Running costs for running a web app - <AUTHOR> http://cushionapp.com/expenses/ <comment><USER2> At our agency we tend to have a lot of low budget projects, plus we like to keep expenses low if there's a relatively small overhead in return.

For saving on costs we use:

\- Bitbucket over Github (Private repos are free, although Github has more features, so it depends on how much you use really)

\- Email Hosting Zoho over Google (FREE): We tend to recommend Zoho to single entrepreneurs since it offers 10 accounts for free on your custom domain.

\- CMS (FREE): We use our own barebones one that's similar to siteleaf.

\- Redis/Web Server/DB Server ($40/mo) Digital Ocean over AWS/Heroku: DO Droplets for launch + initial marketing, and then depending on how things turn out, EC2 or more Droplets.

\- SSL (FREE): Recently tried out Let's Encrypt. Works beautifully. Will probably use that for everything in the future.

\- Exceptions (FREE): New Relic seems to do a decent job, although the paid plan over at Airbrake seems a lot better. Haven't tried Sentry, but will give it a shot after reading this post.

\- Log Management (FREE): We use tail and grep :D It's messy but we survive

\- Assets / CDN: Sometimes Cloudflare (free), sometimes S3/Cloudfront (same as article)

\- Chat (FREE) Glip over Slack: Glip's free offering is better than Slack's, because you can confine people outside the organization to specific channels, which works fantastically for us.

\- Fonts (FREE): We tend to advocate some decent looking Google Fonts that get the job done

<comment><USER3> One can get 15 free accounts in Zoho (10 de-facto + 5 extra), if you can refer another business. Both parties get 5 extra users. Helpful for info@, jobs@, privacy@ etc.

<comment><USER4> _> Helpful for info@, jobs@, privacy@ etc._

I don't know about Zoho, but in case of Google Apps, they allow you a configuration to route all mail through a host of yours which would allow you to create these aliases without having to pay for actual accounts.

At lest that's what I'm doing at our place. All mail to our domain goes to our MX which does alias expansion and then forwards is to Google Apps (after making a backup copy into a maildir in case Gmail goes away and we need emergency-access to mail).

Google Apps in turn forwards all outgoing mail to that machine too which then makes a backup copy in a Sent-Mail maildir, before actually sending the mails off to the recipients (this step is harder because now it's your responsibility to deal with SPF, PTR lookups and mail server rep in general - but it's no rocket science either)

<comment><USER5> Google Apps allows you to create groups for free, or you can alias individual mailboxes (if you're okay with thing@ going to just one person). No need to run through your own middlebox. You do need to make sure that external people can send to the given group, though.

<comment><USER4> Yeah. I know - but I also wanted the free backups with instant-imapd support for when Google decides that they want to cancel our account for $REASONS and we won't have anybody to call (to this day still my biggest worry with google apps)

</comment></comment></comment></comment></comment><comment><USER6> I always find breakdowns like this interesting. Just to get a feel for what others are using, their reasoning, and to generalize what others are spending monthly/annually. With more breakdowns like this from more companies, I think it provides a great understanding of costs. It also can give people a good baseline for understanding what costs are at certain levels of users and with certain functionality.

While I understand that these numbers also give an opportunity for people to point out areas where there may be potential cost savings or opportunities to improve infrastructure, I am not sure generic comments of saying you are spending too much or too little, or I don't spend that much are beneficial. A few key pieces of information that would help correlate these numbers in my opinion are total users on each plan, monthly active users, and the average amount of data required for the users.

Just based off the Stripe numbers I would estimate that they have between 6000-7000 annual paying users (this number may actually be a little lower if the majority of users are paying monthly instead of annually). That does not include members that only trial the service, although I would suspect this number is small.

Long story short, every business has different requirements and usage. What works for one company with 6000 users may not work great for the another company with 6000 users. I just hate seeing people say that someone is spending too much without knowing all the details.

<comment><USER7> I agree and would add that it's easy to look at their spend and think that's a waste, but I think with many endeavors, an individual's time is usually the scarcest resource.

Web services expenses aren't even close to their cost of adding an additional employee to solve these problems in-house.

Learning to automate something a more seasoned *NIX veteran could do in an hour is not always a predictable time expense, and then they might create bugs or run into other issues. $100/month can a bargain and buy you time to do more important things.

Researching services to use can turn into a black hole. There is always a better service that you don't know about. It can be better to decide "I will spend one hour researching metrics/dashboard services, and pick the best one I find, and spend another testing out the service." rather than trying to end up with the most perfect solution and testing every solution there is.

That said, sometimes it's more time efficient to avoid having one extra service to maintain. One has to avoid using a service in a way that the business is too dependent on it, or that the service is not easily replaced. That's just part of what makes running a business hard.

<comment><USER6> That's a good point about individual's time being a resource. There are many things I am good at and there are many things I am not so good at. I would gladly pay a premium to a service to have them handle the things I am not good at, especially when just in the startup phase. So while one person may think that saving a buck here is an option, for me that buck may be the difference between being able to continue business, having to hire someone internally, or not having a business at all.

That's another good point about researching services can turn into a black hole. It is almost like the question of what framework/language should I use to build my startup.

<comment><USER8> Exactly, isn't that the reason why startups "need" so much money anyways? To get the best people to solve problems? In that case, it's a one off and you solve the issue. Definitely seems like the smarter business move to me too.

</comment></comment></comment></comment><comment><USER9> Running a business is much, much more expensive than you'd expect if you've never done it before. I started one on $60 so I get the mindset which has people suggesting that this story represents prolifigate spending, but oh my goodness, it's practically a _shoestring_.

There is an individual thing in the AR deployment which exists for no technical purpose to get us a piece of paper issued by Rackspace which we need for legal reasons. That thing costs more than everything on this page combined. We have one part-time employee; she's 3X more expensive than that thing.

If you're put off by $80 for a database wait until you get quoted rent, insurance, taxes, accounting fees, any engagement with a professional, review of a customer's MSA to sell them an enterprise contract, healthcare for a single person, travel to a single conference, the wifi at the hotel for a single conference, etc etc.

Also: there is virtually no scenario under which a SaaS app grossing $Xk per month has a better financial or technical outcome by working on minimizing expenses when you could be working on selling more accounts and selling better accounts.

<comment><USER10> I have to strongly disagree with you. I run my own online thing and find that keeping expenses down has given me a huge competitive advantage over similar sites.

I would also stress that there are other reasons to keep complexity down, like hating to do paperwork (or work of any kind).

<comment><USER11> Ha, I totally hear you on the second one. There are a number of situations where I've chosen to do something in-house rather than using one of these vendors, partially because I prefer to spend time managing the technical solution over (admittedly much less time :) ) handling the paperwork of one more vendor.

Of course, it's also just my natural inclination. My common response to problems is more along the lines of, "I can write a script to do this," than, "I bet there's a SaaS for this." That may well be inefficient, but it's how I roll.

</comment></comment></comment><comment><USER12> I think this level of expense is totally acceptable and justified when you consider how expensive developer time is today. Even for someone fluent in operations, I'd argue it doesn't make sense to cost optimize until you're spending $1,000+ monthly.

In the entire lifetime of their service, they've spent $8,727.57. That's less than it would cost to hire me to optimize their infrastructure.

