I'll definitely laugh out loud if I find competitor's weakness and learn what works with their own money. However, competition is dynamic. Wining one battle is not wining a war. Would love to read your other creative tactics.

</comment><comment><USER9> reading your post gave me a serious sense of synchronicity. I have been researching this same opportunity and have come up with a number of assumptions that I intend to validate. I would love to exchange some ideas with you on this topic offline. Send me an email at firstname.lastname@example.com. Thanks!

</comment><comment><USER10> Step 1. Don't use Google Chrome because then you can't see my blog entry.

<comment><AUTHOR> I only use Chrome, works fine for me.

Also, according to my analytics, 40% of my readers use Chrome, so unless they're all just constantly refreshing my blog like mindless zombies without seeing anything, the issue is probably on your end.

What issue are you experiencing?

<comment><USER11> I'm not the OP and I can see the text in Chrome on Linux but one issue it does have is if the browser window is small enough that the title wraps the subtitle goes behind the buttons.

BTW, I would have subscribed to your RSS feed (a few times before even) if it was full content.

<comment><AUTHOR> Unfortunately, fulltext RSS feeds are easy prey for scraper/spam sites, which is why most blogs don't use them. Nowadays, it looks like most people use RSS as more of a notification when new content is posted.

<comment><USER11> I won't follow a blog that doesn't have a full RSS feed, it's just not worth it. I can't actually remember another blog I came across recently that didn't have full content, and the 100+ I follow include pretty mainstream stuff. So I'd be curious as to how you got to this conclusion. Also, why do you worry about spam sites?

<comment><AUTHOR> Different industries have different rules I suppose. Allright, I've enabled fulltext feeds for the time being, we'll see how it goes.

Spam considerations aside, it's a tradeoff between subscriber counts and pageviews. I'm not entirely clear which metric's growth is more desirable.

<comment><USER11> Subscribed. I'd be curious to find out what you conclude about the experience. Thanks.</comment></comment></comment></comment></comment></comment></comment>


Automated code review for Python, Django, etc. - <AUTHOR> https://www.quantifiedcode.com <comment><USER2> No offense, but saying this is 'automated code review' and specifically mentioning something like "comply with regulatory standards" is missing the point. The whole point of these regulatory standards (such as SOX) is to put an additional human in the loop, so that a single engineer can't do something obviously bad with people's credit cards, or whatever it is.

Also, given that this is glorified linting, it should be run _before_ code review. Any code review that focuses on issues that can be picked up via a linter isn't actually a review. Code reviews are a higher level analysis.

<comment><USER3> For iteration speed in-IDE linting/checking makes sense I think.

<comment><USER4> Agreed, we're working on a version of the tool that can be integrated into an IDE.

</comment></comment></comment><comment><USER5> This looks like a poor clone of [http://landscape.io/](http://landscape.io/) \- viewing what they have to offer on github, I'm not very impressed at all, the internal tool of landscape.io, [https://github.com/landscapeio/prospector](https://github.com/landscapeio/prospector) does a whole lot more.

I think calling it "code review" as opposed to "health" or just "lint checker" is marketing bullshit aimed at managers who think all work of engineers could be magically boiled down to automation.

That said, I make _heavy_ use of prospector, along with or wrapping: dodgy, frosted, mccabe, pep257, pep8, pylint, pyroma, restructuredtext_lint, doc8, and sphinx-build "warnings as errors" as part of my builds.

Result: Code that becomes a public source reference used by other projects. Contributions from people who are able to quickly dive in and find where to place the change they wish to propose. Through enforced styling, the entire codebase reads as though it has a single authorship, "same throughout", this can make ~5K LOC as easy to adapt to as another of 1/10th its size.

I took a ~25K LOC open source project, ran it through landscape.io, worked (along with closing many other bugs) from "50% health" towards "97% health", and the readability and maintainability of the project increased drastically. It does work.

