Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice - <AUTHOR> https://www.anandtech.com/show/12525/security-researchers-publish-ryzen-flaws-gave-amd-24-hours-to-respond <comment><USER2> Amazing coincidence!

On the very same day this information came out, 'Viceroy Research Group' managed to release a 33-page 'analysis' of these results. With illustrations.

Headline:

>We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries.

Viceroy Research lists no employees or contact address, but it appears they are not a crack team of hardworking & incisive business analysts, but two Australian teenagers and a former UK child social worker, struck off in 2014 for misconduct.

They have previous form in producing or plugging short-call stories (quite effectively), and latterly investigated by South African media for similar shady business.

[https://www.moneyweb.co.za/in- depth/investigations/viceroy-u...](https://www.moneyweb.co.za/in- depth/investigations/viceroy-unmasked/)

It took very little internet sleuthing to find this stuff out. None of the tech press bothered to do so.

Disclaimer: I have no position in AMD.

Edit: link to Viceroy [https://viceroyresearch.org/](https://viceroyresearch.org/)

<comment><USER3> If you look at the metadata of both the white paper and the analysis, you can see that the creation time of them is only 2 hours, 50 minutes apart.

And that's the creation date, not even when they were published.

[https://pastebin.com/CcDTz0hB](https://pastebin.com/CcDTz0hB)

<comment><USER3> (Replying to myself because I can't edit my post anymore)

 _Edit:_ And it gets better! If you check the HTTP headers when requesting the whitepaper from their servers, it will tell you that the file was placed there (last-modified) at 13:22 GMT, so just 1 hour before Viceroy Research Group created their analysis - and probably ages before the actual news broke.

[https://pastebin.com/gXVd9cff](https://pastebin.com/gXVd9cff)

</comment></comment></comment><comment><AUTHOR> >All of the exploits require elevated administrator access, with MasterKey going as far as a BIOS reflash on top of that. CTS-Labs goes on the offensive however, stating that it 'raises concerning questions regarding security practices, auditing, and quality controls at AMD', as well as saying that the 'vulnerabilities amount to complete disregard of fundamental security principles'. This is very strong wording indeed, and one might have expected that they might have waited for an official response.

Extremely fishy. 1-day notice? Such aggressive wording without even the chance for AMD to address the concerns?

<comment><USER4> Independent researchers don't owe AMD a chance to address anything. They bought the chips on the open market where AMD makes them available, and then used their own time and materials to conduct their own research. Their work product is their own, and AMD has no claim to it.

There are, as I see it, two rational, coherent ways to be outraged about this story:

1\. The vulnerabilities are fabricated and the report is fraudulent, in which case, by all means, slag the researchers.

2\. The vulnerabilities are real, in which case. AMD is an 11 billion dollar company that got outmaneuvered by what appears to be 4 dudes in a basement.

<comment><USER5> People use AMD chips. It's about more than AMD's stock price.

I do not need to be a security researcher to understand that they, as with everyone else, have an obligation to the body politic to not be a dick (as in all things!). There are actors who may be aware of this attack already--but, as I mentioned elsethread, wider knowledge of attacks like this have a much higher chance of splashing back on end users who literally don't know any better than it does AMD. I mean, I couldn't give less of a shit about how AMD feels--they'll be fine regardless--but there are _people_ downrange of this, not just some company.

This is shoot-the-hostages stuff, and I believe that you are better than to be OK with that.

<comment><USER6> > I do not need to be a security researcher to understand that they, as with > everyone else, have an obligation to the body politic to not be a dick

So are you talking about AMD being dicks by releasing buggy chips, or the researchers somehow being dicks for finding out?

Related question: if a "food security researcher" discovered a vendor was selling contaminated produce - would it be reasonable for them to give the vendor 90 days notice before telling the public?

While I think it's reasonable and appropriate professional practice for _some people/teams_ to go down the "coordinated disclosure" path (I think the world is a better place for having Tavis Ormandy disclose the way he chooses to), it does without doubt benefit the company who's products are flawed more than the researcher or the public. Anybody who knows they work at a firm that's going to be described dismissively like AMD here did "This company was previously unknown to AMD" is quite likely correct to publish-and-be-damned, because you can bet there's a non-zero chance that AMD's response to non-public disclosure is going to include either stonewalling and stringing the problem out as long as possible, or lawyering up ad threatening to sue the "previously unknown to AMD" company into oblivion.

If you don't want public disclosure of security flaws about your products, either don't make flawed products or don't ship them to the public. Especially if some of the key selling features of said product include bullet points like "AMD Secure OS".

<comment><USER7> > about AMD being dicks by releasing buggy chips

Everybody releasing chips releases buggy chips. It's the current reality of both hardware and software. Unless they do it maliciously, they're not dicks.

<comment><USER4> Does everyone who releases drivers release buggy drivers?

<comment><USER7> Close to 100% of software has bugs. Almost all drivers have bugs. Anything that prioritises company profit and release dates over complete correctness in sectors where bugs == deaths, will have bugs. (And even those sectors are not magically immune) So yes - I expect they do.

<comment><USER4> So are vendors who release buggy drivers not "dicks" for the same reason that chip manufacturers aren't?

<comment><USER7> Unless they released it maliciously, I don't hold it against them. And wouldn't call anyone a dick unless they _planned_ to do something evil.

Exceptions: issue was known but got ignored due to release schedule, or security was never mentioned in the project and at no level was there any security consideration. But that's for specific management issues, not engineers or the vendor in general.

<comment><USER4> That's an incredibly low bar. All you have to do to meet is is not actively look for security vulnerabilities in your products.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> [https://amdflaws.com/disclaimer.html](https://amdflaws.com/disclaimer.html)

"you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

<comment><USER9> This is too well organized and presented. My guess is that this has to be financed in some part by a group of short-sellers.

They made a rookie mistake though - AMD is plagued by day-traders and algorithms who couldn't give a damn about the fundamentals.

Boy the future of capital markets is looking grim.

<comment><USER10> A new twist on an old game. I hear people ask why short-selling exists, but's a good check against corruption but prone to it's own abuses. Citron Research (a short-sell shop) is a good example of this— they savaged companies like NQ Mobile, Lumber Liquidators, etc. and make a bundle doing it.

The security angle is a fascinating and concerning new development, however. That said it may encourage more secure practices (as opposed to theater) through the hardware/software lifecycle in response to serious fundamental design problems.

It will also serve to increase the premium on 0days...

<comment><USER11> _> It will also serve to increase the premium on 0days..._

I strongly doubt that. I've seen incredibly serious vulnerabilities I've reported firsthand have little to no impact on a company's valuation when publicized.

<comment><USER12> But did you create an entire website about the vulnerability, including graphics and headline-friendly names, as well as sending out briefings to major media outlets ahead of the disclosure? Because that's what this group did

<comment><USER11> Admittedly no, but considering AMD is up ~3.85% as of this writing, I'm not sure I'd have benefitted from doing so.

</comment></comment></comment></comment></comment></comment><comment><USER13> I found this on /r/AMD haha: [https://i.imgur.com/OkWlIxA.jpg](https://i.imgur.com/OkWlIxA.jpg)

</comment><comment><USER14> "Although we have a good faith belief in our analysis and believe it to be objective and unbiased, you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports." from the disclaimer

</comment><comment><USER15> Why does it say this on the disclaimer:

"...we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports."

Are they shorting AMD? [https://amdflaws.com/disclaimer.html](https://amdflaws.com/disclaimer.html)

</comment><comment><USER16> Linus' reaction: [https://plus.google.com/+LinusTorvalds/posts/PeFp4zYWY46](https://plus.google.com/+LinusTorvalds/posts/PeFp4zYWY46)

<comment><USER17> It's quite unsettling that Linus thinks as much of security in general, given that he maintains a kernel and he's responsible for accepting its security modules that are next to unusable because of their complexity. Could his general disbelief lead to a (kind of) dismissive attitude in this respect? Keep in mind he's the one that would never properly disclose of a security fix - instead of saying which problem is fixed, the general approach is to just publish a new kernel minor release and say "some security bugs are fixed, go figure".

<comment><USER4> People who work in vulnerability research generally just point and laugh at him. His opinion on this doesn't matter.

<comment><USER18> And the people who focus on real security point and laugh at the so called "vulnerability research engineers", and agree with Linus point.

<comment><USER17> I'll bite. What's "real security"?

</comment></comment></comment></comment></comment><comment><USER19> 24 hours means they don't deserve to be called security researchers. They're exploit creators. Given the material effect this would have on AMD's stock, one might also reasonably speculate about their financial interests.

<comment><USER4> One difference between security researchers and "exploit creators", which is a term I think you just made up, is that exploit creators presumably _release exploits_.

Don't tell HD Moore or the Metapsloit team about this, though. They may cry themselves to sleep tonight.

<comment><USER19> Creation and release are two different things. They have created the exploits, or else AMD wouldn't be taking them seriously. They have also contributed more to the re-creation of those exploits by others than they have to security. So you can quibble over whether others use the exact jargon that you would have, but that doesn't change the underlying reality.

<comment><USER4> Every security researcher creates exploits, so I'm not really sure what the distinction you're trying to make is.

</comment></comment></comment></comment><comment><USER20> If the vulnerabilities were real, I'd have no problem with a company using it to promote themselves, trade and talk their book, etc. The issue here is the vulnerabilities are very overhyped (some are fundamental things like "if you reflash your BIOS with evil, you're screwed", some just make local root access more persistent, etc.

The problem with something like TRO LLC is that markets don't move on security info.

</comment><comment><USER21> I think the economics/ethics of the researchers are overshadowing something big:

"RYZENFALL allows malicious code to take complete control over the AMD Secure Processor."

"Multiple vulnerabilities in AMD Secure Processor firmware allow attackers to infiltrate the Secure Processor."