Even though I've worked on building cost-optimized and efficient deployments for other companies, for my own projects I first turn straight to Heroku. It requires substantial traffic for my opportunity cost to be justified: I'm typically much better off charging larger companies to tune their deployments than using the same skills to shave pennies off my bill.

</comment><comment><USER13> As some have said, this seems expensive. However, I would point out that the costs of using Heroku should be outweighed by the convenience and ability to focus on features. You are getting what you pay for here, the velocity you gain from not worrying about your infrastructure.

I do think that when you are first launching a startup, you should probably do everything as cheaply as possible, which probably means using a VPS or IaaS. As soon as your infrastructure becomes more complicated, you can use Heroku instead of hiring people to manage it for a while. Then see where your growth takes you -- you will probably find that eventually it makes more sense to hire a couple people to manage some IaaS or even renting racks and buying hardware.

As with all things in life, it really depends. I believe this particular configuration makes sense for companies who want to focus on product, not infrastructure -- at a cost of expensive hosting.

<comment><USER14> Cost of getting one dedicated devops engineer would surpass Heroku budget by 10X. If devops engineer is far fetched as per scale of the company than count in number of hours put in by developers for initial up, upgrade, new emlpoyee on boarding tada tada would easily bet it too.

However I wish they would have disclosed traffic handled by Heroku servers as well.

<comment><USER15> Maybe if you hire them from Silicon Valley. There's plenty of skilled people in areas with low cost of living that can handle the job without 10x the pay of whoever. There should be at least one such person on the team anyway if the business is a _web application_. Plus, aren't there alternatives to services like Heroku these days that come as appliances or VM's with simple deployment? I'm seriously asking because I don't work on that stuff but swore such products pop up all the time.

<comment><USER16> For JVM apps Boxfuse ([https://boxfuse.com](https://boxfuse.com)) gives you dead-easy deployment to plain AWS by generating minimal VM images that run unchanged both locally on VirtualBox and in the cloud. It follows the principles of immutable infrastructure (machines are disposable and never modified) and all updates are performed as zero-downtime blue/green deployments.

<comment><USER15> Now _that_ is a bit closer to what I'm talking about. I appreciate the tip about this service as I know some Java people that might like it. You might find it interesting that these Java VM services are actually similar to what safety-critical, embedded industry has been doing for a while:

[http://www.aonix.com/pdf/PercDatasheet.pdf](http://www.aonix.com/pdf/PercDatasheet.pdf)

They run POSIX and safety-critical apps side-by-side on a microkernel (eg QNX, INTEGRITY) w/ latter usually on a built-for-purpose runtime like PERC. They also would combine app, dependencies, and runtime into one image that could go into a ROM. Services like Boxfuse are doing it for cloud but the model goes back over a decade with proven benefit. Goes back further in security kernels (eg Aesec's GEMSOS or BAE's XTS-400) where they did same thing for preventing sensitive components from leaking to ported POSIX/Linux apps. So, it goes back almost three decades now. That's how long it takes industry to learn apparently. ;)

EDIT: Wait, you're the founder rather than just a user. You might have heard of some of this advanced, clever Java stuff already then. Haha.

</comment></comment></comment></comment></comment><comment><USER17> Cloud services can work out super expensive for a startup. To get going often all you need is one server that runs both the database and web server, which you can rent cheaply from any number of hosting companies out there. Sure you have to manage it yourself and it won't scale right off the bat, but sometimes that's fine. This is how we ran Scirra for a long time. Eventually you need to scale up, but that's a nice problem to have!

<comment><USER18> Dividing your architecture into separate components is not only needed for operating at scale (the "nice" problem to have), but for having high availability (or even decent performance) at all.

Depending on one's business, HA/performance may not matter that much, but personally my startup is having a 'proper' design from day 1 - downtime is not acceptable for my business model.

<comment><USER19> Dividing your architecture into separate components will probably cause you more downtime and have much worse performance.

Less servers and components mean less things to break.

Grab a dedicated server and host your shit on it (have a DB replica because losing data sucks, but that is easy). You will be able to run like that for _much_ longer than you probably suspect and the chance of downtime will be massively reduced.

Why? Because a single server has a very low chance of having anything going wrong.

Not only that, but there is a lot of overhead in performance when you split everything up into components. You will be surprised how many requests you can handle on a single inexpensive dedicated server when you haven't put too much effort into "architecture".

When you actually find yourself running out of headroom on that setup you will know much more about your application and it's requirements then you did at the start, so you will have a better idea of what to split out, and a better understanding of what parts of your app need more performance anyway.

<comment><USER18> Workers are a must for any minimally sophisticated web application. You cannot degrade HTTP response time (and whole app server performance) just because you are performing work synchronously before the request finishes.

Similarly, if the work you are performing has any value for your business, it must be retryable, and the queued items must be safely stored (i.e. don't use a single Redis server - use something distributed like SQS instead).

All of that calls for a 'proper' architecture. I'm not talking microservices or anything fancy - just a webapp/worker/db separation and the like. Which is exactly what dedicated server (or DigitalOcean) users tend to lack at early stages.

<comment><USER20> "workers" are application level architecture decisions, not machine/server level. If you need to (which most webapps dont) then do so.

</comment></comment></comment></comment></comment><comment><USER21> These "Heroku is too expensive" comments all look at absolute costs and not relative costs. They are paying roughly $200 a month to Heroku. If you do some rough calculations to figure out revenue (use Stripe fees and make assumptions about yearly/monthly plan breakdown) you can reasonably estimate about $3,000 in monthly billings. The incremental savings couldn't possibly outweigh the time costs of switching to another provider.

If using Digital Ocean allows them to move faster, then sure that makes more sense. But doubt that's true in this case.

<comment><USER22> I used to say "but we could just build that", but I agree with you.

Some of the things I find expensive are te SSL line items and more peculiar than expensive really, a $25 image carousel.

If letsencrypt could be a drop in replacement for te SSL spend it would save them some money.

Other than that, I don't use Heroku, but not wanted to manage a db is pretty reasonable and the cost offset is likely there.

Sometimes these startups are 2 people. So the tech cycle would be hard enough, not to mention business and customer support.

<comment><USER23> For some insight, the $25 carousel was more about supporting the indie dev who built it. :) And sometimes the startup is 1 person, which Cushion currently is. I'm hoping to hire some dev help this year, though!

</comment></comment></comment><comment><USER24> Am I understanding this correctly? Just under 10% of the cost was spent on fonts? $~800? That seems unbelievably high.

<comment><USER25> It's a one time cost. The others are monthly costs. Most likely they're paying for a redistributable licence which is much more expensive than other licences.

For instance, take a look at this font I'm currently integrating into the app I'm working on:

[https://www.myfonts.com/fonts/intelligent- foundry/averta/](https://www.myfonts.com/fonts/intelligent-foundry/averta/) [https://www.myfonts.com/fonts/intelligent- foundry/averta/buy...](https://www.myfonts.com/fonts/intelligent- foundry/averta/buy.html)

If you want to put these on the web, you're paying $200 per font type. If you want to buy the whole family, that's almost $1200.

Companies with a design focus are happy to pay this in order to differentiate themselves from others.

