I revoked $1M worth of EV certificates - <AUTHOR> https://scotthelme.co.uk/extended-validation-not-so-extended/ <comment><USER2> Scott isn't trying to mislead us here, but one sentence from the article seems like it needs expanding certainly for a lay audience like HN.

"One thing that we can do with CT logs is search all certificates for things that we're interested in"

The CT logs themselves implement only a terribly simple API and you can't search them per se. This makes good sense because they are required to hit really onerous availability and performance targets to remain "qualified" as logs. You definitely wouldn't want to put a sophisticated "search" feature in this code.

However, since they're public we can either read all the data (my employer does this) and process it however we like or there are two famous services which already did this for you, crt.sh (operated by Sectigo, one of the CAs) and Censys (from an ex-University of Michigan team). Scott used Censys for this article, and either Censys or crt.sh are good places to play around with this if you have a passing interest that may not last.

<comment><USER3> We get daily notifications of certificates from [https://sslmate.com/certspotter/](https://sslmate.com/certspotter/)

<comment><USER4> Great service.

To add, I like the checks of [https://sslping.com/](https://sslping.com/) too.

</comment></comment></comment><comment><USER5> Another data point in the ongoing theme of EV certificates having basically no value.

The other big data points being: browsers don't want to display them differently, and users don't notice them being any different.

Now we have that nobody is really checking them that closely.

How much longer will these even exist?

<comment><USER6> Just yesterday someone asked if there was a way to verify if the email from a purchase was leading to the correct domain to log in to. They wanted to make sure they weren't being phished. How I wished there was a simple button they could have clicked in their browser that would have shown a window with the company details for the website certificate.

Everybody rails on how useless EVs are, yet it seems like no browsers have spent any time over the past years even trying to improve the UX related to certs. I mean, sure they've changed the color and removed the ambiguous company name and country. Which makes you ask why did they ever display country in situations where that isn't the jurisdiction that issues business licenses, such as in the US?

I mean, click on the lock and through N buttons, then expand various sections and read through dotted identifiers that only ASN.1 experts recognize (seriously, who though it would be a good idea to use OIDs for known fields in the UI?), and then maybe you'll understand who the certificate is issued to.

At least in the US, when obtaining and EV cert you need the jurisdiction (state), business registration number, they call the business phone number. They basically do some research - usually you need a DUNs number, publicly listed phone number, etc. Wouldn't it make sense to have a button that when you click it you see a user-friendly window showing the information about the company for OV/EV? I mean, sure, you can register Stripe in a different state - how about providing some statistics like what year the company was formed (usually only file with business registration), a link to the company registration details on the jurisdiction website, the top level domain Whois info, etc? If you wanted to get fancy you could provide a link to the user's search engine with the company name as the search terms.

Instead it seems like we have a bunch of cryptographers (or maybe just infosec people) obsessed about 1. The money companies are charging for EV certs 2. that it is possible for mistakes to happen. This instead of improving how we present information about a company.

So since there isn't a perfect, foolproof identity verification system for companies online, now every user online needs to do their own reconnaissance to make sure this is really the website they should be at.

<comment><USER7> You're right in that a working EV system can indeed protect people. However, as this article suggests, even a basic check can be very hard for CAs to implement. If you can't even do a spell check on the state or country name, can you be trusted to verify the identity of those who rely on you to meticulously verify a company?

There's also the point [https://stripe.ian.sh/](https://stripe.ian.sh/) made: it's not just about registering the same name in a different state. People don't know in what state your (parent company) headquarters are so they would need to dig deep into the organisational structure to find out if the EV cert they're presented with isn't from a company with the same name in another state. Want to add more years of registration? Just buy an old, probably no longer used letterbox company and change the legal name. Whois info can be set to anything you want for most domain registrars as well. People will still need to find out if all the data matches.

There's also this demonstration of how EV can actually be used to help phishing by using the "green address bar" and the hilariously stupid Apple address bar design: [https://www.typewritten.net/writer/ev- phishing/](https://www.typewritten.net/writer/ev-phishing/)

I believe there is value in EV certificates if you can rely on the identity verification that they come with. Sadly, most providers of EV certificates seem to view them as a way to make more money, not as a tool to bring trust to the web.

An EV-like system will probably be reinvented in the future, giving us a fresh start on identify verification on the web without the crappy practises and standards that plague the EV system today.

Lastly, for such a system to work, all (big) companies need EV certificates. Even before browsers started cutting back on EV UI, nobody knew what site does or doesn't have EV. Some subdomains used different certificates, some didn't have certificates at all. How do you know if a (sub)domain is supposed to have an EV certificate? Will you tell people to just not log into Facebook anymore because they don't have an EV at their login page?

EV doesn't work because it's the wrong way around. For security indicators to work, you need to warn for danger instead of turning off the "everything is okay" light. The OV/EV system has been designed around the latter idea and as long as EV/OV isn't freely available all over the world, nobody's going to mark DV certificates as "insecure".

<comment><USER8> Also ov/ev isn't something a person can get. I mean it might already help for some personal sites if they can be tied to other pseudonyms the user has online so for example sites of more or less well known open source software could get a link to the github or whatever into the cert to directly bind the dev of that software to his website, without having to know who is behind that.

The identity problem is always fun. I mean i don't care who someone is in real life, i only wanna know whether i have the site by the same individual who made something else.

That can be easily and automatically verified (see keybase) and might be more than enough for a lot of things where there are only normal people involved.

It might also be helpful of a given company is more commonly known behind another online entity. Like for example if pewdiepie had a company which he uses for what he does, the link to his yt would be a much greater indicator of validity than some random company name or even his own real name (which not everyone may know).

For pure DVs i think they should be able to issue them themselves. I mean the only thing those prove is domain control and with dnssec+tlsa there's a great way that domain owners can prove that they are in control of the domain and aurhorize a cert, also this lowers the number of trust paths significantly as there is only one possibly trust path over the TLD, and not like 150 CAs from who knows where. Also both the domain owners and the users have less entities they have to trust, as the TLD managers have to be trusted anyway as they ultimately have the full control of their domains,and thereby could make a DV cert themselves over the CAs anyway.

</comment></comment></comment></comment><comment><USER9> At $work I maintain and develop a CMDB and the software that is used to manage it.

All of this sounds like very familiar data entry and maintenance problems.

In general, good data quality can only be achieved by giving the people who enter it some incentives, or make it impossible to enter wrong data (then data can still be missing).

For example, we have automation that configures monitoring and backup for hosts from our CMDB, and this information tends to be well maintained.

Other information that we need e.g. for compliance, but that no automation is tied to, tends to be of much less quality.

The second part is the feedback loop: if you enter some data incorrectly, and weeks or months later somebody complains that it's wrong -- that's too far off to efficiently learn from it.

We as an industry might have expected better from CAs, but we haven't pressured them into building the necessary feedback loops, or indeed given them incentives to provide higher-quality data in the EV certs.

<comment><USER10> > higher-quality data in the EV certs.

Part of this is probably the fact that many people were opposed to the entire concept of EV certs as basically being a money grab by the dominant CA's from day 1, and indeed the trend is away from highlighting their existence in web user agents...

</comment></comment><comment><USER11> Let's encrypt has developers empowered to just get https done in a couple of minutes. This includes the time it takes to search for certbot syntax on stack overflow.

Years ago the certificate was a big deal in project specifications, project managers could lay out the FUD and trick clients into spending more money on more snake oil. This was a pain for developers as they would have to get the work done. Sometimes the client would not have access to the one or two email boxes needed for this archaic system so there would be an added hurdle of setting up firstname.lastname@example.com or whatever it was that was needed to get EV to happen.

Nobody misses those days and the pain and hassle just was not worth it. Certbot came along and made it so easy. Nobody questioned why they needed EV certificates, sometimes you cannot argue with free and easy.

<comment><USER12> As a developer/server admin, one my frequent tasks were to install SSL certificates my clients send to me. My clients used to get the certificate and email/Dropbox me the certs along with the private keys to me.

</comment></comment><comment><USER13> Since the cert log is public, all of this is auditable, as indeed the OP audited it.

Should there be some formal/official mechanism of auditing _every_ EV issued?

Perhaps cert authorities should be required to pay for an auditor to audit their certs -- not just the process or a sampling of certs, but automated auditing of every cert. The problem with this of course is the usual 'auditor capture', if the auditor is getting paid by the entity getting audited, the incentive is not to continually approve the auditing, but to make all the audits pass.

In some sense, this is a success story -- the transparency of the cert issuing log allowed the OP to choose to audit some of them, voluntarily. But transparency of the cert log clearly isn't enough, it's been years of bad certs before someone decided to volunteer their time to audit some of them. Just transparency isn't enough without social/business structures in place such that they actually _are_ being checked.

(This has parallels/analogies with other things...)

<comment><USER10> > auditing _every_ EV issued?

this is what _Extended Validation_ is supposed to mean in the first place.. and lends credence to the argument that EV solves a problem that shouldn't exist to begin with for 'regular' certs

<comment><USER13> No, I am not talking about what EV is supposed to mean in the first place.