If this is legitimate, this is huge! The PSP could potentially be disabled! Very little work has gone into handicapping the PSP compared to the IME.

<comment><USER22> Well there was a big community push a while ago to have the new AMD cpus have an option to disable the PSP.

I'm gonna wishfully think this was intentionally done to allow us to disable the PSP.

</comment></comment><comment><USER23> 24hrs notice is unheard of.

Who works for CTS-Labs? Attaching your name to a company like that should disqualify you from any future jobs in the security space.

<comment><USER4> Who do you think you speak for? Assuming the vulnerabilities aren't fabricated --- it's happened before with other companies --- attaching your name to that white paper probably guarantees you lifetime employment in security research.

"Unheard of"? People have dropped serious vulnerabilities with _zero_ warning before.

<comment><USER24> Perhaps this is my ignorance, but I was under the impression that security disclosures are usually tightly coordinated to minimize exposure of innocent users.

> "Unheard of"? People have dropped serious vulnerabilities with _zero_ > warning before.

Could you point me to an example of a zero warning disclosure that exposed a large amount of users without first attempting to coordinate with the responsible party?

<comment><USER4> Some researchers coordinate, some researchers don't. For a project originally organized around the principle of getting not just research results but functioning exploit code deployed regardless of vendor preparedness, look no further than Metasploit.

<comment><USER25> Wait, Metasploit of all things? They have been doing coordinated disclosure since forever.

</comment></comment></comment></comment></comment><comment><USER26> Wild guess / conspiracy theory: Intel, afraid of the damage to their image just made worse by diminished performance advantage compared to AMD )due to Meltdown), fearing long-term market loss, quickly found ways to tackle the issue by, instead of pedaling to regain trust, damaging a competitor's image. It seems like a reasonable long game to support and perhaps steer the disclosure of AMD vulnerabilities that CTS-labs had been investigating. Or maybe is was Intel investigating themselves, had some cards up their sleeves, but needed some other entity to do the public disclosure.

Other theories discussed here seem less far-fetched than the above, but in any case, it does smell funny.

<comment><USER27> My guess is that some researcher found something and decided to maximize profits, scraping the bottom of the barrel of quasi-vulnerabilities, creatively exaggerating, and bringing in the lawyers, the financiers and the PR weasels needed to throw a scary web site and a misleading "white paper" at AMD. We'll see what CTS works on next.

</comment></comment><comment><USER28> A security researcher claims to have access to the full (non-public) technical report as well as PoC exploits for it. He says they're legit, and they are flaws, not just "you can do admin things with an admin password".

[https://twitter.com/dguido/status/973628511515750400](https://twitter.com/dguido/status/973628511515750400)

Sounds like the capabilities include the ability to jump outside a VM sandbox, take over the PSP, and pivot to the firmware or BIOS exploits.

[https://www.techpowerup.com/242328/13-major- vulnerabilities-...](https://www.techpowerup.com/242328/13-major- vulnerabilities-discovered-in-amd-zen-architecture-including-backdoors)

<comment><USER29> How do we know this guy's not a conspirator?

<comment><USER28> Track record of research/publications in the field?

[https://www.trailofbits.com/research-and- development/publish...](https://www.trailofbits.com/research-and- development/published-research/)

Ian Cutress of Anandtech appears to be quasi-vouching for Dan Guido. Ian is also interviewing CTS Labs tomorrow morning, and looking for questions.

[https://twitter.com/IanCutress/status/973678700687450113](https://twitter.com/IanCutress/status/973678700687450113)

[https://twitter.com/IanCutress/status/973697525071994880](https://twitter.com/IanCutress/status/973697525071994880)

</comment></comment></comment><comment><USER30> Did anyone verify any of these? The whole thing reeks.

<comment><USER31> Good question. They call the "MASTERKEY attack" that requires a reflashed BIOS "remotely exploitable" because on some systems, the BIOS can be flashed from the OS. They then speculate "On motherboards where re-flashing is not possible because it has been blocked, or because BIOS updates must be encapsulated and digitally signed by an OEM-specific digital signature, we suspect an attacker could occasionally still succeed in re-flashing the BIOS." Page 9 in the PDF.

I'm not a professional security researcher but this is looking pretty darn flimsy. I also don't see any proof of concept code anywhere -- the "whitepaper" seems to just claim these things exist with very little mention of how to exploit them. Compare against Meltdown/Spectre, which was highly technical and had lots of PoC code. This just says "Upload malware to the processor" without further comment.

I'm not saying they didn't find anything, but whatever they found, they've hardly disclosed it.

</comment></comment><comment><USER32> [https://www.reddit.com/r/Amd/comments/84510f/call_to_action_...](https://www.reddit.com/r/Amd/comments/84510f/call_to_action_amd_share_price_manipulation_sec/)

</comment><comment> mark-r Apparently all these can only be exploited if you already have administrator privileges. Raymond Chen calls that "being on the other side of the airtight hatchway" and has written about it numerous times.

[https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=31283)

</comment><comment><USER33> Scammy site, see: [https://news.ycombinator.com/item?id=16576516](https://news.ycombinator.com/item?id=16576516)

</comment><comment><USER34> Since all of this seems to be related to "Secure Boot" and other DRM related crap, can we please just have the option of booting with minimal firmware support, no hidden code, and go for a completely open, community maintained, and audit-able by /anyone/ infrastructure?

No, I don't want HDCP or any similar crap; let me run my servers and desktops in secure mode.

</comment><comment><USER35> I'll still buy Threadripper/EPYC. There is nothing else on the market that is comparable for my needs.

</comment><comment><USER29> I lol'ed at this in the "whitepaper" for a potential impact of a claimed vulnerability:

 _Physical damage to hardware (SPI flash wear-out, etc.)_

Reminds me of little kids trying to fill out their 200-word essays.

</comment><comment><USER36> Legal question:

Insider trading claims might be difficult since you can claim the vulnerabilities were public knowledge waiting to be discovered, but...

Can you trade on knowing the security disclosure timeline prior to your publication of the vulnerability? That would seem to be insider knowledge until AMD authorizes publication. E.g. I've got knowledge that AMD likely wouldn't be able to fix the flaws prior to my disclosure. That knowledge would inherently be non-public.

Thoughts?

Disclosure: I've been long AMD for a while.

<comment><USER37> Insider trading usually implies coming into possession of confidential information and acting on it. Trading on non-public information that results from your own research and then announcing it is not illegal.

Imagine someone buying stock and then saying the company is good. Not very controversial is it. Warren Buffet does it. Shorting stock and saying the company is bad is just the flip side of it.

In fact, there are equity research companies that do specifically that (e.g. Muddy Waters). Whether that research holds water or not is for the market to determine (AMD is up on the day).

<comment><USER36> > Trading on non-public information that results from your own research and > then announcing it is not illegal.

Correct. I'm not referring to this. I'm referring to trading on information discerned from communications with e.g. AMD but prior to disclosure of the vulnerability, especially if those communications which establish e.g. timelines are only disclosed after trading

Hence my point about trading upon understanding AMD's response timeline e.g. from emailing them.

<comment><USER38> Generally speaking, a company communicating information to you does not bar you from trading unless you explicitly agree to refrain from making trades.

<comment><USER36> This is fair. Thanks.

</comment></comment></comment></comment></comment><comment><USER39> The 24h disclosure should not be too much of a problem, since they state:

> "we are letting the public know of these flaws but we are not putting out > technical details and have no intention of putting out technical details, > ever"

It's always a risk, because now people know where to look to recreate it themselves, it's not like this is a full-disclosure release where you're SOL as a manufacturer and have to race rampant public exploitation.

</comment><comment><USER40> If anyone trades options, the IV on options expiring in March on AMD went up significantly last week with no apparent news, probably because of these guys.

</comment><comment><USER41> The upside of this is that most of these vulns are ineffective after disabling AMD "Secure" Processor at boot which is now an option in most firmware. Without breaking manufactures firmware upgrade key you cannot execute the first one to toggle the settings.

The interesting one is against Promontory. It still requires VM host access to exploit so the impact is limited.

</comment><comment><USER42> What shocks me is that most mainstream media report it. It's on top of techmeme, and all major names are linked. sigh.

</comment><comment><USER43> "One hit wonder" security firm is trying to make a name for itself.

</comment><comment><USER44> Does this enable auditing of the psp, or replacing the sw with trusted code?

</comment><comment><USER15> DUPE of [https://news.ycombinator.com/item?id=16576516](https://news.ycombinator.com/item?id=16576516)

</comment><comment><USER45> This is FUD. The original post was flagged, because the domain and website are far from trustworthy. Technically, the accusations seem to be more of a joke.

Hello, Intel?

<comment><USER46> Dan Guido is backing up their claims.

</comment></comment><comment><USER47> > AMD is in the process of responding to the claims, but was only given 24 > hours of notice rather than the typical 90 days for standard vulnerability > disclosure. No official reason was given for the shortened time.

90 days is not a standard. Nothing was shortened. People are allowed to publish their research whenever they like. Vendor advance notification is optional.

Full, immediate disclosure is responsible.

<comment><USER5> And the users downstream of bugs that are made more widely vulnerable-- because, as anyone who saw how, as an example, previously rare MitM attacks became commonplace after Firesheep etc. were publicized, _obscurity is in fact a component of security_ \--are...?

Well, fuck 'em, I guess.

Responsible disclosure, contrary to the super-cool leet kid notions expressed by people with who choose to exhibit an underdeveloped social conscience, is not doing a solid for the companies who have vulnerabilities. It's for the users who consume things. Security researchers are effectively taking upon themselves a role of public service. That comes with responsibilities to the public, not to AMD or whoever.

Meanwhile, this crew looks like they briefed _the media_ before telling the vendor, which is all kinds of fucked.