<comment><USER23> Correct—the font licenses were a one-time cost. Previously, I was using Typekit, but I hit an issue with the requests stalling for ~3 seconds. Apparently, Chrome has a threshold of not loading more than ~5 requests from a single external location at once, which resulted in the stall. I reached out to the font foundries and they were incredibly helpful in letting me try out the fonts for performance testing. When loaded from my own CDN, they loaded instantly. At the time, I had some extra cash from a freelance gig I just wrapped up, so I went for the font licenses. To me, as the designer/developer/one-man-team, it was important to have design I intended for Cushion along with good performance—and supporting the font designers who were so helpful.

<comment><USER26> Are you allowed to use these fonts in a native mobile app?

<comment><USER23> Unfortunately, no—that's a different license, which is strangely _much_ more expensive than a web license.

</comment></comment></comment></comment></comment><comment><USER27> People are talking about the cost of Heroku, but it doesn't seem that outrageous to me.

I mean, $180/month for a running app, that is making money, isn't that much. Once the traffic grows, and you're spending $500 or $1000 per month, yes, it becomes worth it to look into alternatives (because $1000 on Heroku can probably be replaced by $150-200 on more powerful hardware). But moving from Heroku to a less managed option just to save $80/month doesn't seem particularly worth it.

<comment><USER28> As long as you can factor in Heroku's costs on your per customer acquisition and it doesn't eat a lot of your profit, then Heroku is a good choice.

</comment></comment><comment><USER29> I really dont understand. Im deploy rails webapps all the time with pretty large postgres backends.

You could totally spin up multiple digital ocean instances to get a much cheaper infrastructure. I usually use one for load balancing, 2+ for running the app, and usually one for the backend postgres. You could also get away with using something other than digital ocean for the postgres.

But for 6000 users, depending on the app. I can probably get away with like $30 a month with this setup. Including the database.

Total setup time might be a day the first time. But it scales pretty well, costs significantly less.

<comment><USER30> The hosting costs appear to be about $70 ($30 for the hosting and $50 for the DB). That doesn't seem excessive to me.

The other expenses appear to be various other services (slack, support site, logging service, etc). Lot's of 3rd part services to handle stuff.

Obviously it's a lot cheaper if you can do many of these things yourself (run your own support web app, use a free chat service, etc, etc). But we all have to decide what services we want to pay for vs run ourselves - in some cases it is cheaper to not have to spend the time!

</comment></comment><comment><USER31> Might be worth checking out things like fbstart or foundersgrid perks to get a bunch of vouchers and discounts off these services.

We got 6 months free Mailchimp and fee-free on Stripe for the first 60k i think, really helped at the time

<comment><USER32> Is the fee free time limited with Stripe?

</comment></comment><comment><USER33> Heroku is without a doubt one of the more expensive options out there. SSL being billed per month? Yikes. SSL really should be standard.

<comment><USER34> The bill looks huge. You can get SSL for like $8/year from reseller for one of the Symantec ones.

I think that starting startup can cut a lot of corners by using open source resources and cheap cloud servers like DO.

<comment><USER28> You can get SSL for free: [https://letsencrypt.org/](https://letsencrypt.org/)

<comment><USER34> Yeah, I compared his paid to other paid. afaik not all companies are OK to use free SSL since it seems it is still a novelty.

</comment></comment></comment></comment><comment><USER35> Anyone here have any thoughts on AppEngine vs Heroku?

I use AppEngine for my experimental projects because I can get a simple data model and some handlers running in minutes and a (supposedly automatically scalable) useful backend up in less than a day, and at very low cost. (Virtually free if I use an *.appspot.com domain).

You do get lockin issues but don't you also get lockin from Heroku? Is there big advantages to Heroku that make it worth it?

<comment><USER36> You get lockin issues with any vendor - even server colocation :)

AppEngine is a great tool for a great price. It scales smoothly with an affordable increase in pricing.

Heroku is sort of famous for getting too expensive at large scale. Their advantages are their ecosystem (most of the additional services listed in the OP can be installed quickly, and you're still only billed by Heroku), and their UIs which tend to be easy to understand and operate.

<comment><USER37> Parse.com is similar to Heroku in that its simple to get started and has a free tier but gets real expensive once you go over that. I'm rebuilding my Parse back-end and going with Google app engine managed vms for a number of reasons.

</comment></comment></comment><comment><USER38> This is the first time I have ever heard of Papertrail. I really hate loggly and am looking for a better option - can anyone shed any light on if this is a good option ?

Which log aggregation services is everyone using ?

<comment><USER39> We got frustrated with the UI on Loggly and wound up moving to Logentries ([https://logentries.com/](https://logentries.com/)).

I've not used Papertrail, so can't compare to them, but it's significantly easier to use than Loggly, they've been kind to us through the odd overage, and it does what we need it to do (Centralise a load of application logs and allow us to search over them and set alerts). The live tail feature is nice as well.

<comment><USER40> Also have had great experiences with Logentries. Easy to integrate on every platform/OS, very configurable alerts, team has been pleasant and responsive to pull requests.

</comment></comment></comment><comment><USER41> This is an excellent breakdown, thanks. As others have pointed out you can make it cheaper here or there but I find it awesome that you can run your business without any dedicated IT resources a sysadmin/network/ops kind of person. Adding one employee might switch it from a nice side income to losing money.

<comment><USER23> Thanks! Fortunately, the app's usage is pretty casual—users check it a couple times a day, or sometimes week-to-week. Because of that, I haven't had too many issues with server load. Honestly, I could probably run it on a single server no problem, but it's good to have a backup just in case. I freelance alongside of this, so I'm trying to slowly make Cushion my full-time gig. Hopefully, I can make the final push this year.

</comment></comment><comment><USER42> Thanks for sharing this!

Why not include the cost of your time to maintain and improve the service? Without including the cost of your own time it seems hard to make budget decisions (e.g. the tradeoff between a PaaS and using a provisioned VPS). Even if you're not paying yourself anything, it seems important to include what you _could_ be making if you were doing something else with your time.

<comment><USER23> I definitely plan to share the cost of my time to work on Cushion. I've been tracking my time since the original idea. To give you an idea, I _just_ crossed 2,000 hours for design and development. I didn't track time for customer support and writing, but it's up there. If I were to charge hourly for all my time spent on this app, I'd be sitting pretty. :)

</comment></comment><comment><USER43> It looks like Intercom is one of the most costly monthly services. I think support is of huge importance, but I'm curious how you justified to yourself that it was worth the cost to use Intercom over, say, email.

<comment><USER23> For Cushion, I use Intercom to handle support, in-app feature updates, newsletter emails, user tracking (tagging to follow up with feature updates), automated emails (trial expiring, etc), and a slew of other things. When I added the cost of that up across other services, it ended up costing more than I'd pay with Intercom. Also, I really love Intercom and their team—they're doing great work. Trying to handle support via email would be a nightmare from simply an organizational standpoint—I tried it for a very short period of time.

<comment><USER43> Awesome. I hear lots of great things about intercom so I wanted to see how people thought of the cost.

<comment><USER23> Also, I mentioned to them that the cost was becoming a bit much for me as a solo dev, so they worked with me to build a custom plan that I could afford. I couldn't recommend Intercom enough.