Why are these checkers useful? Because I want people who review code, especially in business, to spend their time on the purpose of the code, and not spend a single minute of their time considering whether this suites the "style" of their engineering department. I have seen too many people use code review for pedantic styling.

If I can have the tools reject the code before a person, it lowers the time/cost of a purposeful review. It also hurts less ego's to get only 1 or 2 open issues as opposed to 15-20.

Crude napkin estimates of current and past employers gauge the value of the software at roughly $10-$25 per line of code. It should be treated as such.

<comment><USER4> Thanks for the feedback! Compared to landscape.io (or other tools) we have a different approach to code checking since we develop our own algorithms and even allow our users to create custom code checks using a code pattern language ([http://docs.quantifiedcode.com/patterns/language/index.html](http://docs.quantifiedcode.com/patterns/language/index.html))

landscape.io is a great tool of course (in fact we've been in touch with Carl since a while) but we really wanted to go in a different direction with this and build a tool that goes beyond providing a simple frontend to existing tools. The current beta of QuantifiedCode is of course just the beginning and does lack many features that we're currently working on (e.g. giving the user access to the graph representation of code that we use internally), so stay tuned for more.

BTW we have open-sourced our own "Prospector"-like tool, checkmate ([https://github.com/quantifiedcode/checkmate](https://github.com/quantifiedcode/checkmate)). Right now it's still in beta though and we don't pursue it very actively since we use mainly our graph-based approach to code analysis now (so we don't need to aggregate output from different tools).

<comment><USER5> I did look at checkmate. It was my mistake in believing this was the total sum of the checker used in quantifiedcode.

One problem I have with such monetary solutions is that in business where I am willing to pay, I could not provide a SaaS tool like codechecker access to the enterprise github hosted on an internal network (or possibly some other repository service).

I'd be happy to pay, but it just isn't technically feasible unless there is a self-hosting solution, which complicates things for you beyond what is profitable: I don't know what the solution is, but this is why I use only cmd- line tools like prospector in business, rather than simply paying for landscape.io or codechecker.

I'll stay tuned, thanks for responding.

</comment></comment></comment><comment><USER6> I am hesitant to try this because of the pricing. Maybe its just me, but paying 150 bucks per month for a gloried linter seems insane.

Do people actually pay this much for this product? I would love to see some testimonials on the site, because otherwise I cant see myself liking this 150/mo worth

my 2 cents

<comment><USER7> If they'd have called it a "static analyzer" they might have had an easier time selling it. Businesses regularly shell out big bucks for C/C++/Java static analysis tools like Coverity, Klocwork, etc.

Static analysis is less likely to yield fruit (design errors and not false positives) in a language like Python. So the bar's definitely higher for these guys than it is for the static analysis tools for static-typed languages.

<comment><USER4> Good point! You're absolutely right when you say that static analysis is more difficult to do for dynamically typed languages like Python. This is why we develop our own type inference algorithms in order to generate additional knowledge about the code beyond its structure, which in turn allows us to detect more interesting and relevant problems.

</comment></comment></comment><comment><USER8> Is there a way to silence particular errors (i.e. false positives). For example, the python linter is unhappy that I have the following in my code:

        ParticipantFormSet = modelformset_factory(Participant, can_delete=False, max_num=8, extra=8,
                                                  form=ParticipantForm)

It claims that this is a violation of the naming convention for variables, but in this case ParticipantFormSet is actually a python class, albeit created with a factory function.

This is just one example, but I would think long-term that it would be a great annoyance to deal with persistent misapplication of rules.

<comment><USER4> Thanks for the feedback! This feature will be available very soon, we'll notify all users by e-mail as soon as it's deployed.

Right now, you can already disable certain patterns in your project settings if you're bothered by individual messages.

</comment></comment><comment><USER9> The most important part of a code review is the _why_ , not the _how_.

It's pretty easy to implement pre-commit checks that would validate and enforce style and certain lint checks - many companies have these. No automatic check will make sure that the right problem is being solved with the right approach, though.