<comment><USER48> Here's the strongest version of the claim that I understand:

1\. All of the relevant people, i.e. "the users downstream of bugs" are _already vulnerable_.

2\. It's possible, maybe even _probable_ (or _likely_ ), that people, other than the researchers that are disclosing the vulnerability, have also discovered the same vulnerability and, furthermore, that those others can _exploit_ the vulnerability.

3\. Every delay in disclosing the vulnerability prevents the victims from protecting themselves from any bad actors mentioned in [2] thru means more drastic than applying a patch or similar from the relevant vendors (e.g. taking the affected components offline or otherwise making them unavailable).

The argument hinges on the _probable_ size of the bad actors mentioned in [2]. If you _assume_ that the disclosing researchers are the first people to discover the vulnerability, then it would _possibly_ be best for them to first disclose the vulnerability to the relevant vendor or vendors. But note that even vulnerabilities disclosed to vendors can be leaked to bad actors.

And if you _don 't assume_ that the disclosing researchers are the first people to discover the vulnerability, then _not_ disclosing ASAP prevents people from protecting themselves.

<comment><USER5> I think that is a fair depiction. I think also that [3] requires that people are capable, en masse, of protecting themselves from those bad actors.

I think a cursory look at the world indicates that this is not even adjacent to reality.

<comment><USER49> I think your perspective is a bit narrow. If you consider each individual person, [3] is indeed nonsense. However, the impact of many hacks comes disproportionally from high-value targets.

Some high-value targets (e.g. key infrastructure, parts of government, major enterprises) have dedicated security teams, and can come up with a pretty decent response if given the appropriate information. Divulging vulnerability information widely, in particular, may or may not be a net benefit to them. (Consider e.g. Linux vendor vulnerability lists.)

Other high-value targets (e.g. journalists, human-rights activists, etc.) are utterly outgunned by their adversaries (who can afford to buy or find new vulnerabilities), and can only hope that something causes vendors to consistently write software that's sufficiently-uneconomic to exploit. In the sufficiently-long run, proponents of full disclosure would argue, anything that increases the cost of shipping vulnerable software should help these users.

(Disclaimer: absolutely not speaking for my employer here.)

<comment><USER5> Nobody appointed these security researchers to the authority to which you assign to their actions, though. Burning the immediate user on the off chance that it helps the hypothetical future user is some very weak tea.

I agree that some proponents of immediate disclosure would claim that their actions encourage vendors to ship less vulnerable hardware or software. I do not believe that that, in the general case, is why it is being done. And I am certain that that, in this specific case, is not why it was done.

<comment><USER50> Well, the very idea that there is _some_ timelimit on mitigation before the flaw is disclosed anyways is that "very weak tea".

However, overall, I agree with you. Person with exploit needs to compare the probable consequences of disclosing at time N vs. disclosing at time N+1.

If it's being exploited in the wild and users can meaningfully self-protect, disclose now!

If the vendor will probably have a patch in 2 weeks, there is not widespread exploitation of the vulnerability, and disclosing now will _cause_ widespread exploitation, disclose in 2 weeks.

If the vendor seems like they will never issue a patch on their own (because significant time has elapsed), such that at some point in the future there's going to be widespread exploitation and you're only hastening that a bit, go ahead and disclose now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER51> something smells fishy... y 24hrs warning? whatever happened to the usual 90 days disclosure?

</comment><comment><USER29> No reaction from the stock market. I'm not interested.

</comment><comment><USER52> It seems to me a pretty mild security flaw one that requires local root privileges or even reflashing the BIOS to be exploited. I cannot think of a real world scenario where this can be a problem.

</comment><comment><USER53> This is just Intel trying to muddy the AMD waters

</comment><comment><USER54> One thing that does strike me is that, after the Intel Co. situation, giving only a little notice prevents execs from being able to short their own stock on the vuln.

Is this confirmed yet?</comment>


Ask HN: Failsafe Electric Blanket? - <AUTHOR> I've been looking for an electric blanket and have been appalled to find that a large amount of products on the market appear to be obscenely dangerous, despite apparently being UL/ETL listed.
This I've gathered from the consistency with which the amazon listings come with 1-star 'burnt my house down' reviews with pictures, and more importantly that one of the largest vendors, Sunbeam, _still_ sells blankets they know to be defective, _and_ never recalled an older model they know to be even more defective[1]!
That they are still selling them implies a regulatory failure as far as I am concerned. And if they can get away with it, so can everyone else, so no blanket for me.
Which is a real shame because holy wow, electric blankets are so much more efficient than space heaters.
In conclusion, someone please do a disrupt and sell me a blanket
[1] http://www.safetyresearch.net/blog/articles/jury-finds-sunbeam%E2%80%99s-improved-electric-blanket-circuit-still-doesn%E2%80%99t-fail-safe?fbclid=IwAR0Ayoa1n7oz-xW78CZBRwYshnlLBr2Huu0uPEk0E7YhVmTnXvtAAlvatcw <comment><USER2> Or you could just get a hot water bottle... seriously, they are £5 and will never catch on fire. Not continuous but they keep you pretty damn warm for a good hour before needing a refill. Sometimes it's better to just keep things simple.

You also don't need to worry about quality / safety of manufacturing, it's a simple rubber mould - very difficult to get wrong.

<comment><USER3> Still easy to get wrong, I would say. If the lid comes of accidentally or the bottle shears when you lie on top of it, the hot water can burn you.

A few iterations of cost cutting without much regard for safety (why is that skin so thick? Why do we buy premium quality materials?) will easily give you such a device.

<comment><USER2> > A few iterations of cost cutting without much regard for safety (why is that > skin so thick? Why do we buy premium quality materials?) will easily give > you such a device.

It's not a complex profit making product, it's a single piece of rubber, it's not gona suffer from washing-machine syndrome (hot water bottles predate them by centuries).

The modern rubber design was patented in 1903, you find the exact same design everywhere today - If anything is a time proven piece of technology it's the frickin hot water bottle trust me.

<comment><USER3> "hot water bottle recall" gives me several examples of unsafe water bottles.

It also gives me [https://www.productsafety.gov.au/about-us/videos/hot- water-b...](https://www.productsafety.gov.au/about-us/videos/hot-water- bottles-the-hidden-dangers), which says:

 _"Every year, around 200 people are admitted to hospital with serious burns related to hot water bottles.

These are not just superficial burns. Some burns can even require skin grafts and weeks of hospitalisation."_

And that doesn't even talk of faulty water bottles, just of faulty use. Among the things it suggests are to buy a new hot water bottle at the start of each winter, and to only use a hot water bottle to heat the bed – take it out before you get in.

<comment><USER2> That sounds like a very low proportion of users compared to most things, and as you say - due to miss use.

</comment></comment></comment></comment></comment><comment><USER4> Get a BedJet, its safer. I'm astonished no one else has mentioned this solution to you. I bought one for my parents, back in 2015, they love it.

[https://bedjet.com/pages/bedjet-vs-electric- blankets](https://bedjet.com/pages/bedjet-vs-electric-blankets)

</comment><comment><USER5> I'm the third person chiming in without answer as I cannot help you with the electronic blanket. Sorry :)

On a side note I found that if you exercise regularly your body temperature will be MUCH more stable and higher thus possibly eliminate the need for the blanket.

</comment><comment><USER6> try a mylar space blanket. It completely disrupts the electric blanket market by not using electricity.

</comment><comment><USER7> Just checking but you've tried a throw on the bed?

<comment><AUTHOR> It's rather cold in my room. Looking for space heater alternatives.</comment></comment>


Ask HN: Is it possible for a non-programmer to bootstrap a SaaS business alone? - <AUTHOR> https://clientgiant.us/is-it-possible-for-a-non-programmer-to-bootstrap-a-successful-saas-alone-d4b41a5438b0 <comment><USER2> It's not possible unless you have enough money to pay a good developer salary. I've been a part of one once, and the only reason I dealt with the clueless founders was because they paid me better than a regular coding job.

So yeah, it's possible, if you're rich or can get funding before you've got a product.

I've also been approached by countless guys asking me to work on their startup for free or something like 10% equity. Bitch please. I've been a consultant and run all sides of a business, what could you possibly bring to the table besides a nebulous and nearly worthless idea?

To those guys I've started asking for 60% equity and they usually walk away as if it was an insult.

Let me be clear about it. You can run a business with engineers alone and write software. Even one single engineer can run his own software business. If was running a start-up that makes software with two founders do I want one of them to make 0% of the product?

<comment><USER3> > To those guys I've started asking for 60% equity and they usually walk away > as if it was an insult.

Do you advice the developer to accept the offer for 60% equity ?.

<comment><USER2> Sure, if you think the idea is worth it

</comment></comment></comment><comment><USER4> Absolutely.

I contracted for a person who built a small but very profitable SaaS app using contractors.

There are some caveats though. The person has a smattering of technical knowledge which prevented him from being completely taken advantage of by contractors. And he was an effective manager (a rarity to be sure). And he knew exactly what he wanted and stayed on top of details of how it was implemented. Although not a necessarily a "programmer" he also knew enough about using Git to review/merge changes. And perhaps most importantly he had the financial backing to complete the project.

I've also worked for other people who didn't have these qualities but figured they'd just hire some people to build some stuff without keeping on top of it or in many cases having a clear vision of what they wanted. Predictably these projects didn't turn out well for them.

But yes, it is possible. I've seen it.

<comment><USER5> The key here is that he had the financial backing to complete the project. Unclear whether the original poster has enough of a cash runway to keep even a team of 1 at a fulltime salary.

<comment><USER4> You don't need a full time team or person (the guy I worked for doesn't have that) as long as you can deploy and manage the hosting and have someone you can call if there is an issue.

But no way to get building/operating capital? In general forget about it. Most likely not going to fly.