</comment></comment></comment></comment><comment><USER44> How do you only pay $80 for Slack a year? Their base price is $6.67 / user / month on an annual plan, so $80 gets you 1 user on Slack. Huh?

<comment><USER23> I'm a solo dev. :) I use Slack as a notification center for all of my services.

<comment><USER34> How your setup works then? Sounds like something that could improve performance of single dev.

<comment><USER23> I definitely plan to write about it on the journal ([http://cushionapp.com/journal](http://cushionapp.com/journal)). I have channels for new users, Stripe charges/subscriptions, errors from Sentry, build notifications, and support notifications. I plan to also build some Slack bots that would help automate a few things.

<comment><USER34> Sweet, I am looking forward to it. Good job with the project!

</comment></comment></comment></comment></comment><comment><USER45> For all of you dreamers with side projects (like me): red hat open shift has a free tier with free ssl

<comment><USER46> Thanks for the information, I find outrageous to have to pay $20 per month just for the SSL endpoint on Heroku.

</comment></comment><comment><USER47> This is interesting as I'm doing a lot of these things in my spare time on my own sites, eg running postgres servers and backing them up in an automated way, as well as developing them and holding down a full time job.

As others have said, Heroku seems like a very expensive way to lock yourself in to one provider.

</comment><comment><USER48> This is a lot of money. I am running my startup for less than $250.00 a month. This is all server costs.

Without a doubt, this cost has increased over time, but in the beginning of the startup, it was just $20 or $30 a month.

Ive built and home grown all of these products or at least what I needed in house.

Shameless plug: [https://rdnation.com](https://rdnation.com) and [https://snation.com](https://snation.com)

<comment><USER49> Unless you're paying less for the same line items, it's not really useful to say that you're running leaner. You might simply be using fewer tools.

<comment><USER23> I appreciate this.

</comment></comment></comment><comment><USER50> Heroku is very, very expensive. We switched an early Discourse setup from Heroku to Digital Ocean (using our Docker setup, which is another reason why it exists) and it saved them probably $100 per month. Everything but the largest communities fit fine on a $20/month, 2 CPU, 2GB ram DO droplet.

<comment><USER51> "Heroku is very, very expensive." "saved them probably $100 per month"

I'm confused.

<comment><USER52> This pretty much sums up the entire thread.

No one is understanding that having a few extra hours a month to build features and find customers is worth a couple hundred bucks. It's probably worth thousands of dollars a month.

</comment></comment></comment><comment><USER53> This seems ok given that the startup has generated approximately $60,000 in stripe revenue.

I would try to reduce costs in those Heroku workers... $175/month seems steep.

<comment><USER23> Hi! I run Cushion. Moving off Heroku is definitely high on my to-do list. So far, since I'm a solo dev, I've taken the mindset of paying for convenience services that would allow me to spend more time working on the app. Now, I'm getting into the phase where I can start reducing these costs and transition to a system that doesn't induce fear when I need to add another server. Right now, I have two web workers and two background job workers. The one background job handles integrations with other services, so I wanted to keep that separate from other jobs, like delayed emails, downloading backups, etc.

<comment><USER54> Thanks so much for sharing this, I will probably use it as an example for a book about hosting costs that I'm trying to finish for far too long.

By the way, your use of Heroku makes total sense given that you're basically alone, I hope that the lock-in won't be too difficult to overcome when moving away from it.

<comment><USER54> I just thought to leave here a link to a sample chapter from the book:

[https://www.hostingforappdevelopers.com/read.html](https://www.hostingforappdevelopers.com/read.html)

</comment></comment></comment></comment><comment><USER55> What are the strikethroughs for? My assumption is thing you aren't paying for anymore, but wanted to double check since not all have replacements.

<comment><USER23> The strikethroughs are for services I once used, but have since cancelled because I either moved to another service or no longer needed that service anymore. Early on, I paid for Code Climate, but realized it was an expensive non-necessity at the time. For services like Mailchimp, I moved my newsletter to Intercom once the spiked cost of Mailchimp didn't make sense to keep.

<comment><USER56> How about Baremetrics? What did you replace it with or was it not necessary?

<comment><USER23> The decision to cancel Baremetrics is a long story, but the main reason is that I don't agree with a few tactics they've used to improve MRR, like removing the ability for users to cancel their account on their own (you now need to email them). I'd rather make a little less in order to improve the user experience and build a better relationship with users. I use ChartMogul now, which I really enjoy using.

</comment></comment></comment></comment><comment><USER57> From the expense report, it says you have a wildcard SSL (and it seems to be in use in the subdomain for the signup page for example) yet your main root site seems to be unavailable via SSL?

Is there any reason for this or just an oversight?

<comment><USER23> The marketing site is static-hosted on S3 and I _think_ when I first set that up it was either too expensive for SSL or not possible. I'm not 100% sure, but I'll definitely look into it again. The wildcard SSL was a recent addition after coming out of beta, which didn't have the multiple subdomains.

<comment><USER58> Hot tip for when you get around to setting it up - SSL on S3 is far easier if you use CloudFront as the endpoint. At least it was 6 months ago when I was playing around.

</comment></comment></comment><comment><USER59> I can slash about 4000 of those dollars down to 600 by renting hardware to run those services on. Makes you responsible for your setup but if you are bootstrapping, you can find better first year uses for 3400 dollars I'm sure.

<comment><USER23> At the time, I was eager to build the app and focus on its features and getting it online. I don't know much about renting hardware, setting up a system, and scaling, so I was gladly willing to pay to make that easier on myself. The $3400 lost actually bought me a lot more of my own time, which I consider more valuable in the long run. I'd be interested in reading a blog post about how you'd slash the cost, if you ever end up writing one.

<comment><USER60> From the heroku costs, it looks like you are using one web dyno and 2 workers dyno. The database is on standard.0, which is the first base tier production level database they offer. There's no reason you couldn't host all these on one server on digital ocean. I don't really know what load your server is getting, but seeing as you only need one dyno, it's probably not much so one server should suffice.

\---

# Pros of setting up your own host.

\- Huge cost savings.

# Cons

\- Heroku is way easier to scale, just drag the slider. Upgrading databases / redis is still a pain. I recommend going with RedisCloud instead of Heroku Redis. With database you have to do a migration and copy the data over.

\- Having to deal with securing your own server and maintenance.

\- High upfront cost due to setup

At the end of the day, it's about what your time is worth :). There's no right answer. I go with Heroku myself. The instant gratification is hard to beat.

<comment><USER61> You also have to worry about failure of that server or that colo in the "rent a server" case.

</comment></comment></comment></comment><comment><USER62> Is it normal to rely on this many external services when running a site? I'm obviously novice here, but my NIH syndromes kicks in, and I'd feel nervous if I had to deal with this many companies by myself alone.

</comment><comment><USER63> Almost 10% of costs on _fonts_? WTF?

<comment><USER64> it's a one time thing i think.

</comment></comment><comment><USER65> Thanks for posting this, I found the format incredibly helpful, and it kind of makes me want to produce a run-rate estimator in a similar format. I often wind up overspending on side-project ideas for failing to take into account the costs of services I'll wind up using.