<comment><USER10> Having never used this specific product I can't makes claims about any of its functionality, but what I have found is the gap between what one _can_ do, and what people _do_ is very very large. Yeah you can implement all this yourself using pre commit hooks, but do you ? Right now you could pay a little money and vastly improve the quality of your code base. There is value to be added by getting a packaged version of something and having it just work.

<comment><USER4> Good point! When asking developers about their use of static code analysis to ensure code quality we found that most development teams use such tools only sporadically or not at all, and just very few teams have a systematic process or set of guidelines for ensuring code quality throughout all of their projects. So while some technologies already exist for this, we definitely think that there's room for more.

<comment><USER11> I'm not a fan of pre-commit hooks (as I'd rather write it, lint it, fix- rebase-it), but I love having a CI suite that includes the linting tests that our team has agreed on. It lets me code away and lint things when I'm ready to make my pull requests.

<comment><USER5> agreed, git hooks are a terrible place, they can actually impede progress and can also be skipped/disabled/never installed in the first place.

The time for rejecting a build for linting is at time of merge to trunk/next release, which a good CI should already have checked.

</comment></comment></comment></comment></comment><comment><USER12> Jetbrains pycharm does many of the same checks for free, it's also integrated straight into the ide so you get the error 1sec after you wrote it and can fix it immediately. What does this offer me that pycharms analyzer does not?

</comment><comment><USER13> So this is a linter? What does this give me that django-lint and pylint doesn't?

<comment><USER4> It's more a tool for writing your own linters: We have developed a code-query language (Cody - [http://docs.quantifiedcode.com/patterns/language/index.html](http://docs.quantifiedcode.com/patterns/language/index.html)) that allows you to very easily write your own code checkers.

Using that language we have implemented many checks from PyLint, PyFlakes etc. but for us the most interesting feature is that you can easily translate your own conventions into automated rules and check them on each commit.

So while we offer PyLint patterns as well we give you a way to go way beyond what normal linters can offer.

<comment><USER14> Interesting ... but I still wouldn't call it review. Both linting and review are worth doing, but they achieve very different things. In fact, I often think of linting as a good tool to reduce noise in the review process.

<comment><USER4> Thanks for the feedback! How would you call it? Static analysis? Linting? Code linting seemed too be a very specific and not widely known term for us while most people seem to know what "code review" means, hence our decision to call it "automated code review".

<comment><USER14> Well, unless I've missed something, it is by definition static analysis -- so that's probably a good start.

The way I look at it is that every minute you spend discussing a point in a review that could have been caught/corrected by a static tool is a minute wasted. But these tools can't do any of the actual work of the review.

By the way, linting is a fairly well known term with a long history, but it wouldn't surprise me if there are communities that don't know the term.

</comment></comment></comment></comment></comment><comment><USER15> I've been working on static analysis products for almost a decade and I must admit I am not impressed with your "AST visitor approach" for creating custom checks. It seems you are doing the same as SonarQube.

However I am curious about your claim " Unlike any other code checker out there, we've conceived code error as patterns, not as rules." , could you be more specific?

<comment><USER4> Thanks for the feedback! Our "AST visitor" approach is currently not very different compared to existing methods. However, we store the whole AST (including earlier version of the code) in a graph for fast retrieval and add a lot of context information to each vertex in the code tree. Having the code patterns and faulty code in a database, we can make use of user-feedback to (semi-)automatically improve our code patterns for a given error using example-based learning. In that sense the algorithm is much more adaptable than existing technologies.

</comment></comment><comment><USER16> I tried this on one of my projects today. Created account via github, enabled the project, watched the wheels spin. I'm approaching 12 hours now and it still says: "This project will be analyzed soon. Please check back later." I'd like to like it, but that performance isn't going to win many converts.