I'm convinced lots of people do this because I've personally seen at least two. But even more try and spend a bunch of money and fail (seen a lot more than 2 of those). The ones who succeed generally don't hang around HN posting startup related buzzwords though so it's understandable they are presumed not to exist.

</comment></comment></comment><comment><USER6> I'm in the process of bootstrapping a SaaS. I'll say it's absolutely possible, or more precisely, it has equal chance as the programmer going it alone has. The simple reason being that the product is only a tiny piece of the puzzle.

I find the opposite question equally as valid. Why is it assumed that a programmer can bootstrap a successful SaaS alone?

To build an application, you need someone who can identify an opportunity (product market fit.... and that's harder than most would assume). Of course even if you have something customers want, you still often need to help them want it... so you need a marketing/sales guy.

Implementation is the last piece of the puzzle. I think these are completely different skill sets, and a successful company 90% of the time needs 2 or more people to pull it off.

<comment><USER7> The product is still the most important piece that you can't do with out. You might be able to get by without a marketer/sales guy, but without a product you're selling vaporware. All the other jobs can be done (poorly) by the programmer, but the reverse isn't true.

Just look at all those scams on kickstarter, the one thing they're missing is a viable product that an engineer can tell them is impossible.

</comment></comment><comment><USER8> It is freakishly hard to build a successful SAAS if you have funding and a solid team. Doing it alone as a solo non-programmer has got to feel like trying to drink the ocean.

I've never been able to figure out how non-programmers can sift through mounds of freelancers to find a good developer. And, even if they find good developers, I have no idea how they manage to motivate and retain them.

I'd love to read some stories from successful solo non-programmers. If anyone has some links, please share...

<comment><USER9> Here's one [https://www.indiehackers.com/businesses/convertkit](https://www.indiehackers.com/businesses/convertkit) ... follow the link to their blog about the "Web app Saas challenge" and they outline the entire process they took.

Wildly successful too ... $600k MRR in just a few years [https://convertkit.baremetrics.com/](https://convertkit.baremetrics.com/)

</comment></comment><comment><USER10> Just learn to program, every minute that you spend futzing around trying to find developers who'll do it for free or little money is one minute further away from you have the development skills to write your own product.

<comment><USER3> The truth is not every one can write code, i am not being arrogant but it is true.

</comment></comment><comment><USER11> After reading the comments, no one asked about "which"SaaS business model. Yes it is _extremely_ possible to bootstrap a SaaS business alone depending on which model. Example: help a reporter out that peter shankman grew into a Monster of a SaaS business.

Another example? GroupOn. Was a email newsletter first.

I've seen a group of guys go sign up for Wordpress and were generating $2,000/month themselves for a kickstarter-like concept by using plugins. Not all SaaS businesses require a programmer, especially these days.

Will certain models require a programmer at some point? Maybe. Maybe someone just wants to build 10 SaaS newsletter sites that all generate $1,000/month each... $10kMRR in total with no need to hire a programmer.

</comment><comment><USER12> It depends entirely on the SAAS. A non-programmer friend of mine paid peanuts to an off-shore programmer to build an über simple slack-clone with Firebase + Angular + Phonegap. He has two paying customers so far. Will this scale? Probably not but if he reaches 20 customers he'll have the money for the rockstars.

This friend is a sales ninja, the tech is not an obstacle for him.

<comment><USER13> First of all, a Slack clone with Firebase/Angular/Phonegap is not simple in terms of the engineering effort. If he found someone to implement a working system like that for peanuts, then he did not bootstap his startup alone, he did it by taking advantage of the other guy, and the fact that he does not acknowledge the other guy did 90% percent of it and describes it as a 'solo' effort just means that he is an asshole.

<comment><USER14> Are you willing to pay for my education to become a software engineer, so I can code my own products?

If not, then you're the asshole.

</comment></comment></comment><comment><USER15> I always tell non-tech people that if you have an idea, and expect a developer to code it for equity, you NEED to bring purchase orders to the table first.

[0] Obviously there are exceptions for instance if you have deep industry experience and contacts(with buying authority) but these people usually also have the money to pay a developer to implement their idea.

</comment><comment><USER13> If the guy has to 'hire freelancers' to implement the actual product, then 99 out of a 100 cases of this, he is not actually doing it alone. He is just discounting the contributions of core members of his team that are being poorly compensated.

If it were the case that this was normally a group of freelancers making a killing, charging high consulting rates, it would be different. But almost in all cases they are using 'freelance developers' because they cannot afford to pay market rates in the US and can't afford benefits. Even in those other countries, there is a global economy. Those developers might be doing OK, but they are not getting wealthy.

If you try to do it as if the developers are separate and not a core part of the team, that can't work either. Either you acknowledge how critical they are to your business or you just take advantage of them and hope they don't find something better and your business doesn't fall apart.

</comment><comment><USER16> Perhaps by possible, but probably not advisable. Consider the obvious alternatives:

(1) having a technical cofounder, or

(2) raising money instead of bootstrapping.

Either of these alternatives will take time — to find the cofounder or the funders — but this is nothing compared with how much slower you'll move if you're bootstrapping and don't have a pot of cash to fund development with.

And the better your idea is, the easier it will be to find suitable cofounders or funders. So if you find these two tasks to be difficult, this tends to indicate that the underlying idea is not as strong.

My background: I am a non-technical founder of a software startup that has been mostly bootstrapped and mostly solo. My path was made possible/easier by the fact that I have savings from having been a corporate lawyer, and by my wife's stable/good job. Without both of these things, launching a startup would have been even harder.

</comment><comment><USER17> I think it's theoretically possible, if you have enough money or are persuasive enough, to bootstrap a SaaS company using some combination of contractors, friends, cofounders and employees. However it's really them that's bootstrapping the company, not you. However, the more likely outcome, and hopefully the one that the author is headed for, is that by building your company you cease to be a non-programmer and become a programmer. The author already seems far enough down that path that I think he's kind of shortchanging himself with the moniker.

There's really no hidden secret here, just build if you don't know how learn. It's the best way to learn and the only way to build. No one knows how to build something before they do it.

</comment><comment><USER18> I (developer) chatted with a water quality consultant during a plane flight. Consultant mentioned the CRM for his niche business sucked. He asked if I'd be interested in building a CRM for no money upfront, instead making money later (a percentage of his business I could sell, a license fee, profit sharing, whatever). I realized in that moment once the app was built, I wouldn't need him at all, and that I could sell it (let's assume it'd be a valuable product) to all of his competitors. Either he wins, or I win, but there wasn't a scenario I could imagine where we both won. I explained that to him, and he was no longer interested in having me build the software for him.

<comment><USER6> Why do you assume that water quality consultants would buy a software product from you alone? Selling is hard, and a big part of it is knowing your customer, and gaining their trust. This guy would have a much better chance at accomplishing that. He had a lot of value, you just failed to see it. He made the right choice by finding someone else.

<comment><USER18> The point I was trying to make is that making an MVP water consulting CRM for a single customer isn't very equitable for me. The amount of money I'd earn for the time invested feels like it'd be less than what I'd likely earn as a consultant for anyone paying an hourly rate.

If I decided to build a CRM for the water consultant market, he brings little to the table for me. What I mean I can find a water consultant that isn't him. If I approached him, pitching on the idea for a CRM that would cost 50% less and be 2x more efficient, he'd likely be open to the idea of at least discussing it. If he said no, I'd simply find a different water consultant to talk to. He if said he'd talk, but only if he got to own after I built it, I'd turn him down.

For him to be a viable non-technical cofounder, he'd need to stop being a water consultant, and start being a cofounder. Those are two separate jobs. He didn't want to discuss that. He could bring value, maybe. But he wanted to own the majority of something he couldn't buy or build himself, and he wasn't willing to become a founder. I wasn't interested in doing business like that.

I was once tried being the non-technical cofounder. In the end I decided it was easier to learn how to code, and that path was super hard.

<comment><USER6> "For him to be a viable non-technical cofounder, he'd need to stop being a water consultant, and start being a cofounder. "

This part I completely agree with you. If you're splitting equality (relatively) equally. He should be as committed as you are, if he's not, than you need to be compensated extra for it.

</comment></comment></comment></comment><comment><USER9> This is a timely topic, because I'm currently studying the process the founder of ConvertKit (designer) took to get his SaaS off the ground with just his own $5k.

[https://www.indiehackers.com/businesses/convertkit](https://www.indiehackers.com/businesses/convertkit) ... follow the link to his blog about the "Web app challenge" and he blogs about the entire process as it happened

Wildly successful too ... $600k MRR in just a few years [https://convertkit.baremetrics.com/](https://convertkit.baremetrics.com/)

</comment><comment><USER19> I think Nathan Barry (ConvertKit founder) is originally a designer? He might still know how to code. I'm not sure. But his business seems successful enough. There are probably dozens of less well-known examples.

Edit: recent article by GrooveHQ (non-technical) founder that may be relevant: [https://www.groovehq.com/blog/non-technical- founder](https://www.groovehq.com/blog/non-technical-founder)

<comment><USER19> Erm, let's say _I_ saw it recently.

</comment></comment><comment><USER20> Developers are more than code monkeys to order around, they can tell you how feasible your ideas are. If you hire efficiently, they also come with market- relevant experience.

So while you probably could do this in your bedroom, alone-alone, chances are you'll end up with an insecure, unstable, broken hacky mutant that costs too much to run and includes things people don't actually want.

But I would say that. I'm the guy you should hire :)

</comment><comment><USER21> While possible, it doesn't seem advisable. If you could bootstrap a successful SaaS as a solo nonprogrammer, you probably didn't need to.

</comment><comment><USER22> Sure if you have enough money to pay people to do the work. Architects don't build houses by themselves most of the time :)

This is optimal if your goal is to focus entirely on sales and raising, as this effectively lets you sell while building the product, which is really hard to do when bootstrapping everything yourself.