Judging by the Stripe fees, I'd hazard that your cumulative revenue is in the $30k range. I'm sure there are marketing and advertising expenses that aren't listed here, but that seems like a pretty healthy gross margin.

</comment><comment><USER15> I appreciate your breakdown. Helps those of us evaluating various web services get an idea what people are spending and what capabilities we might have overlooked. Neat stuff.

</comment><comment><USER66> This is great, I'd love to see more companies/projects do this. Maybe [http://usesthis.com](http://usesthis.com) could have a company edition.

<comment><USER67> Stackshare does this. Here is SeatGeek's stack: [http://stackshare.io/seatgeek](http://stackshare.io/seatgeek)

</comment></comment><comment><USER68> And here I am, running 7 sites on my $15/year VPS box. Yup, just $1.25/month, and the sites generate a few hundred a month th.

If I moved to Heroku or AWS, my profits would definitely suffer.

<comment><USER69> According to their Stripe data, they're making between $2560 and $4700 a month with around 200 users.

If your VPS box could handle that... they might still have a better business model.

<comment><USER68> 200 users is nothing. It's not like they are rendering 3D on the backend.

</comment></comment></comment><comment><USER70> Aren't we missing a key value in order to compare apples to apples? How many users registered/concurrent?

</comment><comment><USER71> What is funny though is that the cost doesn't seem to go down much or at all even after a few years.

<comment><USER23> I plan to transition to AWS this year, so hopefully costs will go down a bit from that. :)

</comment></comment><comment><USER72> Two things, I don't like that they didn't amortize the fixed costs like the font, carousel lib, and certs because it created those ugly and meaningless spikes. In addition, the site seems to break the back button in Safari(the new IE) on OSX-EC

</comment><comment><USER73> So are there any email marketing alternative? other than mailchimp?

</comment><comment><USER74> My breakdown: $10/month Linode instance, $20/year domain registration.

Unfortunately even that is pretty expensive given how weak my country's currency is against the dollar.

</comment><comment><USER8> How is sentry free if he uses Heroku for everything? It must be running somewhere else like AWS or DO right? But those aren't listed as part of his costs.

</comment><comment><USER75> it's when I see that kind of costs that I wonder if people have completely forgotten about sysadmin and dedicated servers ?

hey we don't know how to do those cryptics admin stuff on the command-line let buy services instead and atomise our monthly costs ...

I don't even talk about tons of open source solutions that would reduce even more the costs.

OK I'm probably biased here

</comment><comment><USER76> > Continuous Delivery Codeship free

I had no idea they were free.

<comment><USER77> One of my initial thoughts was that this list gives an interesting pricing signal to the various services that are shown.

It's interesting to consider whether certain services are pricing for perceived value and what the market will bare, or under-pricing for acquisition in an immature market and going for the land grab, or just underpricing themselves.

</comment></comment><comment><USER78> I run my personal website on a junk desktop I got from free from a previous employer. I only pay for the domain name and have a measured 99% uptime.

This is to say: a shopping list like that is utterly meaningless without the context of what the service architecture trying to achieve.

</comment><comment><USER79> Seeing lots of comments about cost of Heroku. An easy way to get that down is to not use Ruby.

<comment><USER80> Heroku supports more than just Ruby-oriented applications. Python, NodeJS, already possible.

<comment><USER79> That is my point.

</comment></comment></comment><comment><USER81> It costs $5/month to run Sublevel using DigitalOcean plus 21$/year for domain and SSL certificate.

<comment><USER18> One sure can have a DO droplet for a minimal rate, but unlike Heroku/AWS, they don't offer anything oriented to high availabilty, resilience, auto-scaling, performance (via workers), etc.

<comment><USER82> Exactly. In addition to what you listed, the ability to quickly roll-back to previous releases with a single click on Heroku has literally saved me from losing paying customers. I don't know what I would have done this past week where I had to do just that after a bad release.</comment></comment></comment>


Twitter Posts Betray Illness - <AUTHOR> http://www.informationweek.com/healthcare/security-and-privacy/twitter-posts-betray-illness/d/d-id/1204453

<comment><USER2> It would be a lot more interesting if twitter posts could be analyzed to indicate mental illness, and point to what type.</comment>


How the NSA is tracking people right now - <AUTHOR> https://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ <comment><USER2> Please mark this as old (2015) – I thought this was a new revelation (it was new to me). But this is absolutely crazy.</comment>


Embracing slow time - <AUTHOR> http://37signals.com/svn/posts/3502-embracing-slow-time

<comment><USER2> This is just a variant of Rubber Ducking: <http://en.wikipedia.org/wiki/Rubber_duck_debugging></comment>


Sudo_pair: A tool for paired use of elevated privileges - <AUTHOR> https://github.com/square/sudo_pair <comment><USER2> Seems like a good way to keep honest people honest, but is it really going to keep those will ill intent in check?

<comment><USER3> I would expect that the intention is for situations where multiple data owners reside on a particular server. Then, as you say, it keeps honest people honest, and creates the kind of permissions, paper trail and monitoring that many security policies require.</comment></comment>


Non-realtime publishing for censorship resistance - <AUTHOR> http://blog.bjrn.se/2020/01/non-realtime-publishing-for-censorship.html <comment><USER2> One part that the author doesn't go into in detail is that low-latency interaction makes it much harder to be location-anonymous when an adversary can experiment on your service. Of the three examples given in the article, only Silk Road has tried to be location-anonymous by being exclusively available with Tor onion services. But for Silk Road and several other dark markets, it didn't work out because investigators were eventually able to locate the infrastructure.

I haven't looked into how that happened in detail, and I think it was quite varied in practice in each case, but there are known methods to take advantage of the low-latency thing to experiment on services and draw conclusions about where their infrastructure is located. One example is to try to attack different parts of the Internet (different links or different colocation facilities, for example, maybe by overloading them with a DDoS or trying to partition them from the Internet with a BGP routing attack) and see which ones cause the service's availability to suffer when they're under attack. When a service is available in real time, this kind of experiment is much more practical because it's possible to see directly whether each individual attack has had an impact.

I think Freenet has something along the lines of the author's zine concept, where people can publish signed pointers to the latest revision of a document or set of documents.

<comment><USER3> That is true re: Freenet, they are called "signed subspace keys" or SSKs.

</comment></comment><comment><USER4> I'm having a tough time following the logic exactly. Can someone ELI5? I would think the question of centralized vs decentralized would be the dispositive issue. I think I'm missing something basic.

<comment><USER5> Yeah. Near as I can tell, it says "to safely publish something that can be considered illicit, don't put it on the internet." But to the obvious response, "ok, where then?" it doesn't answer, as far as I can tell.

<comment><USER6> Someone would have to publish a digital Factsheet Five (zine of zines) to tell you where to send your digital stamps to get these zines.

</comment></comment></comment><comment><USER7> Wouldn't ipns and ipfs be enough to achieve most of this?

<comment><USER8> Probably yes. In fact, a censorship-resistant marketplace that allows for asynchronous trade already exists built on top of IPFS. It's called OpenBazaar.