EV, in contrary to ordinary certs, is supposed to mean the cert authority verified the registrant really is the name on the cert. Ordinary certs the CA doesn't even claim they did that, they don't even claim that a Cert that says Joe Smith on it was registered by someone who's legal name is Joe Smith or a cert that says Widgets Inc on it was registered by a company with that name. The CA's are claiming to do a different thing with EV certs.

I am talking about a third-party auditing the EV certs to ensure the CA was doing what they committed to do. Like a third party audits a bank by analogy. The fact that banks get audited doesn't mean the bank is useless in the first place. But the auditors do (theoretically if the system is working) help keep them honest.

One of the points of the transparent log is to make this possible. But if nobody is actually checking... it is not quite accomplishing this point. The fact that a transparent log is a good thing so someone can audit doesn't mean the EV is "useless in the first place".

(An EV might be useless in the first place for other reasons, but not because auditing is a good thing).

</comment></comment></comment><comment><USER14> Little silly to say "I revoked $1M worth" since the price paid for each certificate includes unlimited renewals to fix problems like he identified. They are still worth $1M despite everything he did, they just have different private keys now and slightly improved data.

Maybe a better title would be, "Humans not 100% reliable about ensuring accurate information stored within thousands of data records, despite such accuracy kinda being the whole point."

<comment><USER15> I know for a fact that at least one of those certs was replaced with a DV cert - once the team in question had to replace it, they realized there was no point in replacing it with an EV since the browsers are removing the EV UI anyway.[0] I'd bet that a meaningful proportion of the certs in question are similarly being replaced with DV.

[0] [https://www.isc.upenn.edu/alerts-outages/planned-weblogin- ss...](https://www.isc.upenn.edu/alerts-outages/planned-weblogin-ssl- certificate-change-august-30-2019)

</comment></comment><comment><USER16> I mean maybe I'm wrong here, I'm probably wrong, but 99% of people don't know nor care about the difference between an EV certificate and a Will Issue certificate like Let's Encrypt.

Is it really worth revoking these over tiny discrepancies, especially in cases where you can still determine the entity beyond a doubt?

<comment><USER15> If a private entity is issued a cert saying "Government Entity", is that a "tiny discrepancy"? [https://twitter.com/SectigoHQ/status/1171808269528109058](https://twitter.com/SectigoHQ/status/1171808269528109058)

</comment></comment><comment><USER17> So were the misissuances evenly spread among CAs or were there some that were clearly worse than others?

</comment><comment><USER18> Once upon a time i was interested in them my marketing team wanted them. The hassle of dealing with the people that vetted our company documents ensured I never did it again. Totally hopeless process and worse still it was a total waste of my time. Terrible user experience and we paid for the privilege. Today we use the free amazon certificates and it doesn't cost me time any more. I keep waiting to hear how the certificate business is headed for ruin.

</comment><comment><USER19> Is there any kind of transparency index listing CAs and the number of mistakes they've made?

<comment><USER12> A single severe mistake can result the CA being kicked out, but CAs like Symantec were too big to fail, so browser vendors had to spend time and effort to kick them out.

There is CT logs of course. Even if the certs were issued by error or fraud, they must still be included in the log. There must be automated processes scanning these logs and validate the certs (x509lint, cablint, zlint, etc).

I suppose you can check CA CRLs or combined CRLs like Mozilla OneCRL to find recently revoked certs and lint them to see if there were issued with errors.

</comment></comment><comment><USER20> Is it possible to get an EV cert without registering with a specific government database first?

<comment><USER12> It doesn't have to be a government list. Any recognized (vague measurement I know) will do. But you need to be registered in a country.individuals cannot take one.

</comment></comment><comment><USER21> Can someone explain how revocations work? how many there are? what the rules are - etc?

</comment><comment><USER22> Are all of these EV issues not data entry errors?

<comment><USER23> Presumably they are, but the entire point of an EV certificate is that the company's information is supposed to be vetted and verified. If a single human error can cause an invalid certificate to be issued, it's not just a problem with that one certificate. It's potentially a sign of systemic issues that call into question the trustworthiness of all other certificates issued by that CA.

A signed certificate that contains invalid or incorrect data is considered to have been misissued according to the CA/Browser Forum's Baseline Requirements [1]. Misissuance not only obligates the CA to quickly revoke the certificate upon discovery, but also frequently leads to discussions in places like Mozilla's dev-security-policy mailing list. [2]

If you follow some of those discussions, you'll quickly see that browser vendors hold the CAs to fairly high standards. Blaming a misissuance on a "data entry error" is generally not considered sufficient or acceptable; they're expected to be able to explain why the errors were not caught by technical controls or verification processes, and how those defenses can be improved to prevent the same errors from recurring.

[1]: [https://cabforum.org/baseline-requirements- documents/](https://cabforum.org/baseline-requirements-documents/)

[2]: [https://groups.google.com/forum/#!forum/mozilla.dev.security...](https://groups.google.com/forum/#!forum/mozilla.dev.security.policy)

</comment></comment><comment><USER24> I think the traditional concepts of CAs has showed again and again that it does not work. Yet cryptography is worthless if you can't validate who you are talking with. I would propose a system where multiple parties could sign the SSL-certificate and these would be shown as badges in the browser. The more badges the more trustworthy.

Say for example that you have an online store. Then the local tax-office could sign your certificate if you are a registered company in that country. If you have a contract with VISA, they could sign your certificate. The authority for your top-domain could also sign the certificate to prove you own the domain and so on.

And for a customer buying from this store, seeing these badges in the browser would let them decide how trustworthy the website is. I actually think with this solution getting the users to understand would be the least problem. The big problem would be to get developers to authenticate the certificates while doing back-end calls. I mean how many developers even does this today?

<comment><USER25> Number of badges is not going to help if you can't trust any given badge — no matter what the details are, given how automated attacks are, it is reasonable to presume that as soon as you've worked out how to circumvent one, you've probably figured out how to circumvent more of them than will fit in a browser bar at once.

</comment></comment><comment><USER26> Edit: yes, I got the numbers mixed up

I really don't see why having a Danish number in a Swedish registered company is a big deal.

The phone might simply their contact for whomever is responsible for the certificate and it might be possible these contact is in Denmark.

I mean if it was a Canadian company with an US number and most likely they wouldn't even know.

<comment><USER27> A Danish business registration number (CVR in Danish), not a phone number.

<comment><USER26> Ah thanks for the clarification</comment></comment></comment>


How to become rich even if nobody is following you on Twitter - <AUTHOR> http://blog.cubeofm.com/how-to-become-rich-even-if-nobody-is-followin <comment><USER3> I'm not a big fan of creating that many products since it seems like you're forcing yourself into a churn-and-burn corner (and you'll probably be building systemic weaknesses into your model, like being one Googlewhack or AppStore reordering away from penury). However, the core insight about creation being one more process that can be scaled is potentially pretty big.

You can even use it in the service of the one big lovingly-handedcrafted adequately-supported non-sucking product that you're supposedly not capable of building/marketing/etc. For example, everybody and their dog has done "photo sharing website", and if you're coming to the Internet today with photo sharing site #85421 you're probably not going to get too far. However, you could probably do fairly well with the same tech and a focus on wedding photographers. (I happen to know that pond is well-fished, too, just an example.) And you could roll out new facets of your marketing/product creation strategy to target each niche you can identify, big and small.

For example: I very much doubt that I could make a software product about a subject as niche as owls of Asia while still adequately devoting time and resources to supporting/maintaining/improving it, but I'm pretty sure with an established product adding a bit about owls of Asia to the marketing mix is pretty much just a bolt-on-and-go sort of maneuver. (You might ask "Now is there anyone in the world who will actually pay money to do something associated with the owls of Asia?!" I have evidence in the affirmative.)

Edit to add: It seems Max and I independently chose owl-related niches as our practical examples, since he posted before me and I didn't see it. What are the odds, right?

</comment><comment><USER4> This is a sure-fire way to create a lot of spam and hack products. The creative element of fostering a project and putting real intellectual effort is gone, for sake of trying to turn a measly profit. There is nothing artistic or genuine about what he is doing here. There is no soul in these products.

Of all the products and software I use, there is soul in every single one of them. Safari, Tweetie/Twitter, Hacker News, iTunes, Adium, Fireworks, TextMate, Sequel Pro, zsh, Firefox, and all of the websites I read. They each have something to be proud of. If you are making software and services that you cannot be proud of and are only there to make you money, then you have chosen a path that is less meaningful and will not bring you the kind of happiness and security that I think most software creators are looking for in building software.

Feeding your family is one thing, but creating and harboring what is effectively spam is not the only way to do it. Labors of love are perfectly capable of making you money, and with the right amount of luck, and much more preparation, you can find yourself rolling in the same dough as these bottom of the barrel money makers that this writer is scheming.

As they say, don't eat your soul to fill your belly.

<comment><USER5> I'm not sure your conclusion necessarily follows what he's proposing. He's saying: find 400 things that each make $1/day -- it's a thought experiment as much as it is a proposition, BTW.

Some people would certainly make 400 spam blogs or something else equally useless. I don't think that was the author's intention, though.

I wish I could personally say that every single thing I do has my heart and soul in it. I can't, for reasons outside my apparent control. I bet I could find 400 things I _like_ enough to spend time on, and that's enough for me.