Good luck!

</comment><comment><USER23> No, that's idiotic. You will hardly understand what you're selling. Learn what you're doing.

</comment><comment><USER24> Hey Rob, it is certainly possible for you to bootstrap a successful SaaS. Without money to pay a developer, though, your best bet would be to learn to code yourself enough to put out a product to test the waters. Once that gains some traction, partnerships and funding would be easier to come by. That path would probably eat up 3-9 months given the bulk of your spare time and energy.

Why do you think you want to build a SaaS product though? It seems to me like you're already putting out content pretty regularly. I would recommend moving it off medium to a domain you control and start getting some emails for your list. You can still publish there, but link back to your own site. With an email list, your readers can turn into your customers. As a designer, you can then start building products like books, courses, podcasts, guides you name it which will let you take advantage of the skills you have already. Check out Design for Hackers, for example. Why not use the edge you built up instead of starting at a disadvantage?

</comment><comment><USER25> As a founder of 6 figure MRR SaaS, it is possible if you can hire __good __developers overseas for less. That said it is really useful if you know a little code or have someone who can vet good coders for you. Take your time with hiring.

<comment><USER26> I'm someone who is a non-coder, can you please recommend some books/blogs on how to build a successful SaaS business?

</comment></comment><comment><USER27> Of course it is. If you know the problem space very well and are able to conceive and sell a good solution, the code behind it matters very little.

</comment><comment><USER28> Sure its possible, but coworking spaces are full of people trying it and I cannot think of a single example where it has worked.

</comment><comment><USER29> Analogy; Can a non-programmer manage programmers?

<comment><USER3> Are you kidding. All the people who can not program become managers. Its the truth. Exceptional are the Big-4 companies.

</comment></comment><comment><USER30> No

</comment><comment><USER31> Anything is possible if you just dollow your freams!

</comment><comment><USER32> I'm a developer and have helped bootstrap a couple of SaaS. The problem is that in most partnerships like this, the other person can usually only offer ideas or something very minimal with regards to the success of the business.

I usually end up just doing everything myself. Unless you offer something besides just the idea (money, contacts, industry experience). The partnership will not work.

I've had to quit a few startups over the years myself because my co-founder ended up only offering some ideas. This starts to become a perceived manager->employee relationship (since as the developer, you are doing the majority of the work) and because the idea is their only contribution, it's a problem when it needs to be changed.

This also smacks of someone that loves the romanticized idea of running a startup, but isn't willing to actually put the work into it.

Now, I will only go into business with other people that have at least a couple of years of business experience.

<comment><USER33> Yeah in a startup or small business I think every founder needs to do work. You can't have people who only essentially generate work for others. There are so many things that need doing when you're small that aren't directly related to development but still need to be done: applying for grants, tax concessions, marketing, building communities, competitive analysis, market research, payroll, accounting.

<comment><USER5> But this is the fundamental point of the article. It's very difficult to do marketing, communities, competitive analysis market research payroll and accounting when you have no money and no product. So what can non-technical co-founder bring to bootstrapping a SaaS platform with just ideas? May not be possible.

<comment><USER34> >But this is the fundamental point of the article. It's very difficult to do marketing, communities, competitive analysis market research payroll and accounting when you have no money and no product. So what can non-technical co-founder bring to bootstrapping a SaaS platform with just ideas? May not be possible.

You hustle? You sit there and think what is the literal next step, then you try that thing, reevaluate, and repeat. Then keep doing it until you're rich, broke, or dead. There is _always_ something you can be doing.

<comment><USER35> For some reason the image of a mouse in a cage running on a wheel with a person shouting at it popped into my head here; it reads like the transcript of YouTube motivational videos that on the surface has substance, but are actually hollow.

Doing something is a strict superset of doing something valuable, the key is to bring value, which the quoted comment was addressing.

</comment></comment></comment></comment></comment><comment><USER36> Zuckeberg did it right? Atleast till it was viable? JUST DO IT.

<comment><USER23> Zuckerberg was a programmer.

<comment><USER37> Also Facebook is not SaaS (at least not the way most people think of it).

</comment></comment></comment><comment><USER38> F those people that tell you it's not possible. I barely knew how to code and I started a SaaS business. I worked my ass off to become an adequate coder and sell the product to customers. It's been three hard years and now it's starting to pay off. If you have a solution to a problem, one that people will pay for. You have a business. Keep pushing. You can do anything if you're willing to work hard for it. Take help when you can get it. Learn everything you can. Enjoy the journey.

<comment><USER39> You're saying it's possible, but isn't your anecdote saying the opposite? That is, you may have started out as a non-programmer, but by the time things are going well, you have become one. In your own words: you've "become an adequate coder". It seems to me that the author of the post is hoping to avoid that: he wants to succeed and remain a weak coder. Or am I misreading what he wrote?</comment></comment>


Airbnb host's horror as squatter takes over - <AUTHOR> http://www.theage.com.au/travel/travel-planning/travel-news/airbnb-hosts-horror-as-squatter-takes-over-20140721-3cahg.html <comment><USER2> I've contacted AirBnB regarding several unprofessional experiences, and I've found that AirBnB themselves were quite amateur. This has changed, and AirBnB are starting to grow up. Hopefully this sort of stuff doesn't happen again...</comment>


Mathematical formulas are designed to be pretty, not suitable for computation - <AUTHOR> http://blogs.msdn.com/b/oldnewthing/archive/2013/05/08/10416823.aspx

<comment><USER2> s/pretty/readable at a glance by human mathematicians/g</comment>


Show HN: Glance – All-in-One Quick Look Plugin for macOS - <AUTHOR> https://github.com/samuelmeuli/glance <comment><AUTHOR> Very excited to share my latest Mac app, Glance!

Quick Look is a very handy and time-saving feature for Mac power users. By pressing the Space bar, it allows you to peek into files without opening them. macOS supports previews for various file types out of the box. However, there are also many that aren't supported, especially files that developers usually interact with. I used to have five different apps installed to support such files (one for code, one for JSON, one for Markdown, etc.). But it bothered me that their previews don't have a consistent look, don't support Dark Mode, and that some of them might stop working in the future because they still use a deprecated macOS API.

Glance solves all these problems and combines the features of many plugins into one. It provides consistent and beautiful previews. The app is completely free, open source and easy to extend for new file types!

</comment><comment><USER2> This looks good. It'd be nice to have an actual documented list of the file types it supports - everything I find mentions half a dozen languages/ish and then says "and many more".</comment>


PubSubHubbub Subscribing for CouchDB - <AUTHOR> http://github.com/maxogden/couchpubtato

<comment><USER2> Good usage example: <http://pdxapi.com/pdx911/feed>

<comment><USER3> heres that ActivityStream visualized using bubbRubb (github.com/maxogden/bubbrubb)

<http://pdxapi.com/911feedexample>

</comment></comment><comment><USER4> An excellent example of a clear but entertaining README.</comment>


An ex-cop's remorse - <AUTHOR> http://www.newyorker.com/magazine/2016/10/24/an-ex-cops-remorse <comment><USER2> > _colored by the cop dramas he watched growing up_

Well, I'd hope not. In general TV and movie cop dramas present exceptionally poor models of policing which emphasize aggression, violence, and a contempt for the public. The last thing I'd want is for any police officer to model themselves after those distorted depictions of what a cop should be.

<comment><USER3> > _The last thing I 'd want is for any police officer to model themselves > after those distorted depictions of what a cop should be._

Most real life cops are much worse (sexist, racist, aggressive, easy to lie/tamper if they don't like a suspect, easy to pull the trigger, etc). So even the average tv cop as a role model would be an improvement.

<comment><USER4> Luckily that's not true; there's about 810.000 police officers in the US (source: [https://en.wikipedia.org/wiki/List_of_countries_and_dependen...](https://en.wikipedia.org/wiki/List_of_countries_and_dependencies_by_number_of_police_officers)) (or 266 per 100K people); if they were all like that, you'd see a police murder incident several times a day.

Instead, the US has toddlers shooting people every day.

<comment><USER5> Umm... [https://www.washingtonpost.com/graphics/national/police- shoo...](https://www.washingtonpost.com/graphics/national/police- shootings-2016/)

> 963 people have been shot and killed by police in 2016

And that is just shootings, never mind other methods of murder.

<comment><USER6> How else could a cop kill someone ? suffocating ?

Don't downvote blindly, I was really wondering how "lawful" death could occur without gun in self defense.

<comment><USER3> > _How else could a cop kill someone ? suffocating ?_

That's also a not entirely uncommon occurence.

USA [https://en.wikipedia.org/wiki/Death_of_Eric_Garner](https://en.wikipedia.org/wiki/Death_of_Eric_Garner) [http://www.thedailybeast.com/articles/2016/12/08/cops- gagged...](http://www.thedailybeast.com/articles/2016/12/08/cops-gagged-and- smothered-a-man-to-death-then-fist-bumped.html)

Belgium [https://en.wikipedia.org/wiki/Semira_Adamu](https://en.wikipedia.org/wiki/Semira_Adamu)

South Africa [http://www.vanguardngr.com/2017/01/south-african-police- suff...](http://www.vanguardngr.com/2017/01/south-african-police-suffocates- nigerian-death/)

Sweden [http://filmingcops.com/witnesses-horrified-as-cop-beats- and-...](http://filmingcops.com/witnesses-horrified-as-cop-beats-and- suffocates-9-yr-old-child/)

</comment></comment></comment></comment></comment></comment><comment><USER7> I've never seen "coöperator" spelled with a diaeresis before. Apparently it's a New Yorker house style: [http://www.newyorker.com/culture/culture-desk/the- curse-of-t...](http://www.newyorker.com/culture/culture-desk/the-curse-of-the- diaeresis)

<comment><USER8> Interesting! We have similar diaeresis in Spanish. But on the other hand, given English's spelling ambiguity and lack of overall consistency, I wonder what is the point of using this nowadays... But I guess, that article also wonders :D

<comment><USER9> > We have similar diaeresis in Spanish.