</comment><comment><USER17> How does this compare to Semmle? [https://semmle.com/2014/06/semmle-analysis- now-includes-pyth...](https://semmle.com/2014/06/semmle-analysis-now-includes- python/)

<comment><USER4> I'd say: Similar approach, different target market ;) Semmle provides really good code analysis for Python as well (we're in touch with some developers there in fact) but targets mostly big companies with their product. Contrary to that, our mission is to make state-of-the-art code analysis available to everyone :)</comment></comment>


16 Year Old CEOs, What Has The World Come To? - <AUTHOR> http://www.brandonpaton.com/2009/11/16-year-old-ceos-yeah-ok/

<comment><USER2> Young kids use the term CEO because it gives them a sense of importance and officialness. There is nothing sinister or inflated about it, it's just kind of like playing house or pretending. You play the part you dream of one day being.

When I was younger I remember starting "companies" and trying to be really official about it even though I had zero experience and didn't know shit. Who cares? It was fun.

<comment><USER3> I think more than a few 40-year-old small business owners style themselves CEO as well, and for the same reasons.

<comment><USER4> "Boys will be boys, and so will a lot of middle-aged men." - Kin Hubbard

<comment><USER5> In your lifetime, your only young once, but you can stay immature forever.

</comment></comment></comment></comment><comment><USER6> I never called myself the CEO of Viaweb. I just used my actual job title, which was president. It seemed silly to talk about someone being Chief Executive Officer of a company with 20 people. But that was over 10 years ago; fashions may have changed.

<comment><USER7> Don't top academics avoid titles in the US? See for example how many top academics have "Dr." or "Prof." in the title of their home page.

I suppose the impression is that an academic would only fall back on his/her title because he/she is not particularly well known and needs some way to impress others. It looks bad.

Why is this different in industry?

<comment><AUTHOR> Someone commented on the site about this.

The difference between academics and business is that "Dr." and "Prof." are appointed titles, while CEO is self-given without having to meet any prerequisites or requirements.

<comment><USER8> Miss Manners writes that in academia, Ph.D.s are like noses. You only notice if someone doesn't have one.

<comment><USER9> This might not be true in the humanities. I've had quite a few students repeat the idea that they must call be "Dr.", since the title "Professor" is reserved for lowly grad students. They tend to hear this from literature professors, so non-science fields might have different customs.

<comment><USER10> If someone is calling grad students "Professor," then they are abusing the term. A grad student who is teaching is an instructor.

Something that I didn't appreciate until I was in grad school was that not all professors are even "Professor." Becoming a full professor is a big deal. An "Assistant Professor" is generally someone who has a tenure-track position, but does not have tenure yet. "Associate Professor" is for someone who has tenure. "Professor" is for someone who has tenure, and has contributed enough to the school through research and teaching to earn being a full professor.

<comment><USER9> The person teaching the class can be legitimately called "professor". It signifies their position as "that guy teaching the class", not their academic rank.

Similarly, "that guy commanding the ship" is called "captain" regardless of actual rank [1].

<comment><USER10> I just checked the dictionary and Wikipedia. While both allow for "that guy teaching the class" to be considered a professor, that doesn't seem to be the standard custom. Both stressed the formality of the title, which is the custom I'm familiar with.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'll say! Real CEOs should be 14 years old, like Ben Casnocha back when.

(And yes, his company, Comcate, is a real company with employees and everything.)

Though I do agree with the general principle - it's why I decided that the title of Research Fellow at the Singularity Institute was more honorable, even though I could easily get something with "Director" in it.

But there really is a flipside; not everyone gets the countersignalling. I met with a Congressperson once who told me that if I wanted to meet with Congresspeople, I should have gotten a bigger title - the phrasing was something along the lines of "Executive Directors get into the office, Research Fellows wait outside" (said in a friendly and helpful way).

Similarly, at a gathering of VCs, someone said to me afterward: "When you introduced yourself as a Research Fellow, I thought you were just a scientist."

I guess in the larger world, people really do go around judging by titles, even if from in here it seems like obviously easily fakeable fluff.

<comment><USER10> You write about signals all the time - this is so obvious a signal that it's written down next to your name.