[https://github.com/OpenBazaar/openbazaar- go](https://github.com/OpenBazaar/openbazaar-go)</comment></comment>


Hashtags Instagram Won't Let You Search - <AUTHOR> http://thedatapack.com/banned-instagram-hashtags-update/#more-171 <comment><USER2> This reminds me of Shutterstock's open-source List of Dirty Naughty Obscene and Otherwise Bad Words:

[https://github.com/shutterstock/List-of-Dirty-Naughty- Obscen...](https://github.com/shutterstock/List-of-Dirty-Naughty-Obscene-and- Otherwise-Bad-Words)

<comment><USER3> Interesting. "anal" is a bad word in English, but not in German. On the other hand, "naked" is a bad word in German, but not in English.

Maybe I should send a pull request...

<comment><USER4> It may that they did not add it for a reason also. There are a lot of edge cases because many potentially dirty concepts are made up of words that are not bad alone. For example a text can have both "girls" and "nude" in it without being vulgar, but if it has the phrase "nude girls" the chance for it being pornografic is much higher.

( Searchdaimon have done some research on this and have a list if anyone is intrested: [https://github.com/searchdaimon/adult- words](https://github.com/searchdaimon/adult-words) )

</comment></comment></comment><comment><USER5> > #bi > #gays > #lesbian

Yet another example of mentions of queer identities being filed as pornography.

<comment><USER6> Like:

#italiano #kansas #kickoff

Which presumably show racism towards Italians, a hatred of the midwest, and a dislike of football?

Or maybe Instagram has an automated system which correlated hashtags with reported porn. Tags with greater than X% reported porn get banned.

If that's true (and we have no reason to think it is or isn't true), then the banned tags come out simply because the #bi, etc. people happen to use those tags more for porn than (presumably) #straight people.

I'm wary of waving the racism / sexism / whatism flag. We're not all racist. We're not all sexist.

<comment><USER5> > Which presumably show racism towards Italians, a hatred of the midwest, and > a dislike of football?

If that was a consistent pattern, maybe, but I am yet to hear of it.

> Or maybe Instagram has an automated system which correlated hashtags with > reported porn.

> I'm wary of waving the racism / sexism / whatism flag. We're not all racist. > We're not all sexist.

Maybe it's automated, sure. Maybe it's not directly intended. Doesn't change the outcome.

Also, no, everyone is racist and sexist to varying extents, it's not a binary. Humans are imperfect.

<comment><USER7> >Also, no, everyone is racist and sexist to varying extents, it's not a binary. Humans are imperfect.

Not everyone and everything is racist and sexist, stop peddling this histrionic narrative. If it's automated, are you claiming that algorithms are racist or sexist? The outcome isn't shaming a sexual orientation any more than x + 3 = 9 is "six shaming."

<comment><USER8> Presumably the claim would be that it contributes to a phenomenon which is considered harmful, and that there is an obligation to have it not do that.

Now, I don't know that I agree with that claim (certainly not without reservations at least), but I think that the idea of an algorithm contributing to a harmful phenomenon, and that being bad, is not an obviously wrong idea.

I don't think your argument against theirs is a very good one. Something better than your x + 3 = 9 quip would be needed to refute it.

I'm saying this as someone who also disagrees with the worldview you are arguing against.

/epistemic virtue signaling

<comment><USER7> The (management or computer) algorithm is likely designed to cut down on pornography and/or "offensive content"; the correlation of the terms bi, lesbian, or gay as metadata to explicit images is likely to be large on a visual platform. If anything is offensive, it's the quickness to jump to "I'm offended by logical explanations and I refuse to come up with practical solutions." Which is to say, I believe that the claim was infantile and deliberatively obtuse. Obviously it wasn't meant as a slight against sexual identity and if you want things to be better, get to work and stop complaining (which is unlikely to happen because complaining is easy and fixing things is hard).

Sometimes a cute riposte or simple response is all that's needed to defuse absurdity. Debating with someone plainly calling everyone racist and sexist isn't likely to bear fruit.

I wish we could get to a state in which the professionally offended would stop wasting others' time and encouraging this doublespeak-nonsense game -- there's only so many minutes in the day and we both wasted daylight on this.

</comment></comment></comment></comment></comment></comment><comment><USER9> > #snapchat

Huh. I wonder if there is some competition going on here

<comment><USER10> That was what by _far_ I found most interesting. Those could be easily labelled as genuinely anti-competitive practices - (i.e., it'd be if Google blocked "Bing" lookups, or vice versa (presuming it was manually added by their staff, rather than auto-triggered by a lot of adult content being flagged at the same time, and a heuristic firing off a ban-signal)). MS got into that whole DOJ trouble for bundling their own browser for way less than that.

</comment></comment><comment><USER11> I understand censoring pointless things like "kansas" but "asiandick?" Seriously? They're going to penalize Human A&P students that need help just because the source material is Asian!? Or just the Art majors that could get by with a different theme?

</comment><comment><USER12> Well, that was a pretty silly list. Most of the hashtags here seem to be pretty normal or harmless stuff, at least to anyone above the age of about six.

Also, not a fan of this being done because 'some' content under those tags was reported as inappropriate.

</comment><comment><USER13> Some of these are just weird or very specific. I'd love to hear the reasons for them being banned.

> #kissing

> #newyears

> #citycentre

> #hornyyyyyyasf

> #saltwater

<comment><USER3> First Google result for #hornyyyyyyasf is: [https://www.instagram.com/explore/tags/hornyyyyyyasf/](https://www.instagram.com/explore/tags/hornyyyyyyasf/)

Instagram, you're doing it wrong!

<comment><USER14> Dang.

</comment></comment></comment><comment><USER15> Is there a way to turn the filters off? Otherwise how is this not censorship?

<comment><USER16> It's censorship, but so what? It's a private company. They're allowed to display or hide whatever they please.

</comment></comment><comment><USER17> #workflow ?!?

</comment><comment><USER18> #whitegirl?

come on!

<comment><USER19> Could be because 'white girl' is also slang for cocaine.

<comment><USER20> This, also it is a term often used by escorts promoting their services on instagram.

</comment></comment></comment><comment><USER21> > #italiano

Really?

<comment><USER22> Italiano looks PG at worst.

[https://www.instagram.com/explore/tags/italiano/](https://www.instagram.com/explore/tags/italiano/)

Kansas is weird.

[https://www.instagram.com/explore/tags/kansas/](https://www.instagram.com/explore/tags/kansas/)

<comment><USER23> "Recent posts from #kansas are currently hidden because the community has reported some content that may not meet Instagram's community guidelines."

You aren't seeing the presumably bad stuff when you go to /explore because it is being hidden.

<comment><USER22> Ah thanks. Now I'm more curious.

</comment></comment></comment></comment><comment><USER24> no emoji?

<comment><USER25> Right, I recall a story being run about the blocking of the Eggplant emoji as a search term on Instagram.</comment></comment>


10k Steps a Day Is a Myth. The Number to Stay Healthy Is Far Lower - <AUTHOR> https://www.wsj.com/articles/10-000-steps-a-day-is-a-myth-the-number-to-stay-healthy-is-far-lower-11591968600 <comment><AUTHOR> [https://archive.vn/DAQwN](https://archive.vn/DAQwN)

</comment><comment><USER2> Did anyone believe that the number was exact and accurate for all people?