<comment><USER4> My conclusion stems from his primary example: A collection of ninja videos slathered with adsense. It's half-way to a spamblog, but he considers it something to be proud of.

<comment><USER6> I think he considers it a way to make money.

</comment></comment></comment></comment><comment><USER7> This article is silly, and just wrong in every way. It totally discounts time spent doing these projects, and totally fails to understand expected value. For instance:

"I wrote a desktop software once, and priced it at $29.90. I sold one copy a month, which was terrible. That's $1 a day. It's really easy as a programmer to do something that makes $1 a day."

I suppose if that desktop software took an hour to make it would be worth it in a few months. More likely it took an amount of time that would better have been spent (from a purely financial perspective) working at Wal-Mart and then investing the funds in an ETF. To make $1 a day ($365/yr) takes only around $4k (what a good programmer earns in <2 weeks) tossed into the market. Thus any project that takes you longer than that for $1/day in return is a waste.

Also even if you assumed every project would net $1 per day, you'd still be better off thinking big. A hit Facebook app, for instance, might make $10,000 a day. (A megahit 10x that.) A good keyword to arbitrage via an affiliate account and AdSense could do the same.

You're far better off taking a 1% shot at $10k/day than a 100% shot at $1. (You're far better off taking a .1% shot.) You might say "well what about variance" but apparently you have the time to create 400 products.

Also, Twitter followers have done little of real value for anyone in terms of making a business profitable. On the list of ways to get customers to your web-based business, Twitter's still pretty far down the chain.

A far better plan would be to try to create one product that makes $1 per person you drive to it. This is doable. Then you can buy users for far less with ads, roll your profits into more ads, rinse, repeat. This is how people like me who rarely if ever use Twitter have made oodles from the web. (I've done this now multiple times, for reference.)

<comment><USER8> Matt, a huge part that I _think_ he has left out is the use of outsourcing stuff offshore. A lot of his projects seem to be content plays. You can get lots of content produced offshore for very cheap.

The end result? You can have 5 people working full-time at $500/month each($2500/month), each producing content for 50 of your sites. Now you might wonder how one guy can write content for 50 sites. It's actually not that hard. Give 2 hours per blog post per site. And in a 9hrs day, you can cover 3-4 sites, averaging out to about 2 blog posts/month per site--which can be profitable in the big scheme of things.

When quality is not a huge consideration, you can get a lot of cheap stuff done offshore.

<comment><USER9> I'd still not give you odds on making more than $1 per 'project' per day though.

Factoring in all the costs you'd be very happy to be a bit above break even after a year with tons of 'content' ripped by mfa sites that don't do all the work and that don't invest the money. They'll be making your profit. And at $1 / day per project you're not going to spend any time suing the infringers either.

<comment><USER8> It's totally doable IMO. A friend of mine who knows nothing more than how to setup a wordpress(answer: get her bf to do it) wrote 20 posts and forgot about the blog. She gets ~$50 check from google every month. She was laughing about it.

The life time value of her blog post is pretty cool!

I don't know if it scales(I'm presuming it does from posts like the OP). But hey I like the initial numbers.

<comment><USER9> Cool!

But to prove it works you need to scale it, and that's where the hard part sits I think.

I fell for it in just that way.

This all started with <http://www.clustercompute.com/>

A small site about a project that I built years ago.

I rebuilt it using drupal, and the template had a nice spot for a google ad in it so I thought oh well, whatever, let's do that.

To my surprise it made some money! Hey I thought, that's easy, let's do that some more. And that's when I ran in to the statistics of the thing, when the numbers get larger the payout seems to drop considerably.

$50 per month is great as 'found' income, and as long as your site is small you'll be able to stay under the radar of the cloners, but as soon as you start getting significant traffic (as in show up on alexas 100,000 or so) then you're going to be cloned left right and center.

You'll be competing with your own content on 20 other sites.

Even on HN we get plenty of 'blogspam' submissions that are basically nothing but the original article quoted with a one line addition (if that).

<comment><USER8> I don't think the idea is so much to grow that one site's revenue from $50 to $500 by making it a full fledge property that attracts attention.

The idea is to build 400 _small_ $50 properties that stay low-key and bring in a small but sustained amount of rev each month.

From your effort, it seems like you tried to make one large property which I can see as being harder to pull off for _this_ particular strategy.

<comment><USER9> No, on the contrary, I tried exactly that, but it seems that some stuff develops traction and the majority simply bombs.

So very few sites land on that '$1/day' target.

Maybe it's my lousy aim!

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> There's a third option not mentioned in the article. That's creating a $1/day project, then working to make it a $2/day, then $3/day.

Either through improving the thing you're selling, or by finding better ways to sell it. Take, for example, email@example.com . He seems do have done pretty well following that method.

I don't know if that's any more or less work than building 400 projects, each selling for $1/day though.

<comment><AUTHOR> I think that's the first option. Which is focusing on one thing and making it better and making more money from it.

<comment><USER3> I'm confused then, because it seems from your post that you say the first option is difficult unless you're a US-based MIT-educated elite startup founder Twitter-chasing wunderkid with VC money coming out your ears and good writing ability.

At the risk of stating the obvious, I am not a US-based MIT-educated elite startup founder Twitter-chasing wunderkid with VC money coming out my ears. Nor do I think any of these are pre-requisites or, well, even all that helpful in terms of building successful businesses. Some of them even contribute to the pathologies in our industry, like obsessive focus on building products to be used by ourselves rather than reaching out to more diverse groups of customers with desirable properties such as "pays money for software."

<comment><AUTHOR> I'm not saying it is impossible to write and sell good software and keep improving it. I'm saying that a lot of people have tried it and do not have the neccessary advice and reach to make the software successful.

Look at all the Review my startup posts. I have only ever seen a handful actually become successful. Most just seem to fade off.

I'm not saying you NEED to be from that group to do it successfully. But it is difficult. What you did, has not been replicable by most of the other people here.

<comment><USER11> That's because most of the Review my startup posts are really "check out my weekend project I threw together". You can get all the advice you need through great books and online content, and reach is simply a matter of building up your online presence through a good blog, open source projects, etc.

</comment></comment></comment></comment></comment><comment><USER12> This is an interesting post, and I'm eager to hear what other people who have spent more time in the startup scene think of it. Here's my thoughts:

1\. I think I've seen the "two groups" that the post talks about, but I have begun to have serious doubts that they're as fatalistic as they're made out to be. For example:

 _The in-crowd live in the U.S, they attended MIT or Berkeley, they write well, have interesting blogs and are followed by 400 or more people on twitter._

You can't change where you went to school, but you can improve your writing skills, start a blog, and get 400 followers on Twitter. In fact, this is trivial over a period of months. Writing good content is not only for the elite; it's how you become one of the elite ;)

2\. If you do a little research up front on the market for whatever you're going to create, you might be able to just create one product rather than 400. It might be more difficult in the beginning, but you just might learn an incredible amount and turn out to be one of the most well-rounded sources of startup insight on HN. See patio11 / Bingo Card Creator for an example :)

3\. My main concern would be sustainability; those 150 projects that make you $12k / month aren't going to do so forever. You'll run yourself ragged trying to keep them all together, and at some point, you'd probably be better off with a job. I guess what I'm saying is to try and pick a model that will scale more than $1/day projects will.

In spite of these criticisms, I did enjoy this article for its thought- provoking angle that's very different from a lot of the stuff I read on HN.

<comment><USER13> Wikis are forever sustainable, even if it is horribly outdated.

However, depending on the niche you occupied, you barely get enough money above your domain cost renewal. Beyond a certain point, it is not worth your time to invest in it.

For me, it helps that I can wait a few year before bootstrapping my next website, along with freelance work. That wiki is still earning me money.

<comment><USER14> Just curious, as someone who is considering starting up a wiki, what is your revenue model? Just ads?

<comment><USER13> That's pretty much it.

</comment></comment></comment></comment><comment><USER15> I think the bigger hurdle for most people is getting from $0 a day to $1 a day. Replicating success isn't as hard as finding success.

<comment><USER5> Max is proposing that it isn't that difficult for a programmer to find a way to make $1/day. Max -- care to elucidate?

<comment><AUTHOR> If you want to make $1 a day, go search for a keyword. Like Owls. Then find a bunch of videos of owls in YouTube, put them on the site and call the site OwlVideo.com. In a week you will be making $1 a day.

Or if you prefer to program for the desktop - go wrap ffmpeg and make an AVI to MP4 converter. Def make $30 in sales in a month.

Or if you prefer to program for the web, make something that parses Apples XML of new iPhone apps, put all that text on your website, slap adverts on it. There is $1 a day.

Or you can copy the bible and allow people to annote it. Put on web. There ya go.

Find a commonly done task like file uploading. Write a wrapper script for this in PHP. Sell it on a scripting site. $1 a day.

Make a wordpress theme and target a specific group. "Theme for Doctors". Make it premium and put it for sale. $1 a day.

It's easy, you just need to think in the right mode.

<comment><USER11> So these might be great ways to make a little bit of money, but they don't really create value (except for the theme). Creating a successful startup should be more about creating value then making money, if you create value the money will come. When you think about success do you define it as money or building something people use and love (and also makes you money). If you want to make a cheap buck there are plenty of ways to do it without providing value. Go create a trash blog on a popular keyword, become a domain squatter, etc. But I want to create value and build something people will use and enjoy using.