Besides _ü_?

<comment><USER8> You are right, only _ü_ to break the _gue_ and _gui_ forms. The "diptongos" containing a weak-strong vowel combination may be broken into a "hiato" with an accent, such as: _vía_ vs _via_.

</comment></comment></comment></comment><comment><USER10> I hate to be the sanctimonious European on HN, but I was really surprised to read that 3 days and 2 detectives is all that is (or was) used to investigate a murder. From American films and tv we get the impression of maverick cops with this gung-ho attitude who investigate alone or with one partner. This article makes me wonder how close to reality is this?

<comment><USER11> You really shouldn't base your understanding of a society on media presentations, other than perhaps very lightly. I just watched a Belgian crime show "La Treve" / The Break on Netflix, but it doesn't mean I assume every Belgium small town is rife with murder and intrigue.

<comment><USER9> Good, so you've seen _one_ 10-episode Belgian series. We've seen hundred, thousands of of American series and movies (and books). After a while we begin to be able to pull out some constants that are represented, and more importantly and more interestingly, we become able to see _the constants which are not purposely represented_.

You don't realise the massive power of the American cultural imperialism. It is a steamroller: most European people have a better knowledge of the police and justice systems of the USA than of their own country!

(And that's not only about fiction but about the news: we also know better the political system and political life of the USA than the ones of our neighbouring countries. We still know our own better, luckily :-) )

<comment><USER12> Is this really true? (I'm American.)

<comment> angry-hacker It is true. A lot euros use "free speech, free speech" but majority of countries dont have one! It's an American concept.. You'd be surprised how much the cultural influence America has over here!

</comment></comment></comment></comment></comment><comment><USER13> This job should be made a institution, a office of last appeals, allowing to reopen every case, should new evidence surface or the involved persons, methods and legal proceedings give cause for reasonable doubt.

<comment><USER14> Yes. England and Wales have for a while had the Criminal Cases Review Commission. If they see a case that suggests a miscarriage of justice, even after twenty years or the exhaustion of appeals, they can send the case back to the Court of Appeal. It's done some good work.

<comment><USER15> It sounds like if the Innocence Project were an official government entity.

</comment></comment></comment><comment><USER16> What's worse is that this is highly unlikely to be the only case in which Forcelli sent the wrong person to jail. I don't know if he's come to that realization yet.

</comment><comment><USER17>
      > this was a case of mistaken identity. "I always
      > wondered—and it sounds weird—how did it feel to
      > these guys who arrest the wrong guy?" Forcelli
      > told me. "It feels terrible."

Sad Story, free Garry.

<comment><USER18> Arresting the wrong guy would happen pretty often and shouldn't be a serious issue.

 _Convicting_ the wrong guy, especially if you know they're the wrong guy even as 'due process' finds them guilty - now that's another issue entirely.

<comment><USER19> Thing is, it arrest actually IS a problem. It's often said that any decent prosecutor can indict a ham sandwich. Throw in a dash of racism or classism, and you've got a recipe for sending lots of people to jail who didn't commit the crime. Every step of the way needs to responsible and honest in order to mitigate this problem as much as possible. Can't just let cops do whatever they please under the premise that the prosecutor's office will figure out the truth.

<comment><USER20> The mere arrest can totally disrupt your life. Lost job if you miss work. Loss of trust with friends and family. Lost money if you can afford bail. Confusion in your kids if you suddenly have to get someone to pick them up from school that day, and arrange for care. Record of arrest.

<comment><USER21> Bail is the opposite. If you can afford it you get the money back if you show up to your court date. If you can't you go to a Bail bondsman and pay 10% up front - but you don't get it back at all.

<comment><USER20> Thanks for the correction. I did mean being able to afford a bail bondsman, which many people can't and so sit in jail needlessly.

</comment></comment></comment></comment></comment></comment><comment><USER22> What an incredible anti-cop dumpster fire this turned into.

<comment><USER23> All police are represented by the worst of the police. Therefore it would be in their interest to weed out the bad cops. Instead, they line up and protect them. Thus they make the public perception of police even worse. It then becomes manifestly clear that the police are not about protecting the public. Especially from bad police.

</comment></comment><comment><USER24> Holy shit</comment>


Twitter to Introduce Algorithmic Timeline as Soon as Next Week - <AUTHOR> http://www.buzzfeed.com/alexkantrowitz/twitter-to-introduce-algorithmic-timeline-as-soon-as-next-we#.fo4jbXAdvY <comment><USER2> I can't believe they are ruining twitter on purpose.

First, their staff admits to taking weeks to change the star icon to a heart. Seriously, weeks? Just to copy Facebook. All past save-for-later and/or acknowledge content now implies _approval_ under the new system. No data migration or mitigation. Just patting themselves on the back.

This algorithmic timeline bullshit is why I left Facebook. I absolutely don't want it. I don't want to be half way across the world in some country messaging friends and get "popular content" when I'm trying to get an address.

They took all the things that make their platform useful and pissed all over them. Their staff all deserve to be laid off when the inevitable under priced purchase happens.

Waiting for the Clone Of Twitter to come about. Where are people going?

</comment><comment><USER3> > Twitter to begin censoring content as soon as next week.

FTFY

</comment><comment><USER4> Twitter is becoming a clone of Facebook</comment>


Facebook Is Upworthy's Weakest Link - <AUTHOR> http://www.bloomberg.com/news/2013-12-11/facebook-is-upworthy-s-weakest-link.html <comment><USER2> Facebook isn't their only problem. If Upworthy videos suddenly disappeared tomorrow, would anyone care? That's a bigger issue than Facebook.</comment>


Publicly committing to a personal goal considered harmful - <AUTHOR> http://www.spring.org.uk/2011/10/why-you-should-keep-your-goals-secret.php

<comment><USER2> Rule from personal software projects: If you tell other people of your first release, you won't have a first release, ever. The only thing that works is "hey, i wrote this and it works, have a try!" -- you'll be hatching your creation until that and you might actually get to release it.

Note that the first release need not be big and complete, just something that works. But the game changes after that, so the above rule loses its context. Running a public project is a different scenario from the initial phase of development.

<comment><USER3> This is exactly how I do things in general. It's great for when you can't deliver. Nobody expects things that haven't been promised.

</comment></comment><comment><USER4> My experience is that it depends a great deal on the types of the goals and how they're presented. The article mentions vaguely-defined, general self- improvement goals, like taking up a new hobby. I can see a public commitment being counterproductive there. But I'd bet that it works differently for more quantifiable goals, especially ones with a specific starting time, such as completing Nanowrimo, or telling your boss that you're going find a fix for bug XXX before Monday.

Quitting smoking? A hell of a lot easier to change your mind about if you haven't told anyone.

Of course, we're just going on the article. I don't have access to the original paper, but just reading the abstract already suggests (big surprise here) that the article is probably not a faithful summary of the study in question.

<comment><USER5> The original paper is posted on the the author's site:

[http://www.psych.nyu.edu/gollwitzer/09_Gollwitzer_Sheeran_Se...](http://www.psych.nyu.edu/gollwitzer/09_Gollwitzer_Sheeran_Seifert_Michalski_When_Intentions_.pdf)

</comment></comment><comment><USER6> I got to know this law by Derek Sivers's TED talk[1] and I totally agreed with him especially about personal programming project. A downside of this approach is that you cannot get a feedback until you unveil first version.

[1] Derek Sivers: Keep your goals to yourself [http://www.ted.com/talks/lang/en/derek_sivers_keep_your_goal...](http://www.ted.com/talks/lang/en/derek_sivers_keep_your_goals_to_yourself.html)

</comment><comment><USER7> I find it more likely that the harm done to your goal is not caused by public announcement of that goal, but rather announcing it is evidence that you aren't as committed to the goal as you are to other goals that you're better at sticking to. In other words, if you're having trouble with achieving something in particular, or working towards it, then you are likely to acknowledge that to yourself in the form of "needing to set a goal" and thus "announcing it to the world", thus automatically ensuring that announced goals are less likely to be kept by the very nature of the fact that they needed to be announced in the first place. If you want something badly enough, you are more likely to "just do it", thus foregoing the need to announce it to others.

</comment><comment><USER8> Had the idea of publicly committing been tested before? I'd be pretty surprised if this was the first controlled study about this idea.

</comment><comment><USER9> I found beeminder (<https://www.beeminder.com/>) to be a surprisingly effective commitment utility. The goal has to be measurable, and you have to trust yourself somewhat enough not to subvert the rules, but since there is a counter-party most people's sense of personal ethics should be sufficient.

</comment><comment><USER10> <http://four.livejournal.com/963421.html>

I'd say, only talk about your future plans as much as you are comfortable to. Sometimes just talking vaguely about your things with other people helps to keep you interested and motivated.

</comment><comment><USER11> Well, I'm sorry to say that I believe exactly the opposite. Public committing means a high level of responsibility and scrutiny, and it is the best motivator for any task.

In our weelky meetings we write down each task that needs to be done and the name of the person in charge, then send it by email. Even if there is no follow-up the next week, we observed that stopping to send the emails leads to less work done (or, at least, not the work that is expected to be done by the managers)

<comment><USER12> Believe what you want, but your belief is directly contradicted by evidence.

Also note that your example is of something very different, as it is not personal goals of the person being put in charge of the tasks, but tasks put in place to carry out a duty to someone else.

With personal goals, publicly committing to them will rarely lead to a strong negative reaction if you fail.