Are there people who think, "Oh, I've only gotten 9,500 steps a day this week; my health will begin to fail." ?

10k steps a day is not a myth, it's a goal. X glasses of water a day is a goal. Most health instructions are goals, and most people will fall short of the specific targets. How short you fall is likely to have some impact on your health, but each person is different.

While being active is undoubtedly very important for health, it's very clumsy to focus on one behavior and highlight the difference in mortality risk. It's very likely that more active people have other habits that contribute (significantly) to mortality risk reduction.

<comment><USER3> But the "X glasses of water a day" example you give _is_ a total myth. There is literally no evidence that humans need any "goal" when it comes to drinking water, just drink when you're thirsty.

<comment><USER4> This is overbroad.

Many people are acclimated to low levels of dehydration and do not feel thirsty when they should.

Setting an imprecise, but safe, target number is helpful.

<comment><USER5> I've noticed that I drink a ton more water when I have my water bottle on my desk---I rarely get up to go get myself a drink (because I'm deep in whatever work I'm doing), so I would wait too long without the water bottle. The convenience factor certainly plays a role in determining what the "thirstiness threshold" is.

<comment><USER6> but is it doing you any good? are just drinking more often but smaller amounts? is it just nice to drink but not useful?

<comment><USER5> > are just drinking more often but smaller amounts?

Probably. I don't measure my water consumption, but I'm guessing that I drink smaller amounts. Even if my average hydration level is the same, it never goes too low this way, which means that I feel better.

I don't have any objective way to measure the health benefits of drinking a certain amount of water, but it definitely makes me feel better to be more hydrated, so I'm guessing it's good for my health.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Among the group, walking approximately 4,400 steps a day was associated with > a 41% reduction in mortality compared with walking 2,700 steps a day. > Walking around 7,500 steps was associated with a 65% reduction.

The headline does not match the content whatsoever. "The Number To Stay Healthy" implies a threshold beyond which there is no benefit. Yet the data suggests that more steps leads to better health outcomes, so 10k is certainly better than 4K or 7k.

If I were the author of this piece I'd be pissed to see it mischaracterized by this clickbait trash headline.

<comment><USER8> So is there "no benefit" to taking 20K steps a day versus 10K?

<comment><USER9> Maybe the point at which diminishing marginal returns really kick in, and "benefit"... with respect to what metric are worthwhile factors to consider here. The graph shows mortality rate but perhaps other cardiovascular disease markers would be meaningful to look at here.

In general, it would be nice for one to know some correlation between how the number of steps taken reduces one's risk. From what the article suggests, presumably these would be non-linear relationships.

</comment></comment></comment><comment><USER10> At 44% mortality reduction for 4,700 steps, and 65% at 7,500, I can't help but draw a curve in my mind where 10,000 steps is awfully close to the asymptote it is approaching, or at least an inflection point where further benefits rapidly diminish.

So the original figure of 10,000 would be surprisingly close to the mark, considering its genesis.

<comment><USER2> 10,000 is also a nice number. It's big enough to be impressive, but not so big that we cannot imagine reaching it.

It also takes 10,000 hours to master a skill...

There are probably other "10,000" goals in human behavior.

<comment><USER11> there is the 10,000 sentences method for aquiring a foreign language.

</comment></comment></comment><comment><USER3> Most of these "recommendations" turn out to be myths. They are generally "good ideas" that have _some_ experimental backing (e.g. "walking is better than sitting"), but then someone puts out a number that people repeat ad infinitum because it sounds good. 10k steps, 8 glasses of water a day, 10k hours to "master" something, are all basically just catchy slogans.

<comment><USER12> Catchy numbered slogans are also more effective for getting a message across and setting a goal

</comment></comment><comment><USER13> As far as I know this magical number comes from Japan as in 1965 they released a pedometer labeled Manpo-kei which supposedly means "10,000 steps meter"...

From the last link: "It turns out the original basis for this 10,000-step guideline was really a marketing strategy," she explains. "In 1965, a Japanese company was selling pedometers, and they gave it a name that, in Japanese, means 'the 10,000-step meter.'"

[https://en.wikipedia.org/wiki/Pedometer#History](https://en.wikipedia.org/wiki/Pedometer#History) [https://www.news-medical.net/health/Where- did-10000-steps-a-...](https://www.news-medical.net/health/Where- did-10000-steps-a-day-come-from.aspx) [https://www.theatlantic.com/health/archive/2019/05/10000-ste...](https://www.theatlantic.com/health/archive/2019/05/10000-steps- rule/590785/)

</comment><comment><USER14> Health and fitness research is amazingly vague and.. well shit. Or no wait, the term in underfunded. We should be sinking hundreds of billions into figuring out these things.

The stuff here talks about the amount of physical exercise to stay healthy! In what other field would such things be acceptable? You just cant say "Stay healthy", there is no such thing. (at least not today)

I want to see the entire chart derived from huge data sets but I believe the really interesting data to live around minimal activity. There is probably a sweet spot around 20-100 steps where fewer really starts killing you really fast. Then we can get to addressing the issue and possibly improve average/collective health dramatically.

I wouldn't mind showing up for bench marking 1 time per year. If the report puts me in a group slowly killing themselves I would be interested in solutions. It might sound absurd but I already pay 25 euro for some smokes. They say it is for my health but Nicotine addicts don't need to smoke.

</comment><comment><USER15> Easy goals so people don't have to think. 5 a day. 10,000 steps. 2 metres.

Is anyone surprised?

</comment><comment><USER16> this article is flagged. I'm seeing a lot of flagging lately, here on HN. Did anyone notice the same thing ?

<comment><USER9> Yes. My guess would be because the title is clickbait-y (though it is the actual title).

The title also doesn't seem to match the research results in the article.

</comment></comment><comment><USER17> pre-covid I easily did 10k steps every day and I really wasn't healthy.</comment>


How could bees come up with anything as complex as a dance language? (1997) - <AUTHOR> http://discovermagazine.com/1997/nov/quantumhoneybees1263?resubmit=hn <comment><USER2> _Championing an unproved or unpopular idea is a good way to put your academic career on permanent hold._

Which would be a shame, actually. If everyone were to play it safe that way, we would make no progress at all. I didn't know science is a popularity contest.

</comment><comment><USER3> It would be cool to at least check the claimed flag manifold relationship.

The quark thing seems on the giggle side of unlikely though. I could see a route to electromagnetic quantum biology, since there is some evidence for that in other contexts, but quark interactions seem fairly remote from any known biological mechanisms.

Also should the flag manifold connection be correct, sensitivity to quark interactions is not required for bee neurons to construct a flag manifold, any more than it is for humans. Bees would have presumably just hit on this maths during evolution of their neural structures, rather than during time spent staring at a chalkboard.

<comment><USER4> Dogs can catch balls that fly along parabolic paths. I wouldn't go looking for conical structures in the dog's brain to explain how come they have such astonishing mastery of conic section geometry.

<comment><USER5> Another good one with dogs is that if you are on the shore and throw a ball into the water at an angle for the dog to fetch, so that it is not straight out from where you and the dog are, the dog figures out how far to run down the shore before entering the water to get to the ball fastest.

Going straight for the ball is not optimum because the dog runs faster on land than it swims in water, so if the ball is far enough to the side the greater speed along the shore more than makes up for not directly approaching the all.