<comment><USER16> Agreed - these ideas are not a startup - they don't create real value as a company. However the idea of making passive income is very attractive to many programmers, and creates an opportunity to have time to work on something big.

</comment></comment></comment></comment></comment><comment><USER17> How on earth are you supposed to create and maintain 400 "projects" at once?

<comment><USER18> It all depends on what you put behind the word 'project' (and there's no judgment in my sentence).

For most programmers, a project is something that has already a decent size, is complex to get out and test on the field.

If you think this way, a "side-project" can only be rare.

On the other hand: a friend of mine started exactly the way Max describes a long while back, and currently runs _way more_ than 400 sites/projects.

He is also doing way more than 12k€ per month.

The thing is 95% of his projects wouldn't even catch the 'regular' (if there's such thing) programmer's interest :)

<comment><USER19> It would be really interesting if you could describe some of these projects briefly.

<comment><USER18> Those I know revolve around affiliation, alternate search engines, porn/erotic stuff, niche technological forums and such topics :)

Not by him but in the same kind of idea, here's an example:

<http://fastpowertools.com/>

A while back I know the owner of this site did a few hundreds $ per month. It was really an eye-opener to me :)

Of course this requires SEO skills to earn more than a few bucks, that need to be learn on the way.

I started a couple of sites like this one, and although I earned a bit of money, I wanted to try sites that are really useful to myself, which I'm focusing on now.

I think it's always good to remind myself that between what would look a half- spammy site to a regular programmer, and the typical too complex projects regular programmers would start, there's a sweet spot in the middle.

<comment><USER17> That site looks like a shady search engine spam site. I could never earn money like that and feel good about myself.

<comment><USER18> Well, it's a fun experiment per se - but for one it's hard to really get past the few bucks stage here.

I do understand what you say, that said. My overall feeling is that these kind of sites are not really "changing the world", if I dare.

So now I'm trying to solve real issues I have. It's more fun for me!

</comment></comment></comment></comment></comment></comment><comment><USER20> A better approach:

Get a job at at a startup run by those MIT elite. Kick ass and make yourself invaluable. The next time one of the founders starts their own thing, they'll bring you along at the very beginning. Use that role to get more involved with the business and network like crazy.

Wash, rinse, and repeat.

Depending on your effort, by the third time around you should have the connections and experience necessary to do your own startup - get VC funding - and make the deals necessary to give it a good chance at success.

<comment><USER21> Just as a sidenote, there really aren't that many tech startups started by MIT people, at least relative to say Stanford or Harvard.

<comment><USER20> I was referring to the "MIT elite" mentioned in the original link. Basically - if you haven't gone to a school where you were able to make great connections (Stanford, MIT, Harvard), you'll need to make those connections on the job.

</comment></comment></comment><comment><USER22> This sort of reminds me of the old pottery story, where they had one group making which was graded on how many pots they made and another one which was only graded on their best pot. Of course the group which was graded on quantity made better pots in the end.

I really think that by iterating really quickly you will become good faster than if you try to make the perfect thing right away. So don't be paralyzed by trying to achieve perfection; go out and create, and then create some more.

<comment><USER23> Sounds like the proverb taught to GO beginners: "Lose Your First 100 Games As Quickly As Possible"

<comment><USER24> Also works great for Chess. But horrible for Boxing.

<comment><USER23> You certainly do have to modify that advice to avoid serious injury, but from my limited boxing experience I'll say that nothing teaches you to keep your hands up like getting smacked around a few times.

</comment></comment></comment></comment><comment><USER9> Interesting, I've been doing just that for the last couple of years.

It's been a mix of partial successes and total failures, mostly failures. I didn't want to go the 'mfa' route for obvious reasons, so I try to make these sites in to something that actually is useful, and that have a sense of community about them.

Here is a breakdown of what you can make this way in a month based on adsense alone after several years of work, not something to be proud of, that's for sure.

It is _very_ hard to make stuff that does not need maintenance.

       pfn 	        3,203 	        18 	0.56% 	€0.08 	€0.26
       leftsidebar 	68 	        1 	1.47% 	€0.00 	€0.00
       linkbar 	72 	        0 	0.00% 	€0.00 	€0.00
       ccm    	1,012 	        2 	0.20% 	€0.06 	€0.06
       dzleft 	52,480 	        34 	0.06% 	€0.03 	€1.81
       dzlink 	47,804 	        98 	0.21% 	€0.04 	€1.87
       dzmain 	46,950 	        222 	0.47% 	€0.17 	€7.93
       fls 	        90,839 	        459 	0.51% 	€0.50 	€44.98
       gms 	        4,242 	        61 	1.44% 	€0.31 	€1.31
       hst160x600 	30,360 	        54 	0.18% 	€0.20 	€6.13
       hst468x60 	29,992 	        55 	0.18% 	€0.20 	€6.00
       jks 	        359 	        10 	2.79% 	€2.06 	€0.74
       lrmsmall 	90 	        0 	0.00% 	€0.00 	€0.00
       lrmtall 	2,173,823 	2,039 	0.09% 	€0.05 	€112.76
       lrm    	5,209 	        17 	0.33% 	€0.35 	€1.81
       lrmlink 	2,204,212 	2,234 	0.10% 	€0.05 	€115.06
       lrmlinkbar 	24,719 	        109 	0.44% 	€0.15 	€3.64
       mdcl 	84 	        1 	1.19% 	€0.05 	€0.00
       pcs 	        93,418 	        225 	0.24% 	€0.21 	€19.21
       pcslinkbar 	89,701 	        1,206 	1.34% 	€0.43 	€38.88
       stroompunt 	1,039 	        17 	1.64% 	€3.60 	€3.74
       cams   	1,510,897 	5,889 	0.39% 	€0.19 	€289.18
       ztk 	        27,112 	        711 	2.62% 	€3.69 	€100.15
       ztklinkbar 	28,534 	        462 	1.62% 	€1.30 	€37.10

These figures are for the month of January.

I've removed the ones that I consider total failures from this list or it would have been three times as long.

$1 per day per site sounds like a great plan in theory, but in practice it is quite hard to do that across a broad number of sites and not get bogged down in maintenance issues.

Anything with a form will attract spammers more than it will attract users, software will over time stop working because external things it depends on will change and so on.

Passive income is nice, but it is hard to make something that is really passive.

It's not a complete failure, but it definitely wasn't the success I expected either.

This is due to a whole pile of factors, maintenance has already been mentioned, lousy ECPM is another, inability to get any traction with some projects is a third (anybody interested in a complete platform for trading second hand cars or houses ?).

<comment><USER25> I agree completely, $1 a day times 400 sites is simply not feasible. This article is terrible advice, the kind that will probably lead you to failure. I have a fairly successful affiliate marketing business (I make more than I would if I had a day job), and it seems like every day I talk to people who are taking this approach and making $1-$2 a day. The article's logic is flawed- if it were that easy to make projects that do $1 a day on autopilot, your competitors(and big corporations) would already be scaling that model. The truth of the matter is that nothing runs on autopilot for long. Even with SEO, you constantly need to be producing fresh content, building links, and keeping abreast of ranking changes. And most of the time, these kinds of small-time efforts will still fail and lead to making $0 a day.

On the other hand, every millionaire Internet marketer I've ever talked to (and I've connected with many of the big ones) has succeeded by focusing on a single market/product and scaling it up instead of running around from one failed project to the next like a chicken with its head cut off. Oh, and most of these people are "normals"- they don't have popular blogs or lots of Twitter followers, they're quietly grinding every day and making a killing online.

Trust me, taking one project and not giving up until you MAKE IT WORK will be much more profitable in the long run.

Oh, and I've just gotten into AdWords a couple months ago( most of my previous experience has been with social traffic like Facebook) and am doing _very_ well with it, so anyone who tells you it's too late to get in is either a competitor who doesn't want more competition on a traffic source, or doesn't know what he's talking about.

Talk to people who are actually succeeding online about their strategy, and you'll quickly see a pattern emerge. I bet very few of them got rich by making 400 AdSense sites.

<comment><USER26> Hmmmm. As it happens, you're wrong and to the extent your parent supports your thesis, he's wrong, too. I work for an SEO marketing firm and one of my coworkers built up a portfolio of $1/day projects exactly in the mold of this article over the course of 2 or 3 years, and once he got to about $6000/month, he quit to do it full time. And he was no genius and had very little technical skill--he hired out all his programming.

I would do it myself, but I have no desire to work on projects like that full time, even for only 2 years.

<comment><USER9> Interesting! So, what's the state now, has he been able to continue that trend? Does he have maintenance issues yet? Or does it seem like his model will scale forever?

My 'little projects' make about 800 euros or 1200 dollars per month, so that's about 1/5th of what your friend is doing, or rather was doing when he quit to start working full time.

I'm not saying it's a total failure, but it's not the success I'd hoped for either. And, to be honest at $6,000 per month I'd probably still not be too happy about it, but that's simply because I figured I'd be doing much better when I started out. (I already had a $10,000 per month project with 0 maintenance to tide me over while doing this, if it weren't for that I wouldn't have made it this far).