</comment></comment><comment><USER12> It's hard to define a concrete point where you aren't being pompous by calling yourself a CEO, but having more employees (or at least contractors) than yourself is probably a good start. I find it a little depressing when I'm reviewing the resume of someone applying for an engineering position and I see their first job experience listed as CEO or CTO of X, especially if the date range is before graduating from high school. "Founder" seems like a much more legitimate, scalable and reasonable option.

<comment><USER13> IMO (an I've been on both sides of this, having started a small company in my 20's, and now as a hiring manager at a startup), "owner" is even more appropriate.

Even "Founder", to me, seems to imply a certain amount of effort was involved above and beyond the base paperwork.

If your company exists more on paper than in practice, skip the titles and just list yourself as Owner or "Self-Employed".

Many many many many people of all ages have managed to generate some cash flow from their determination and inventiveness. It's no great accomplishment, in the relative scheme of things, to have managed to generate a couple hundred thousand dollars in above the line revenue.

A Founder or CEO type title is, again IMO, appropriate when you have created something that has started to take on some life of its own, and might have a slim chance of continuance in your absence or departure. Or, when you have managed to convince some non-relative to give you a 7 figure investment.

I just dug out some old business cards from my little venture in the 90's. I just listed the company name, what we did, my name and contact info. The legal paperwork listed me as President or CEO, IIRC, but in the day-to-day operations I was just the guy that ran the joint. The company managed to do a few $MM in revenue, net me a bit o' cash and employ a couple of people besides myself.

</comment></comment><comment><USER14> The term CEO has, largely, lost all of its meaning. CEO is a specific role within a company; it is not an umbrella term meaning "person in charge of things". It makes me cringe every time I turn on the television, read an article, or listen to somebody speak and hear the term CEO used to mean "person who isn't a cubical drone".

This is especially true if you are the ONLY person in your company. Saying you are the _chief_ executive officer at least implies that there are other officers.

</comment><comment><USER15> If a 16-yr old CEO has the social acuity, business acumen, and maturity of a 45-yr old CEO, then major kudos to them.

I met a CEO and member of the Young Presidents' Organization (YPO) several years ago. In the brief time I knew him, he inspired me. I know it's a cliche but his attitude was infectious and amazing. Every year, the YPO picks a different city to party and network in. That is the _club_ that you might aspire to be part of.

Strict requirements. Responsible for full operation of a qualifying (by revenue) corporation or division by age 45. Yes, they require at least 50 employees (which may be more tailored to traditional business)

<http://www.ypo.org/criteria.htm>

<comment><USER16> >If a 16-yr old CEO has the social acuity, business acumen, and maturity of a 45-yr old CEO, then major kudos to them.

That would be a horrible 45-year-old CEO. If you don't learn something in those thirty years that can't be applied to give you an edge on a sixteen- year-old, you're doing something wrong.

Age deserves more respect, imo. It's extremely unlikely that any sixteen year old would be a businessperson than a forty-five year old.

<comment><USER15> I can see how it got lost in translation but by no means I was implying that the 45-year old CEO was horrible (e.g. it's very very unlikely or even impossible that a 16-yr old CEO will ever be equivalent to a veteran CEO - e.g. 16-yr old CEO is a near mockery of the title). Much like what happened when they started giving away Green Berets to non-Green Berets.

</comment></comment></comment><comment><USER17> Like getting incorporated is such a big deal.

It's a simple form you fill out and pay a few bucks, and bam, you are now the CEO of an incorporated startup.

Personally I'd feel weird calling myself a CEO unless my company was making ~60K(basically a salary) or I had some funding to at least prove my legitimacy.

<comment><USER18> I'd feel weird calling myself a CEO unless my company was making several salaries.

</comment></comment><comment><USER19> _Truth is, in a few years we won't be teens anymore. We will no longer have our foot in the door just because our age is impressive._

Yeah. I sometimes think about what the entrepreneurial funnel for these seemingly uber bright kids looks like. I've always felt that each additional year x% of kids that looked like the next (insert some top name) drop into the average John.