<comment><USER13> I'm not so sure it's so clear (in research) that some form of public commitment reduces the likelihood of completion.

In fact, Robert Cialdini found that commitment was an excellent form of motivation. "If people commit, orally or in writing, to an idea or goal, they are more likely to honor that commitment because of establishing that idea or goal as being congruent with their self image. Even if the original incentive or motivation is removed after they have already agreed, they will continue to honor the agreement. For example, in car sales, suddenly raising the price at the last moment works because the buyer has already decided to buy."[1]

Cialdini performed his original research several decades ago, but it has been continued by the Freakonomics/Kahneman/"Nudge" crew. To the best of my recollection, all of their experiments showed a strong positive effect when public commitment was added. It's the principle behind StickK.com, as well.

Perhaps there are certain types of improvements (vague self improvement was mentioned elsewhere in this thread) that are harmed by external reinforcement, but I think that's more the exception rather than the rule.

[1] <http://en.wikipedia.org/wiki/Robert_Cialdini> (also check out his "psychology of influence" book for more on the topic)</comment></comment></comment>


Introducing jQuery++ - <AUTHOR> http://www.bitovi.com/blog/2012/06/introducing-jquerypp.html <comment><USER2> This appears to me as a collection of jQuery plugins that is masquerading as a better version of jQuery. I really don't like the name, and I hope whoever controls the jQuery trademark puts the kibosh on this name. These plugins should stand on their own merit, and should be advertised as something other than jQuery++.

Frankly, I have also not really liked that jQueryMobile, and jQueryUI used the jQuery name because it killed the prospects of better alternative projects, but at least they had endorsement.

<comment><USER3> It is by no means masquerading as a better version of jQuery. No where does it say this. It only states it's a collection of jQuery plugins.

<comment><USER4> It says that in the name.

<comment><USER5> Is c++ better than c?

<comment><USER6> Was it meant to be?

</comment></comment></comment></comment></comment><comment><USER7> If they are providing performance improvements, why not just pull a copy of jQuery and commit the improvements? Why do these need to be presented as a separate library?

<comment><USER3> Of the 3 that add performance improvements:

animate - probably wouldn't make sense until CSS is better supported.

styles - I've suggested adding it, but waiting on the "go ahead".

fastfix - I've suggested adding, but jQuery said it wasn't interested. I don't think they realize that although fix in its current state is fast, it's called all the time, making it important.

</comment></comment><comment><USER8> I would like to see some data on how much faster. Maybe make some demos that run in a frame where jQuery is compared to this library. It's a tall claim to say this is faster and needs credible verification.

<comment><USER9> Some data here:

<http://jquerypp.com/#fastfix>

Not comprehensive, but it's something.

They also include a link to:

<http://jsperf.com/jquery-event-fix>

Which lets you benchmark yourself (I'm getting an error in Chrome on OSX).

<comment><USER3> Yeah, that article was on our initial work. I'll fix the benchmark soon.

</comment></comment></comment><comment><USER10> This looks awesome! Are there any other javascript libraries that support drag, drop, and swipe events?

<comment><USER3> Yes, there are several, but not many can be used with delegate / on in the same way these events can. This makes it extremely useful for frameworks that use declarative event bindings.

</comment></comment><comment><USER11> I can now listen to ".item hoverenter" and ".item hoverleave" in backbone? Sounds good to me!

</comment><comment><USER12> Looks like a very useful set of functionality, but the name will need to change.

</comment><comment><USER13> "Have you ever found yourself wishing jQuery had just one more feature or wanted it to be a tiny bit faster?"

Yes, then I search for plugins and find that other people had also wished for the same feature or performance improvement and implemented it.

<comment><USER14> Right... that's what this seems to be. An organized collection of plugins. Or do I misunderstand it?

</comment></comment><comment><USER15> i love it</comment>


High-Speed Firms Now Oversee Almost All Stocks at NYSE Floor - <AUTHOR> http://www.bloomberg.com/news/articles/2016-01-26/high-speed-firms-now-oversee-almost-all-stocks-at-nyse-floor <comment><USER2> "... millions of trades a day".

What is that ? How can that be the reflection of what's going on in the 'real' economy ?

I interviewed at an HFT firm once and they were doing kernel-bypass networking, latency measured in nanoseconds and all kinds of really low level systems programming tasks.

Interesting technical challenges. Except... what does that have to do with the economy ? Why is it that I can make money if my algo runs a microsecond faster than yours ?

Why is that time delta measured in money ? I know there's the very rational technical explanation of how the first to react executes the trade, but just step back and look at the bigger picture here - what the fuck are you guys really doing ?

Are the people writing these algorithms even remotely thinking that the trades can ruin or starve millions ?

Are you even considering that these high frequency "trading" systems have an actual impact on the planet, the air, the water, etc ?

Of course no. They don't give a fuck. In fact, you can only survive in this industry by not giving a single fuck. Otherwise you have to look at yourself and realize what a parasite you really are.

The stock market made sense when securities actually reflected the "real world" performance of companies.

Now it's all reversed - price determines company performance - it's like all companies work for the stock market itself.

I don't like these guys. A bunch of crooks and gamblers who have no idea what they are doing, while everyone thinks they do.

That's why the prognosis for the world economy is pretty bleak - because the insanity is institutionalized already and we have no idea how to stop it.

<comment><USER3> Millions of trades a day each contain teensy, tiny little updates about the state of the economy. Think of them like tweets, not like State of the Union addresses. This married couple wants to send their daughter to college more than they want Google. That hedge fund likes Coke more than Apple. This pension fund doing it's weekly buy of an index to prepare for 2075.

The market is these little packets bouncing off each other and summarized. High numbers of them are not unhealthy. On the contrary, it means more information is moving with less overhead loss to middlemen. (By analogy: What's more expensive, 100k tweets, 10 phone calls, or a FedEx envelope? If you say "clearly it's the tweets because there are so darn many" that would be a weird answer for an engineer to believe.)

If you believe the world economy is going to heck in a hand basket, there exist ways for you to be richly compensated for that expert opinion by sending your tweets into the machine. (Well, if you're proven right.) HFTs will happily minimize the transactional costs you incur while making that statement, as compared to the sweaty, yelling colluding-against-you jocks they have replaced.

<comment><USER4> But what is the social benefit of the stock markets being synced to the state of the economy at the micro-second / nano-second time scale ?

That's surely taking things a little too far. Nothing in the real economy changes that fast.

<comment><USER5> >But what is the social benefit of the stock markets being synced to the state of the economy at the micro-second / nano-second time scale ?

It's cheaper than people doing it, and the lower the latency, the faster a trader can move his position to match changes in the market.

What is the social benefit of Twitter loading in 100ms instead of 150ms? Why is latency important for peoples' stupid mobile apps, but not important for financial transactions?

>Nothing in the real economy changes that fast.

Sure, but you don't want to have to wait for an earnings report to sell your shares when you want to buy a house or something. You want people to always be trading your stock so it's easy to buy and sell. Similarly, when a big pension fund buys or sells a lot of your stock at once you want "people" trading to reduce volatility.

<comment><USER4> Dude its not 100 ms we're talking 100 microseconds.

</comment></comment></comment></comment></comment><comment><USER6> For any programmers curious about how HFT __actually __works in practice --- I recommend checking out our very own patio11 & tptacek's [https://www.stockfighter.io](https://www.stockfighter.io) [1]

It's a stock market simulator with a websocket API that you can code against to run your own trading bots in various scenarios.

I am currently on level 3 where the exact goal is to write a profitable market maker bot. So far my bot is decidedly UN-profitable, but I hope to change that soon.

[1]: And here is the thread when Stockfighter launched on HN: [https://news.ycombinator.com/item?id=10724592](https://news.ycombinator.com/item?id=10724592)

<comment><USER7> Hi, that's a really cool project! However, something I noticed with a lot of 'virtual market' simulations is they never take into account bid-ask volumes and allow unlimited volume trades at market values. Unfortunately, a lot of strategies people come up with that are 'profitable' in reality don't work. Do you guys have some sort of mechanic in place to stop this, or are working on one in the future?

<comment><USER3> Unlike most simulations [+], we run an actual order book. You can very, very easily exhaust the shares available at the best bid or offer and experience price slippage. Avoiding that is literally the goal of level two.

\+ Most investment games generate a spot price by magic and let you transact at it as much as you want. We have actual counter parties (bots) running their own strategies, the number, composition, and interaction of which determine the prices available. This is complicated; most simulations abstract it away to focus on their particular areas of interest. Having a nice crunchy view of market microstructure wrapped in an API is our interest; we in turn punted on a lot of other things. A big one: many people interested in stock markets want to trade Google; Stockfighter doesn't have Google but might have e.g. Amalgamated Tree Frog Airlines (ATFA), with a fake-but-almost-plausible market dynamic to it much of the time.

<comment><USER7> Sorry for the late reply, but that is incredible! The simulation overall sounds incredible and I sign up. Thanks for creating something so cool!

</comment></comment></comment></comment><comment><USER8> The end of this article hints at the real macro trend here: the NYSE floor is a glorified TV stage. Compare NYSE to NASDAQ.

First - a quick explanation of what these market makers do. Every security is primarily listed on a single exchange. In the US, this is dominated by NYSE and NASDAQ. Any listing exchange assigns market makers to the securities that it lists - these firms guarantee that they will both offer and buy the stock within certain limit and pricing restrictions. In return for this responsibility the market makers get price breaks and other preferential treatment. NASDAQ never had a floor, so these were just designated firms you could (in the early days) call. NYSE, on the other hand, assigned this responsibility to specific individuals from firms - all in one building on a single trading floor. Once the markets electronified, it was easier for the NASDAQ market makers to adapt and become electronic and more automated as well. As NYSE held on to the old model of individuals on the floor, they attempted to justify it - mostly by spreading distrust of computers. (Distrust which has proven partially justified - see the Knight Capital meltdown a few years ago.) Despite their arguments that the humans are adding to the stability of the market, the reality is the humans are doing less and less. For the last 5 years at least all floor brokers and market makers are managing most of their orders electronically with the help of "upstairs" \- other employees of the markets makers / floor brokers who are upstairs. Furthermore, the benefits that come with being a market maker apply to some of the firm's electronic business as well - effectively making the floor presence a cost that is made up off the floor.