If he's managed to take $1 / day with 0 input from now forward then he's done very well, but from a business point of view investing 2 to 3 years and getting to $6000 (or $1200 as in my case) still does not count as time well spent.

For instance, if I had spent that time consulting it would have brought a multiple of that (but I'd have to continue to consult, which is of course the whole point of this exercise).

<comment><USER27> This is a standard guy with no real experience and no programming experience getting to $72k/yr after investing some time. Not quite living the dream, but it's not awful either given that he may not have had some outrageous education or experience and is now getting passive income that he can gradually build on.

I think anyone here with some general startup knowledge/ability (e.g., can buy a domain, set up hosting, write HTML, write content, etc) could probably build up a passive $50/day source to give them a bit of a buffer to create bigger projects. Or they should at least be trying it to see if they can pull it off.

</comment></comment></comment></comment></comment><comment><USER28> I think if you try to create 400 projects, most will make 0/day and a couple will make 10/day. Then you optimize those. Slowly you end up with a small number of projects generating a half decent amount money.

This is actually a great way to prevent yourself from choosing a local maximum in the product space. You climb a bunch of hills a little bit.

(edited)

<comment><USER29> Over diversification is dangerous too. Jack of all apps, master of none? I like the idea, but the problem with this product space search is that is dead slow. You might want to search like this for a bit and see what takes off, then put more energy into the ones that are doing well.

<comment><USER28> You are right about the dangers of diversification. You would have to prune down projects as you go or else risk not doing anything well.

However, if the projects are designed to be all up front effort and no ongoing time costs, you can just leave them to languish. I have had things take off in a minor way, long after abandoning them.

</comment></comment></comment><comment><USER27> I do something roughly like this on the side, but trending more towards MFA stuff (not that ninja videos with ads isn't the same). Rather than $1/day, I look to cover the base cost of the domains as a starting point (4c/day at least). Some sites absolutely struggle because they're half-arsed with poor content, no pagerank and few backlinks while others rank really well for reasonable 2-3 word keyphrases.

Of the sites, 5-10 have some traction, took a few hours to set up (total) and make $3-4k/mo, passively.

It's definitely possible and can ease pressure enough to give you time to work on more serious side-project pursuits because your living costs are already taken care of.

<comment><USER30> Would you mind pointing out how your domains are hosted and registered? Thanks

<comment><USER27> I either register domains based on keyword research and bulk searches to see what's still available, or I try to grab expired domains at auction (via drop.com.au). Vast majority of my domains are .com.au - smaller audience obviously, but also less competition when it comes to SEO.

I register through TPP (wholesale account) and host them with CrystalTech. On a base ColdFusion plan ($11.90ish/mo reseller rate) I can host 26 domains and then split out the requests either via ColdFusion or Mod-Rewrite. Some sites are standalone, while a few others use a quick publishing engine I built that takes articles from the database and outputs them with nav, AdSense blocks, etc ready to go.

Given content and a domain pointed to the right nameservers, I can have a multipage site up and running in a few minutes.

I have tried having content written by someone cheaply ($6/300 words) but it's quite obviously MFA, the content isn't massively helpful to those arriving from Google and the sites are rightfully struggling because they're uninspiring.

Another example is a six-page site targeting 2-3 word keyphrases. Content was written by my partner after she had to look into the topic herself and realised there was a bit of a gap in the market. Took her an afternoon to write six pages of content a couple of years back. Took me a couple of hours to put together. Makes about $3-4k/yr from AdSense and I haven't really touched it since I put it together.

If I were to make any recommendations to people hopeful of trying this sort of thing, I'd say:

      - have patience, domain age and so on will stop anything from raking in cash immediately
      - if you have another side-project with decent pagerank, use that to help out the new project
      - don't go for a single keyword as you'll struggle with competition; pick a keyphrase niche
      - make sure you pick something that will have advertising in the space and where the clicks will pay (Google the phrase you're considering, and if no ads show, avoid that phrase)
      - use Google's keyword research tool to find a niche with some traffic
      - try to pick a space where you have some passion/interest and write decent, useful content yourself. If you do use a dodgy paid-writer, take what they've created and try to polish it a bit yourself. I think if you're just looking for a cash-cow, it'll show.

I looked at opening comments through Disqus to try and get some longtail content, but comments are just a waste of time and kill you on maintenance. You want something that will stay relevant and if it needs any maintenance, it's just an hour a month or so to tweak.

<comment><USER30> Thank you very much for this precise and very helpful answer!

</comment></comment></comment></comment><comment><USER31> Making $1 400 times is exactly my business model. I've been building websites that hire excellent writers to write excellent content about specific keywords, targeted for SEO, and every article brings in about $1.50/day. Each article costs me about $10 to make (so I make back my investment in 7 months, purely passive). I write about 100-200 articles/month.

I wrote software and hired assistants to do everything, so my actual work is < 4h/week. The software I wrote can be seen just after the 3m' mark here: <http://www.youtube.com/watch?v=1merER1zVFg> .

I find targeted keywords, use SEM to get my article into the top 4 results and sit back and wait for passive income. It's not as hard as you'd think.

</comment><comment><USER32> To borrow Warren Buffet's term, the in-crowd are the winners of the Ovarian Lottery, and the normals (with me among them) are the losers.

 _"I've had it so good in this world, you know. The odds were fifty-to-one against me born in the United States in 1930. I won the lottery the day I emerged from the womb by being in the United States instead of in some other country where my chances would have been way different._

 _Imagine there are two identical twins in the womb, both equally bright and energetic. And the genie says to them, "One of you is going to be born in the United States, and one of you is going to be born in Bangladesh. And if you wind up in Bangladesh, you will pay no taxes. What percentage of your income would you bid to be the one this is born in the United States?" It says something about the fact that society has something to do with your fate and not just your innate qualities. The people who say, "I did it all myself," and think of themselves as Horatio Alger – believe me, they'd bid more to be in the United States than in Bangladesh. That's the Ovarian Lottery."_

</comment><comment><USER33> It seems like marketing would still be an issue though. Even to make $1/day, someone has to find your software. If you're not marketing through a blog or Twitter, that leaves advertising. So now in addition to writing good ads, you need to make sure each project is making more than you're spending on advertising, which is a lot of work on its own.

<comment><AUTHOR> Actually, it's not. If you have to move 1000 copies of software in a month, then you need to market. If you want to move 1 copy a month, list it on download.com and you will move 1 copy. That's the beauty of the system - <USER2> minimises the need for marketing and instead ups the project count to make up for the loss there.

You are basically moving resources from one thing (marketing, promotion) into another (designing generic software, finding new ideas, writing software very fast). The second options are easy for software developers to do compared to marketing.

<comment><USER9> If you write software to move 1 copy per month then you'll be writing software to move 25 copies during the lifetime of that version. It'd be very hard to even support your users.

</comment></comment></comment><comment><USER34> Interesting article.

I guess there is definitely some money to be made, if the site is useful ("tool" based). Some examples:

<http://selfmademinds.com/200811/mini-site-case-study-update/>

<http://www.calendarsquick.com/printables/index.html> (don't know how much this site makes, I'd assume more than $1 per day)

<comment><USER35> Curious, how important do you feel a good domain name is for these mini-sites?

Imagine that a highly relevant name could significantly reduce your marketing investment and get you more traffic.

<comment><USER34> not sure if domain name is that important, for such tiny sites. Most of your traffic is going to be from search engines, so I guess you'll need to worry more about SEO than coming up with a memorable name (as people aren't going to remember it). From SEO point of view, keyword rich domain names are important, not sure how much though.

</comment></comment></comment><comment><USER36> Sounds like a great strategy if one only cares about making money and doesn't care about working on any projects, startups, software for companies, ect.

<comment><USER37> If you take his definitions of in-crowd vs. normals to be true, the in-crowd has the prerogative to choose energizing startups and work on exciting projects without putting much thought into making money early-on. The normals have bills to pay, kids to send to school, and sick family members to take care. For us normals, money is always a large (though not the only) factor in making decisions that relate to our career, projects, and products.

I would love to leave everything and work on some of my ideas but too many people rely on me to have a stable income at this point for me to just abandon them midstream. This doesn't mean I'm doing nothing. I'm slowly changing my life around so I can get to where I want to be. But at every project I look into, I have to consider how much money I can potentially make and how soon would I see a cash flow. The normals aren't all dreaming of being the next MS/Google. Just like the in-crowd, we want to make good products that users would love. We just have a lot more baggage and need to make sure our dreams don't get in the way of our loved ones' care.

<comment><USER36> I guess I should have said sounds like a "strategy." It dislike the strategy because it's not why I program. I don't program a million things to make a million dollars. I program because it's a passion, and unless I misinterpreted the meaning of the post, this strategy is...heartless.

I take into account that "in-crowd" has it easy and "normal" doesn't. I could image myself writing a similar article; however, instead of the goal being _"make 12,000 a month"_ , the goal would have been " _Find followers_ so that one can _make a reputation_ which will allow one to _find a well-liked job_ (could be continuing to make small apps)" And hell. I'd sure as hell point out that if one attempts to make money from those apps, then one can help subsidize his living costs and manage to raise enough money to send his or her kids to private school!