And of course, every year many average Johns that did not grow up as "CEOs" turn into CEOs.

I've learned my lessons over the years. No more any kind of story around me. If there is a story, it should be about my start-up. Of course, I am also 22 now but you'll find out the reporters' infatuation with age and hyping up an individual never really ends.

There are some folks that actually excel from this sort of publicity. They end up writing a book or two that actually sells. I realized I'm not one of them and self-publicity is mainly a distraction at least at this point in my life.

<comment><USER20> I'm 19 and in the process of looking for exceptional talents my age to work with. As I go through people, I find that publicity is never a real indicator of somebody's success. Most people who're really good at what they do never learn to promote themselves; a lot of mediocre people develop the skills and take advantage of media laziness to get mentions.

I've never liked people that pull age. I remember when I was thirteen pretending to be in high school because I thought that high school was a big age on the Internet; within a year I'd started to lie about being a college student because I didn't want to be treated differently than the people I talked to. As a result, when I see people whose web pages brand themselves as HIGH SCHOOL STUDENT first and CEO second and don't list any real accomplishments, I feel a sort of sneer, because I know there're just as many people that age who're quietly learning to do things till they become prodigies at the age of 25.

It is fun, though, when somebody discovers your age and fawns over you like you're some little darling prodigy. Not a wholesome fun, more like a smirking "You care more about my age than what I've done?" Some people do it because they think it's polite, but other people sincerely think that young people must be the smartest people on the planet and young people that know better laugh.

<comment><USER19> Makes sense. Though as I said in an earlier post, there are some folks that are young, can talk a great story, get a book contract and end up making a decent $ from their writing. I don't see much wrong with that approach though I know some have a problem with that.

Just like you, I did not tell my age to clients when I was 14-15. But that was more out of fear. Ones that found out before giving me the project(via sites like rentacoder/elance) would never pick me. So I quit sharing my age until later into the project once I'd knocked their socks off. Ironically, I was able to provide a better service to clients back then than I can today. Today I care wayyy more about money/ROI. Back then I only cared about the actual work. Money was almost zero motivation.

<comment><USER20> As a writer myself, I always thought that was kind of an ass-backwards approach. Writing a story about being young is the cheapest and easiest story to write. So props to the people who manage it, but I don't necessarily see that as a success.

I find, funnily enough, that the people who succeed the most past being young are the people who find passion in what they do at an early age. So embrace what you love! That's what you'll find it easiest to grow at.

</comment></comment></comment></comment><comment><USER21> I find the use of C-level titles in a very early startup fairly pretentious. I try to avoid using it and just call myself "co-founder" - that is what my business cards say.

However, we do also get feedback that we need to give ourselves business titles so that people know who they are dealing with. Last night I was submitting a slide deck for a presentation I'm doing at an investor conference in a couple of days. The last slide I did was "The Team" slide. The team is currently just me and my co-founder. I actually wanted to put "business guy" and "techie girl" as our titles, but its a fairly strait-laced conference so in the end I put CEO and CTO.

I did feel a bit awkward doing that, knowing that it's just the two of us. I am positively cringing now after reading that article!

<comment><USER22> How does "partner" sound? Same a co-founder? Or more like someone climbing up the ladder in a law firm? English is not my mother tongue which is why I am wondering...

<comment><USER21> I would use "business partner" in conversation, but if I saw "partner" on a business card I would think of some kind of law firm (pretty near the top of the ladder actually ;) )

</comment></comment></comment><comment><USER23> My father did little when it came to marketing (he mostly sold office buildings), but one of his few lessons about it was that one should never advertise their product as "exclusive". If something really is exclusive, people will start using that description all by themselves - your product will be in demand but have a very limited and controlled supply. If it's not, advertising it as "exclusive" just sounds cheap.

I find this similar to the use of the title CEO in start-ups. If you advertise that as your title, there is no reason you're doing that other than vanity. If there's one of you, you're not the CEO - you're just the guy doing things. If there's three of you, then you're just one of the guys who makes decisions. If there's twenty of you, you have a proper corporate governance structure, and all you do is manage and plan, then maybe call yourself a CEO.