TL;DR - The NYSE floor is a joke. This just proves it.

<comment><USER9> > mostly by spreading distrust of computers. (Distrust which has proven > partially justified - see the Knight Capital meltdown a few years ago.)

Computers only do what they're programmed to do by humans. Inherently, distrust of computers (sans AI) is distrust of humans.

</comment></comment><comment><USER10> Or, put another way, HFT firms now oversee most market-making. Not surprising really, that what can be automated is left to the experts in automation and fast infrastructure.

</comment><comment><USER11> That's part of the 4th industrial revolution - automate all the things.

What strikes me is that if automated trading is profitable, then it must be predictable as well, meaning trading and market direction is more "Non-random walk" than "Random Walk" ..

<comment><USER12> Market making is not really like directional trading. When a market-maker trades, the price is very likely to move against them afterwards. To be profitable, all that they need is for the price to move against them by slightly less than the spread (the gap between the price they offer to buy at and the price they offer to sell at) on average. Something like a random walk is exactly what a market maker wants; trending prices are bad.

<comment><USER13> The price will definitely move by more than you make on the spread - but you might win or lose on that. In simple terms what you lose on the swings you gain on the roundabouts.

</comment></comment></comment><comment><USER14> Seems fairly obvious that market making would become almost full automated eventually

</comment><comment><USER15> market making on the NYSE is not that glamourous. There is an extra set of rules that have to be followed. The margins are already very thin due to the increase in competition.

</comment><comment><USER16> Pay a small fee for every transaction and here you go, HFT will be over.

<comment><USER17> HFT already pay a small fee for every transaction. Any additional fee they will just price into the spread like they currently do.

<comment><USER16> Add 1 dolar for every trade. Good luck with adding this to spread. They are making money on small differences, ultra short investments. Then ultra short will not be an option. If you make 1 million transactions then you pay 1 million for transactions. How much do they actually make on this?

<comment><USER17> Some commodities and options exchanges already have fee ranges of that order of magnitude. They can get away with it because the leverage of the derivatives means the spread is bigger than that.

On the equities side, if you went to a dollar per trade it would be priced into the spread one way or the other. My suspicion would be with decreased liquidity due to participants moving to derivatives that allow for ownership in fractional components of large transactions that make the tax more bearable.

Either that, or you wouldn't have market makers and the equities market would grind to a halt and things like index funds, etfs, etc would no longer be economically viable.

</comment></comment></comment></comment><comment><USER18> HFT mocks the true essence of trading. That of buying or selling goods or stocks because you see the intrinsic value and care to "invest" in them. This used to give us a real picture of the public sentiment for those companies or commodities.

HFT on the other hand is the brutal unempathetic cousin of intra-day trading that completely takes the human element out of the picture. Stocks are bought and sold in micro seconds, creating an unsustainable and unlevel playing field for the real humans in markets.

To this day, I fail to see how was this even allowed by regulators. HFT systems should be pitted against other HFT systems on newly created indexes or an alternative system, where humans are not allowed to trade for their own benefit. The current ecosystem is just unsustainable.

<comment><USER19> > HFT mocks the true essence of trading

HFT is the true essence of trading--predicting short-term changes in supply and demand and acting accordingly.

> This used to give us a real picture of the public sentiment for those > companies or commodities.

Can you pinpoint some moment when it stopped?

> Stocks are bought and sold in micro seconds

Most HFT strategies don't actually do this. Buying and selling in such a short period implies a pure arbitrage, of which there are very few. The ones that do exist are generally fully exploited by the single fastest participant.

> creating an unsustainable and unlevel playing field for the real humans in > markets.

Depends on your investment horizon. The statement is nonsense for all but the shortest timeframes. In particular, the fundamental finance guys (the "investors") are in no danger from the machines.

> The current ecosystem is just unsustainable.

Why? Automated market-makers are a middle-man that temporally bridge supply and demand between "real" buyers and sellers. Kind of like a grocery store temporally bridges supply and demand between consumers and farmers. Kind of like a car dealer temporally bridges supply and demand between consumers and manufacturers. Kind of like... you get the idea. Why are equity markets different?

<comment><USER18> > Most HFT strategies don't actually do this. Buying and selling in such a > short period implies a pure arbitrage, of which there are very few. The ones > that do exist are generally fully exploited by the single fastest > participant.

I assumed most were of that sort. I still fail to understand what does being one millionth of a second faster accomplish if you're going to hold your position longer than that. It still triggers a competition for being the fastest participant that makes the transaction right after an event.

>Why? Automated market-makers are a middle-man that temporally bridge supply and demand between "real" buyers and sellers. Kind of like a grocery store temporally bridges supply and demand between consumers and farmers. Kind of like a car dealer temporally bridges supply and demand between consumers and manufacturers. Kind of like... you get the idea. Why are equity markets different?

That's an interesting thought. It may just be that the subject has a lot more elements that I haven't considered yet.

Here's something for you to consider and I would love to hear your POV on this. What if the regulators decided to ban all HFTs. Transactions had to rate limited by 300ms or more. In your opinion, would the markets behave any differently from now? If not, then what is being gained by all the major investments in HFT systems and platforms? If yes, then what do the markets gain?

<comment><USER19> > I still fail to understand what does being one millionth of a second faster > accomplish.

A simple example: suppose AAPL is currently quoted $95.00 x $96.00. A reasonable estimate for the "fair value" is the midpoint, $95.50. Now, a new sell order for $95.01 arrives at the market. AAPL is now quoted at $95.00 x $95.01. In the absence of other signals, a trader might reason that there's something wrong with the guy selling at $95.01 when everyone else thinks fair value is ~$95.50. If so, he'll rush to trade against the new order. First one to get there gets shares cheap; everyone else gets nothing. Hold the position for as long as you like.

There are a lot of details to get right, but this is an actual HFT strategy, not a toy example. Note that your speed matters only insofar as it lets you trade ahead of everyone else. All the infrastructure investment is required to stay ahead of other participants, but it does not confer a durable advantage: the arms race will quickly erode the edge. The investment is best-viewed as a tax imposed by other HFT firms, paid to technology vendors and exchanges. The big winners are those who sell the equipment and fast lines that certain HFTs desperately need.

> What if the regulators decided to ban all HFTs. The market would look pretty > similar to how it does today. The big change would be somewhat wider > spreads: market makers need to compensate for the additional risk they take > on by leaving their orders out. Any other traders here have an opinion?</comment></comment></comment></comment>


Index your site on Yahoo through Bing? - <AUTHOR> http://search.yahoo.com/info/submit.html

<comment><USER2> Because Yahoo! use Bing for their search engine, big deal, was made in 2009, transition finished last year, amongst the transition was of course the transfer of site indexing to Bing, and so you gotta use Bing webmaster tools now.

It's fairly handy actually, and Bing's webmaster tools are quite good.</comment>


Ask HN: just found a big competitor for my niche. What do I do?  - <AUTHOR>

I have been talking with some local martial arts studios about building tracking software for their businesses using a SaaS model. As part of the research process I stumbled across this company:
http://www.mindbodyonline.com/ http://www.inc.com/inc5000/profile/mindbody
On one hand I feel like my solution will be a better fit for my customers, but this company provides a very compelling and similar solution that is already built.
Has anyone been in a similar situation? How did you handle talking to customers about the competitor to learn how you could do a better job? <comment><USER2> What's the problem, exactly? It's a rare (and usually unprofitable) niche that has no competition, and if you don't have competition when you start, you'll likely run into it later.

You already say that your solution will be a better fit for your customers; if that's the case, it should be simple for you to draw up a mental list of differentiators that can constitute your "unique value proposition", and pull these out when a prospect asks why they should choose you. (Hint: price is not always a great differentiator.)

If you run into prospects who are already using the competing solution, ask them how it's working out for them, and what kind of things they wish it did differently.

<comment><AUTHOR> I'm actually happy to find this competitor because it validates a lot of my thinking and confirms that a market exists for this type of service.

At this time the other company has a more "feature rich" solution already built which is very similar to what I would provide. My product is basically vaporware today.

I'm wondering how to approach my customers about this other site without pushing them to that solution. Sounds like you are suggesting to use a strong list of differentiators. That seems like a good idea.

Talking to some of the other guy's customers sounds good too.

<comment><USER3> For many customers the issue is not features, it's pain avoidance. If you do just one thing, but better/easier/faster than the established competitor then you can approach customers on that basis. Bonus points if it allows them to save money, especially via employee effort, compared to the "feature rich" competitor.

One awesome book that's helped me with this is "Spin Selling" by Neil Rackham. It's a straightforward method to having productive sales discussions and is based on a quantitative grounding. Their approach is discussion based and a co-exploration, so you're just talking to uncover needs instead of pushing your product. Go check it out.

</comment></comment></comment><comment><USER4> Competition is only real when a significant number of your potential customers know of it. It sounds like a relatively small percentage of people know of mindbodyonline (obviously the groups you have talked to haven't). So the only danger is if both that company and your company become huge; and that's not something to be worried about now.

</comment><comment><USER5> Even if the products are very similar, you can still compete on price or customer service - or just marketing.

If you get there first and/or make some deals with organizations (martial arts clubs tend to talk to each other a lot and organize themselves into hierarchies), you could still carve out a chunk of the market.</comment>