<comment><AUTHOR> One of the reasons I write now is to grow my popularity, so that one day I will have enough reach to be able to build something big and grand and people will actually notice.

<comment><USER38> Why do you have to have reach in order to build something big and grand? Your reach has no bearing on the quality of your product! The idea is to build something so great that others will talk favorably about it regardless of what you say.

<comment><USER39> Except for projects that require a large userbase before it is useful (auctions, dating sites, etc). Then, a large following can be the jumpstart you need.

</comment></comment></comment></comment></comment></comment><comment><USER40> Assuming a 20 day work month and a 10 hour workday that will give you half an hour a month to work on each of your 400 projects. And assuming (optimistically) that you will spend 2 weeks doing each project it will take 15 years to get to 400.

And that's not counting overhead such as accounting, etc. for all of your projects.

I like the idea of the post, but maybe he took it a bit too far...

<comment><AUTHOR> That's the point - you don't start a new project every 2 weeks. You start off with an idea easily adaptable to various scenarios. Then adapt each time, target new people, and observe if the variation makes you required $1 a day. When you have nichified a codebase that nothing more can be squeezed of it, you start on the next.

<comment><USER6> So it's not really 400 projects, it's maybe 20 projects optimized in 20 different ways each.

That's a whole different way to look at it.

</comment></comment></comment><comment><USER41> In short, forget interesting projects, spam and SEO are the way to go :P

</comment><comment><USER42> This advice feels wrong but it reminds of what Jason Fried said at this year's startup school, which I feel is better advice anyways. [I'm probably butchering it but one of the gists of it was] Just get started and practice making money.

<http://www.justin.tv/clip/b897875d2e8cd907>

</comment><comment><USER43> Although I wouldn't see myself doing 400 "half baked" projects, I understand that it could be a solution for people who are in it for the money. That being said, I definitely agree with the fact that your social network and environment can have a big influence on your success. We don't all have the chance to live in Silicon Valley.

</comment><comment><USER44> I think the odds of creating 400 money-making projects without one of them becoming a real success are very low.

<comment><USER36> One of the projects was putting thirty ninja videos on a website. When that project becomes a _real success_ I'll buy you dinner.

<comment><USER45> Ask a ninja is ridiculously popular and probably started with a bunch of videos.

<comment><USER5> Ask a Ninja is so popular that he/they (I'm unclear) appeared alongside a bunch of stars in SF recently -- in honor of Conan O'Brien, whom I presume was there as well. Holy cow.

</comment></comment></comment></comment><comment><USER46> I actually don't agree with the in-crowd - normal philosophy. As long as someone works hard and gives good focus then the chances of someone being highly successful is pretty good. As I always say, 99% effort, 1% luck.

</comment><comment><USER47> Did you set the "in crowd #" at 400 twitter followers because that's what you have? Because 400 is pretty low, I'd say the number should be closer to 15,000

<comment><AUTHOR> 15k followers is not in-crowd that's more like the exclusive country club crowd. Most seem to have 60 or 70 followers. The people who are just random programmers and not real marketers seem to have 400-600. But I obviously did not do any serious research on this.

</comment></comment><comment><USER48> Ah, that photo brings back memories. That's the keihin-touhoku line in tokyo and believe me, it's an accurate depiction.

</comment><comment><USER49> If ever I wanted the ability to down vote a blog submission, it was this one.

</comment><comment><USER50> "The normals lack any of those attributes. They may be 50 years old, or have gone to community college, or may have learned programming on their own, or may come from Bulgaria or some other distant country."

That is, frankly, racist.

<comment><USER5> Why is it racist?

<comment><USER50> Just because someone comes "from a distant country" doesn't mean you can make any sort of preconception about them...

<comment><AUTHOR> A bulgarian with bad english is very distant from the silicon valley connections.</comment></comment></comment></comment>


Show HN: New Earbits design is more app-like - <AUTHOR> http://www.earbits.com/play

<comment><USER2> I like it, hadn't heard of Earbits before.

Just wondering, are the artist bios entered/managed manually or pulled from some API or external resource?

<comment><AUTHOR> They are entered manually by the artist or label.

</comment></comment><comment><USER3> I have flashed blocked by default (click to play on Chrome), so it took forever to time out and give me an error. Not a great experience.

<comment><AUTHOR> Thanks for the head's up.

</comment></comment><comment><USER4> Please give my back button back.

</comment><comment><USER5> Works and looks good to me.</comment>


Coders at work Q's - <AUTHOR> http://www.codersatwork.com/questions.html <comment><AUTHOR> Also a page for suggesting your "coder(s)" of choice ~ <http://www.codersatwork.com/shuffle.fhtml> and read about it here ~ [http://www.gigamonkeys.com/blog/2007/07/17/coders-at-work- so...](http://www.gigamonkeys.com/blog/2007/07/17/coders-at-work-sorting.html)</comment>


What Seems to be the Problem Here? - <AUTHOR> http://nplusonemag.com/what-seems-to-be-the-problem-here

<comment><USER2> n+1 produces quality articles, check out [http://nplusonemag.com/bad- education](http://nplusonemag.com/bad-education)</comment>


New site to have anonymous discussions - <AUTHOR> http://www.fakewall.in

<comment><USER2> nice... :)</comment>


Creating a Redis Module in 15 Lines of Code - <AUTHOR> https://gist.github.com/dvirsky/83fc32366d5ad82fc3dca47ed2704377 <comment><USER2> I'm trying to be cautious yet open-minded and optimistic with Redis modules.

Redis is such a well-written C software that I can't help but think modules might become an antipattern to Redis. I like the idea that the option to use modules exists, but I hope it doesn't spiral into dependency hell as it is with the Ruby ecosystem. I hope library developers think very hard before employing and requiring a module.

Redis is fast, easy to use, and extremely flexible, and makes it easy to use any of the hosted options (Redis Labs, RedisToGo). Its allure is that Redis is batteries-included yet small enough like a Swiss knife. I wouldn't mind installing a module if it brought in significant optimization for a specific use case. I personally hope most library developers will pretend modules don't exist, and that only app developers will use them. I have this selfish desire that most libraries stick to the vanilla Redis features, because for most things you can use app code to manipulate the features you need without modifying Redis and compromising performance. Modules might add to the heap of things to think about, such as special Redis deployments or the things that can go wrong with the module code.

My fear is that instead of years of using the simple Lego blocks that is vanilla Redis, modules will start a pattern where we need to install special modules to use certain libraries.

TL;DR, I'm worried for the potential for abuse with Redis modules. My love for Redis was how simple and powerful it is, and yet now Redis has grown up, ready for modules.

<comment><USER3> The only other C project I know of with a module system in Linux. I've actually found that Linux modules make development _much_ easier because you can isolate your code from the rest of the Linux code base. Of course, the last time I was professionally developing with the Linux kernel, git hadn't been invented yet and you really couldn't keep the entire kernel in version control without going insane. So, maybe things are different now.

<comment><USER4> Are modules not pretty common? Apache and Nginx have modules like that as well.

<comment><USER5> Nginx's modularity and tolerance/embrace of plugins is absolutely amazing. I use a combination of openresty[0], lua scripting, and third party modules in our API servers (coincidentally, one that talks directly to Redis) and it's still one of the fastest, best pieces of software in our stack.

I understand the concern, but if it ends up being half as flexible (and I already love me some Redis) I can only see good things.

</comment></comment></comment></comment><comment><USER3> What projects are people using Redis for? I'd love to know how others are using Lua or plan to use the new module system specifically.

We're using redis as a queue (Sidekiq) and also to store the index.html page for our SPA. We have an "active" key in redis and its value is the key for the current index.html. This let's us push new versions of our app into redis (each generation of our asset files has a unique name so a new index.html gives you a new version of the SPA). We can then add a get param to our URL and pull a specific version of the index.html out of redis. Once we've smoke tested, we update our "current" value to point to the new index.html and, boom, zero downtime deploys.

What's your story?

<comment><USER2> We use Redis as a record level distributed lock on top of pub/sub and a cache and a queue. We also take advantage of expiring keys to detect if users are connected or have activity. We used to use it a session store but switched to encrypted cookies. I know some have used it as a semaphore as well.

<comment><USER6> What did the semaphore usage look like? Did it use pub/sub or something else?

Also what encryption algorithm are you using on your cookies. I ask because certain algorithms produce malleable ciphertexts, which could potentially be a huge vulnerability.

</comment></comment></comment><comment><USER7> There are also lots of examples from Antirez himself in the source: [https://github.com/antirez/redis/blob/unstable/src/modules/h...](https://github.com/antirez/redis/blob/unstable/src/modules/helloworld.c)

<comment><AUTHOR> There's also the RedisModulesSDK repo that has a few helpers, plus a skeleton module with a makefile: [https://github.com/RedisLabs/RedisModulesSDK](https://github.com/RedisLabs/RedisModulesSDK)

</comment></comment><comment><USER8> I think it's a very good idea because it will reduce the pressure on the core development team about feature X or Y. "You really want this feature? Write it as a module."

Then it can serve as an incubator before importing functions into the core library.

The only problem with modules is that poorly written modules may cause unstability. One way to mitigate this is to have some sort of fuzzer/stress tester for developers to test their modules against.