If you're really concerned about your title between the sizes of three and twenty employees, you're worried about the wrong thing. If you really need one for some reason, call yourself Founder (if you founded the company) or President (if you have the ultimate decision-making power and preside over decisions). If you don't do either of those things, put the words "Senior" or "Director of" in front of what you actually do and speak like you've got some authority.

<comment><USER24> It's just like the word authentic. When I see a restaurant with "authentic" in the byline I avoid it. If they have to call themself authentic than chances are they aren't. Authenticity is achieved by x-factor and word of mouth.

When I ran my small company my title was owner. There was only one employee so it was obvious who "found" it. And sinced I financed it it was me who "owned" it.

</comment></comment><comment><USER25> At my startup we didn't take CXO titles until we started talking to investors. Then it was basically expected. People on the other side of the table need to know who they are talking to in terms of corporate responsibility. I don't think that the title necessarily reflects the revenue status or anything like that, rather it is an expectation of responsibility, regardless of whether the company is at the stage where you actually act in that capacity yet.

</comment><comment><USER26> Finally a teenager humble enough to address the ad nauseam idea that teenagers can be entrepreneurs to. The media (most esp. major media outlets) have been exploiting this topic ever since they finally acknowledged the internet as a valid 'media contender.'

A teenager with an entrepreneurial spirit is rare as is and perhaps even paradoxical in the most stereotypical case, but a teenager disciplined and willful enough to build a business (web-site/service) attractive enough to sell and humble enough to remind us they still have a lot to learn is probably one in a million.

I don't mean to swing on this kid's nuts, I'm merely trying to make the point that a majority of early-blooming entrepreneurs wearing fancy acronyms/job- titles assume they know too much too soon and have a hard time adapting their business and their ego when X takes a turn for the worse.

</comment><comment><USER27> There have always been 16 year old CEOs.

They used to deliver newspapers and mow lawns and babysit. All that has changed is what teens to for spare cash, and their self-perception.

This trend is a lot more about labels than about any changes in what young folk do with their time and talents.

</comment><comment><USER28> C-level executive does mean something to people executives at large corporations, but calling yourself a CEO on your webpage/business card won't actually make you a CEO for anyone who understands that. If your resume doesn't say P&L responsibility for >X millions in revenue, don't throw around the term CEO because you will come across as a braggart. President or founder are much more accurate descriptions for what most startup founders call the "CEO" position.

</comment><comment><USER29> The only time I use the term CEO in my title is when I feel as if I have to convey my leading role in the company _over_ giving the impression that I'm an everyday employee. This normally only happens over e-mail and with people that don't really know me or my company.

</comment><comment><USER30> Seems like the site is down. Here's the cached version: [http://184.108.40.206/search?q=cache:http://www.brandonpaton...](http://184.108.40.206/search?q=cache:http://www.brandonpaton.com/2009/11/16-year- old-ceos-yeah-ok/)

</comment><comment><USER31> > 16 Year Old CEOs, What Has The World Come To?

It's come to ageism.

</comment><comment><USER32> From the article:

"However, I cringe when I hear the title "CEO" used lightly. To me, it conveys a lack of humility and a desperate call for attention."

Lacking humility and making desperate calls for attention? High school is all about lacking humility and making desperate calls for attention. Calling yourself the CEO of your personal non-incorporated company would be par for the course, not a shocking breach of decorum.

I can't think its much different than my having pretended to be a wizard doing magic on the occasional weekend night.

I think that the sad part about this is that teenager's imaginations have slipped to the level where the geeks among them now play at being things that actually exist.*

Kids these days...

*= Although I am a lisp programmer awash in a C of embedded systems guys (read: warriors), so pretending to a wizard and saying a bunch of mumbo-jumbo incantations that only I understood (and then blasting my enemies with fireball!) may have been some sort of pseudo-apprenticeship.</comment>