<comment><AUTHOR> Totally agree. It's really easy to break redis if you're not careful. When I wrote my module I made sure to do lots of random input testing, stress testing, and running things in valgrind to make sure everything is kosher.

</comment></comment><comment><USER9> That looks a lot like a Tcl extension [1]! Maybe I shouldn't be, considering [2], but I still was pleasantly surprised.

[1] Example: [http://www.omanurkka.fi/files/test.c.txt](http://www.omanurkka.fi/files/test.c.txt)

[2] [https://tcl.wiki/9497](https://tcl.wiki/9497)

<comment><AUTHOR> Yeah, not surprising :) Also, the API sort of reminds me of the Python C API.

</comment></comment><comment><USER10> Obscuring links to code w/ shortened URLs is off putting and seems unnecessary.

<comment><USER11> Yeah. I wasn't going to click the link, but you got me curious. The link is: [https://raw.githubusercontent.com/antirez/redis/unstable/src...](https://raw.githubusercontent.com/antirez/redis/unstable/src/redismodule.h)

I don't see why you would hide a link to the official redis repo.

<comment><USER10> This gist inspired me to learn that you can preview bitly links by appending a + to the URL

[http://support.bitly.com/knowledgebase/articles/136551-can-i...](http://support.bitly.com/knowledgebase/articles/136551-can- i-preview-a-shortlink-before-clicking-on-it)

<comment><USER12> Sure, but you're better off not using mystery meat links from Libya in the first place.

<comment><AUTHOR> I've added the real links beside the bitly links, thanks.

</comment></comment></comment></comment></comment><comment><USER13> I really like these types of examples but to fixate on the fact its 15 lines of code, forgetting about the many thousands of lines of code below it that do the actual work. Don't forget to thank your developers for making an API that can show you how to use the library in 15 lines.

<comment><AUTHOR> You are misreading my title. As someone who actually helped with building it, the point was not to boast about it, but show how little you need to get a module stub up and running.

Usually I hate those titles too because they show some "import gravity" type of thing, but here the point was to just show that the boilerplate is roughly 15 LOC.

</comment></comment><comment><USER14> What's the point of being so proud it only takes 15 lines of code? If it had taken 20, would people have groaned and walked away? Examples like this aren't "real world" anyway, so...?

<comment><USER15> It's small enough to get a rough feel for how complicated a module would be. It's small enough that it's like "hello world" \- test your toolchain (etc) install. It's simple enough to start understanding the process without having to read a bunch of docs. It's straight-forward, so there's no need to both puzzle out the module interface AND someone's module logic.

There are probably plenty more reasons I'm not thinking of ATM.

<comment><USER14> Ok, then say "Small redis module example to test your toolchain".

Exclaiming it only took 15 lines of code is mostly irrelevant.

<comment><USER16> "Small" is relative and doesn't tell me anything. "15 lines" tells me this is quickly digestible and I can take a minute or two to look it over.</comment></comment></comment></comment>


The Rise and Fall of Working from Home - <AUTHOR> https://www.bloomberg.com/news/articles/2017-07-10/the-rise-and-fall-of-working-from-home <comment><AUTHOR> It's unfortunate that instead of encouraging (or forcing) these lazy employees to shape up and get better at working from home, they make them come in to the office...cluttering roads and fouling the air (assuming they drive cars, of course). Remote working can function wonderfully but you need the right tools and the right people.</comment>


Read-optimize your code - <AUTHOR> http://www.brendel.com/consulting/blog/2009/06/read-optimized-source-code.html <comment><USER3> I'm not sure why, but people that use the term "not a team player" to beat other people up really rub me the wrong way.

Perhaps its because the desired trait has no moral worth in itself. It's application of peer pressure at its most brazen. It sounds to me like, "you're not conforming to the group's norms", or "you're exhibiting lower than acceptable levels of groupthink".

Anyway, I agree with naming (the most important aspect of programming style, IMHO) and "why over how" comments. The consistent style, I'm a lot less enamoured with. Aligned '=' assignments drive me up the wall - <USER2> when there are short variables like 'i' mixed with nice long descriptive names, where it can be hard to see what corresponds to what with the gap in the middle. But, of such stuff wars are made.

The other argument against consistent style is archeological: style idiosyncrasies, providing they aren't too far off the beaten track, can make it clear at a glance who on the team modified a particular piece of code.

<comment><USER4> I think he means "not a team player" in a very literal sense: if you are too lazy to organize and document your code, you are valuing a few minutes of your time as more important than much more of someone else's. That "someone else" is most likely on your team.

I think that alignment and organization is important, but any formal system -- e.g., align all basic blocks of assignments -- is bound to be irritating. I align related statements, with liberal whitespace to distinguish unrelated sections of the same basic block.

"Why" comments are key not only on code, but on data structure definitions also. Is that tree any old tree, a min-heap, a BST, a DAG?</comment></comment>


How often do iOS users update? - The Pareto Distribution - <AUTHOR> http://octopart.com/blog/archives/2013/5/how-often-do-you-update%253F-%252D-the-pareto-principle <comment><USER2> Those numbers are close to my app's update rates as well. I found it surprising that it happened so quickly too, but then noticed how my wife updates her apps: she hates those little red numbers, so will update almost immediately to make them go away.

<comment><USER3> there are two types of people in this world, those who can tolerate the red badges on their apps and those who cant

<comment><USER4> My fiance absolutely never updates and also never clears her notifications. She only uses her phone when she wants to... use her phone.

And actually, I think that's the rational approach. Updating is a horrible experience. "Hey, guess what! You can't do anything while these 10 apps are updating. And guess what, the one you need is in the back of the queue. And a large game is in the front. You're not getting anything done for a while!"

Background auto-updating should be the default on all OSes.

<comment><USER5> Having not owned an iPhone, I just want to clarify: when you update an app, it does so in the foreground? That seems like an odd design decision. Would there be any reason for that to happen, as opposed to in the background (a la Android)?

<comment><USER6> Depends on what you mean by background. You can't use an iOS app while it is being updated (or in the queue to be updated), but you can do anything else. I'd call that a background update.

<comment><USER5> Gotcha. I foreground == can't use the phone while the app is updating. Seems like it uses a similar mechanism to Android app updates then.

</comment></comment></comment></comment></comment></comment><comment><USER7> Wow, that graph is very surprising to me. I only update apps when I update iOS (very rarely). I find it supremely annoying to update things manually. I would worry that the population being captured is not representative of the general app using population.

<comment> k-mcgrady >> "I find it supremely annoying to update things manually"

What's annoying about it? It only takes two/three taps:

1\. App Store

2\. Updates tab

3\. 'Update all'

A password isn't even required anymore. Personally I don't see how anyone could find that annoying but even if they did most app updates come with new features and the benefits of those far outweigh the 10 seconds of time it took to update.

<comment><USER8> Some design issues prevent me from updating regularly and when I do, it's a painful process.

1.) Installing applications of size X generally requires 2X amount of space. I'm not a dev so I don't know what happens under the covers, but I can understand why (copy compress package, unpack/uncompress and deploy to filesystem)

2.) When you update, it's an all-or-none proposition with the "Update All" button

3.) Because of 1 & 2, if you're low on space and one application is too big to update, when you press the "Update All" button you get an error message and nothing gets updated

So, I now have a red "93" on my App Store icon, and unless I want to manually go and update each non-big app individually, that's how it's going to stay.

Bonus: Loading the icons in the "Update" screen impacts the UI something fierce (as does updating, I guess), so Updating individual apps is an exercise in frustration. This scales linearly with the number of apps you need to update, so at this point I'm past the point of no return and will likely not update an app unless it complains directly to me. Even better, _finding_ the app in the update screen is painful since they're sorted by time and not name, so it's nearing the point where if I can't use your app because you complain to me, and you're not an absolutely essential application, I'll probably just delete you.

<comment><USER9> Re: Your first point, the App Store uses delta updates now, so, it doesn't download/replace files that haven't changed.

</comment></comment></comment></comment><comment><USER10> My wife never updates her iOS apps. Any lawyers here able to tell me whether that constitutes "irreconcilable differences" ?

</comment><comment><USER11> For me it's the Peter Principle - update until the app becomes worse than it was before. I don't trust them not to ruin more things in the future and I can't really revert, so that's where things stay.

<comment><USER12> If it is an app you care about then you better go read the reviews before updating because you cannot roll back.

<comment><USER13> Sure you can, if you have a backup of the ipa file on your computer.

<comment><USER12> I haven't connected my phone to my computer for years so that won't really work for me, but yeah you could go that way.

<comment><USER14> Technically, you don't need to _connect_ your phone to the computer. It will do it w/o your intervention. I backup/sync all devices in the family to one computer over Wi-Fi.

<comment><USER12> Can you roll back to a previous version of an app using iCloud after you update? I don't think so.

<comment><USER14> How does iCloud comes into this picture?

Grandparent suggested using iTunes on computer for ipa backups. I've added that you don't need to connect your phone to that computer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I only update the apps when I had a chance to read the reviews. Often the latest versions have bugs and may reduce the functionality, so I make sure there is an improvement before updating. For example, I have my old kindle app from 2011 that allows in-app purchases.

</comment><comment><USER16> Our server API still receives noticeable traffic for versions of the app that date back to late 2011 when we first launched.

<comment><USER17> Same. A lot of people don't update ever unfortunately.

</comment></comment><comment><USER18> I wonder how this compares to Android users, where (I presume) many users have auto-update turned on.

<comment><USER19> I'm also pretty curious about this. I'd assumed that auto-update was a pretty basic feature and that of course iOS would have it- it's only with this thread/article that i'm discovering otherwise. Is there any particular reason that iOS doesn't do automatic updates in the background? I've just got "update automatically on WiFi only" set up on my Android phone and I've never had any problems.

</comment></comment><comment><USER20> Here's their decision: Update or Delete. People don't like that extra notification laying there. So you will either retain them or loose them when you update. Some who are disengaged will just update all, but those users you care about will either update or delete.

</comment><comment><USER21> I'd like to point out that Octopart customer base is probably tech friendly (as they are an electronic parts search engine), I would be more curious about numbers from an app geared toward general consumers such as Yelp.

</comment><comment><USER22> That curve fitting seems a bit off in the middle and at the tail. What does the log plot show? Log-log plot? That will nail down a power law or exponential law if there is one.

</comment><comment><USER23> Along these lines, it was surprising to me that many non-techies never close out their apps. They leave them running in the background and are not even aware it was possible to close an app.

As a developer, this means the only time many users will "restart" the app is when they update, and the restart is forced upon them. So make sure your apps are stable!

<comment><USER24> More surprising to me is that ANYONE closes out their apps.

I've never ever ever pressed that little red (-) icon. On pretty rare occasion, I need to hold _power_ and then hold _home_ to kill an unresponsive app. But I've never "quit" an app when I was done with it. I've had an iPhone since the beginning and my battery life and performance has always been stellar. Only apps that passively use GPS have been a problem , so I uninstall those.

This is also (mostly) true on my Mac as well. I leave DOZENS of apps running and only kill them if they start sucking down CPU cycles. Generally, most apps sit there, do nothing, and get paged out to the flash disk.

I'm also a little annoyed each time I meet a non-techie who had some techie tell them "Oh, here's how you close apps. It will make your phone faster." Try as I might, I can't convince my girlfriend that it has absolutely no effect. She religiously closes every single app in that little tray once or twice a day.

It's 2013 people. We don't (shouldn't?) need to manually manage memory for our computers.

<comment><USER25> It's not always about memory. With my (current iOS, but not current hardware) iPhone, it's about battery life - for whatever reason, applications that use the camera dramatically drop battery power even if the app isn't "active".

It shouldn't be that way, but it is, and the only way I have to control it is to go manually quit certain applications when I'm done with them.

<comment><USER24> > applications that use the camera dramatically drop battery power even if the > app isn't "active"

Do you have any evidence of this? Have you run a controlled experiment? Because that makes zero sense. I'm 99% sure that you've been conditioned to press a placebo button.

<comment><USER25> Others (and you) note battery drain when the gps circuits are used, why does it make "zero sense" that current draw is higher when the camera is powered on, vs when it's off?

To answer your question though, yes, I have experimented several times over the nearly three years I've owned the phone (plain old iPhone 4 from sept 2010). From a full charge, airplane mode on (turn off the RF drain and minimize outside events -- namely texts and phone calls that I cannot control), phone set to sleep after 1 minute, screen brightness minimum, and with nothing else running, I can start the camera app (pre-configured to be in still photo mode, with flash set to "off"), hit the home button to drop the camera app to the "background", start and then quit the notes app to make sure the last thing I did was something other than the camera app, and doing nothing else with the phone -- lay it on the coffee table and literally do not touch it -- will drain the battery in about 3 hours, 4 max. Doing the same routine, but quitting the camera app, then starting and quitting the notes app and I can leave the phone on the coffee table for days (although I usually give up after about three and start using the phone again).

Everything else I can (and do) leave running with no ill effect.

Bug in the OS? Bug in the built in camera app? Something defective in my battery/phone? Perhaps -- I don't know, and don't really care. I just make a point to turn the camera app off when I'm done with it. Since I usually have a DSLR with me, I rarely reach for my phone for photos in the first place, so it simply isn't that big of an issue.</comment></comment></comment></comment></comment>


Ex-British ambassador claims Russia did Not provide Clinton emails - <AUTHOR> http://www.dailymail.co.uk/news/article-4034038/Ex-British-ambassador-WikiLeaks-operative-claims-Russia-did-NOT-provide-Clinton-emails-handed-D-C-park-intermediary-disgusted-Democratic-insiders.html <comment><USER2> Daily Mail on HN? Revolted.

The "Ex-British" ambassador maintains a blog. Post that:

[https://www.craigmurray.org.uk/archives/2016/12/cias- absence...](https://www.craigmurray.org.uk/archives/2016/12/cias-absence- conviction/)

</comment><comment><USER3> The Daily Mail is notoriously unreliable.

<comment><USER3> I mean, it is. They have very many more more retractions and forced retractions than any other UK newspaper.

> To its critics, however, the Mail is as biased as it's possible to be, and > none too fussy about the facts. In the files of the Press Complaints > Commission, you will find records of 687 complaints against the Mail which > led either to a PCC adjudication or to a resolution negotiated, at least > partially, after the PCC's intervention. The number far exceeds that for any > other British newspaper: the files show 394 complaints against the Sun, 221 > against the Daily Telegraph, 115 against the Guardian. The complaints will > serve as a charge sheet against the Mail and its editor.

> This year, [ _2014_ ] the Mail reported that disabled people are exempt from > the bedroom tax; that asylum-seekers had "targeted" Scotland; that disabled > babies were being euthanised under the Liverpool Care Pathway; that a Kenyan > asylum-seeker had committed murders in his home country; that 878,000 > recipients of Employment Support Allowance had stopped claiming "rather than > face a fresh medical"; that a Portsmouth primary school had denied pupils > water on the hottest day of the year because it was Ramadan; that wolves > would soon return to Britain; that nearly half the electricity produced by > windfarms was discarded. All these reports were false.

[http://www.newstatesman.com/media/2013/12/man-who-hates- libe...](http://www.newstatesman.com/media/2013/12/man-who-hates-liberal- britain)</comment></comment>


Ask HN: Human-Realistic Robots? - <AUTHOR> I'm a novelist and I just completed the first draft of a fictional story about robots.<p>I was wondering: how long do you think it will take for human-realistic robots to become available on the market? <comment><USER2> For what purpose? I consider human like robots a publicity stunt that will never catch on. (sex is probably the exception that proves my rule). I don't have any interest in a human like robot. Robots need to serve a purpose.

I want a robot to do my laundry, vacuum (current offerings leave much to be desired), dishes - in short a domestic servant. I can branch out to yard work, driving... Human realistic isn't of interest, I want the jobs done, and that is where the market it.

I can see pets catching on - but even bipedal pets have significant differences from human like. Passing the truing test is a negative - I want to feel superior to my pets.

Of course your story is about available on the market. That is different from a market success. I can see them in 20-40 years, but just like the pet rock they are a fad that comes and then ends up in the dump.

The above is points to ponder. You are writing fiction. You can reject any as you see fit. If you think I'm wrong about anything you need to consider if your readers will fail to suspend disbelief if you don't explain why I'm wrong. Or maybe I'm right and that lack of demand can be spun to fill the plot hole of why the robots take over. There are endless possibilities. Your universe, your choices: good luck.

<comment><AUTHOR> The purpose is comedy, haha, but the need I have is to realistically estimate when companion robots (clean) will become conversational. Some of the robots in the book are more mechanical-looking. Some more "human-like," meaning: difficult to discern from humans. It's all for the purpose of serving the story, and I can see your point about where the market is. That is helpful as I can see that if these nonsexual companionship robots come to exist, it will be well after every other area is dominated by more useful robots. Thanks!

<comment><USER2> > That is helpful as I can see that if these nonsexual companionship robots > come to exist, it will be well after every other area is dominated by more > useful robots.

Actually I think conversational companion robots can happen before more useful domestic servants. Elisa was from the 1960s, voice recognition is pretty good already. You can do a lot of comedy around a robot that can hold a conversation but can't find it way from the kitchen to the living room (in an open floor plan).

Laundry is actually a hard problem, and there isn't much research going into it. (it might be easier than speech, but a lot of research is going into speech)

</comment></comment></comment><comment><USER3> There are quite a few interpretations of what human-realistic means, but here are my _very_ optimistic, noisy estimates. I'm interested what numbers others come up with.

* Proyas' "I, Robot": 15 years (no evil uprising)

* Spike Jone's "Her": 20 years, but no trans-human A.Is

* Sex robots that feel like "the real thing": 20 years

* Bicentennial Man: 30 years

* Spielberg's "Artificial Intelligence" (2001) - 30 years.

</comment><comment><USER4> Not as long as you think

[http://www.hansonrobotics.com/](http://www.hansonrobotics.com/)

<comment><AUTHOR> This is the assumption I am operating on, so this is a great link. They all seem kind of mechanical, which is what I am using for some of the humor in the book. So, it was fun to watch these robots in action after having imagined what it would look like in my head for so long.</comment></comment>