Going to the point along the shore closest to the ball is not optimum because as the dog gets near that point, it is traveling almost perpendicular to the line to the ball and so isn't going to get enough closer to justify the extra time to run there.

The best point is somewhere in between, and the dog finds that.

<comment><USER4> Dogs probably use quantum simulation of light refraction to figure that out ;)

</comment></comment></comment></comment><comment><USER6> [http://pasteboard.co/2bBK3iI3.png](http://pasteboard.co/2bBK3iI3.png)

<comment><USER7> ... and the image is not even a honey bee.</comment></comment>


Instead of 'finding your passion,' try developing it, Stanford scholars say - <AUTHOR> https://news.stanford.edu/press-releases/2018/06/18/find-passion-may-bad-advice/ <comment><USER2> This thesis is developed by Cal Newport in his book "So Good They Can't Ignore You" ([https://www.calnewport.com/books/so- good/](https://www.calnewport.com/books/so-good/)).

As an introduction example, he mentions Steve Jobs who said to graduating students (during a speech made viral), that they should follow their passion in their (professional) life. But when Newport digs a little, turns out it was actually not at all what Jobs did in his career. Yet, no one would say that he wasn't passionate about his work.</comment>


Ask HN: Considering Offer with Late-Stage Pre-IPO Company with private RSU's - <AUTHOR> The role seems like a great fit, but I'm evaluating the comp.
Is this a risk? How big of a risk? Should I look at public companies instead?
They are offering RSUs but are private. From my understanding, I will have to pay taxes on this but won't get to sell them until if/when they IPO. Is this typical, is this really risky? Could it get diluted? They are a major player in business for 15+ years.
Looking for any advice. <comment><USER2> RSUs get taxed pretty much like normal income when they vest; you pay capital gains on them when you sell (assuming they are worth more than what they cost at the time of vesting). But, if the company is private, there may not be a market for the shares, so you may not see any money if the company doesn't go public/get acquired.

Edit: The risk angle relates to the time horizon (yours and the company's) and the valuation (the company may be overvalued and offering you RSUs based on said overvalued price per share). Additionally, there is always the dilution risk in the event of a 'down round', where the company does not increase in value but has to issue additional shares to raise capital (if the company is growing in value, dilution affects will cut the value of said RSUs less than in the previous case).

If you want to see actual money from the RSUs by a certain time in the future, then the time horizon comes into play a bit more --- what if the company has no plans for a liquidity event within said time horizon?</comment>


Free pdf Books on Machine/Statistical Learning - <AUTHOR>

Elements of Statistical Learning
http://www-stat.stanford.edu/~tibs/ElemStatLearn/
Gaussian Processing for Machine Learning http://www.gaussianprocess.org/gpml/
Bayesian Reasoning and Machine Learning http://web4.cs.ucl.ac.uk/staff/D.Barber/pmwiki/pmwiki.php?n=Brml.Online
Convex Optimization http://www.stanford.edu/~boyd/cvxbook/ <comment><USER2> There's lots of good books on the topic (It is a hot field after all). But I really wish there was a good online community for the subject along with NLP and AI.</comment>


Ask HN: What's the best modern Java web app stack and tooling? - <AUTHOR> Background: for the past few years I've been mostly Ruby on Rails, some iOS, and some JS/React. Would like to start building some simple web apps with Java–most likely with React on the frontend.
What's the best modern stack for this? What are the equivalents of rbenv, gems/bundler, Sinatra, Rails, and AR/sequel in Java-land?
TIA! <comment><USER2> You're going to be disappointed. That said we do a _lot_ of Spring Boot with react front end and it works. I don't like Java very much and the docs are not as good as rails and the surface area is huge but... wait why do you want to write Java again? Lot of people do Kotlin + Spring Boot when they can.

<comment><AUTHOR> 2 reasons: (1) we're the only rails team in a large company that is mostly java; so I'd like to get better. (2) recently went back to school part-time and we've been doing java projects but with _no_ tooling, frameworks or external libs ... so I'm kinda curious if it gets nicer.

</comment></comment><comment><USER3> You might want to look into Dropwizard: [http://www.dropwizard.io/1.2.2/docs/](http://www.dropwizard.io/1.2.2/docs/)</comment>


Homemade CPU and 8bit computer with discrete logic - <AUTHOR> https://old.reddit.com/r/electronics/comments/dslwtc/i_finished_the_ultimate_homemade_cpu_and_8bit/ <comment><USER2> Amazing and takes me back to my high school project's days. But I must ask- why ??

<comment><AUTHOR> He explains it quite well further down in the thread:

As you said, from an educational standpoint, most students(some of my colleagues last year at least for example) were kind of missing that you are not "programming" an FPGA, but rather describing the circuit. Furthermore, when you add conditional statements(if, else if) , you completely lose track of how it's being implemented and therefore you are not really learning digital design(in my opinion).

Of course doing everything with discrete logic also has its disadvantages, like being time consuming and expensive, but when doing so, you really know how every digital block communicates with the other and learn true digital design.

Anyway, I think both discrete logic and FPGAs should be taught in college. The former as an introduction and the latter as the standard industrial way of doing things nowadays efficently.</comment></comment>


How to Set Up Automated Text Messages in Pipedrive - <AUTHOR> https://mediabooth.com.au/how-to-set-up-automated-text-messages-in-pipedrive/ <comment><USER2> Does Twilio not operate in Australia?

</comment><comment><USER3> This seems a bit niche...</comment>


Voynich Manuscript Decrypted by Bristol Academic - <AUTHOR> https://phys.org/news/2019-05-bristol-academic-voynich-code-century-old.html <comment><USER2> I don't buy it.

The correct way to produce a decryption is to produce a full plaintext document, along with steps to reproduce it.

It's also worth noting that this is the latest of a long series of claims of having deciphered it: [https://en.wikipedia.org/wiki/Voynich_manuscript#Deciphermen...](https://en.wikipedia.org/wiki/Voynich_manuscript#Decipherment_claims)

</comment><comment><USER3> The paper itself is here: [https://www.tandfonline.com/doi/full/10.1080/02639904.2019.1...](https://www.tandfonline.com/doi/full/10.1080/02639904.2019.1599566)

From the introduction:

> Past scholarly attempts at solving the writing system are far too numerous > to mention individually, but none was successful in any way, because every > attempt simply used the wrong approach

This is rather a strong claim (which I am not equipped to evaluate). The author goes on to argue that the manuscript can be understood as an example of a long-hypothesized language with minimal written artifacts.

<comment><USER4> "Published online: 29 Apr 2019", says that page, and the article itself says "May 15, 2019", but it looks like Gerard Cheshire published his theory in 2017, because here's a plausible-sounding rebuttal from November 2017:

[https://ciphermysteries.com/2017/11/10/gerard-cheshire- vulga...](https://ciphermysteries.com/2017/11/10/gerard-cheshire-vulgar-latin- siren-call-polyglot)

<comment><USER5> And indeed, it was discussed on Hacker News at least once before:

[https://news.ycombinator.com/item?id=19491517](https://news.ycombinator.com/item?id=19491517)

</comment></comment></comment><comment> crypto-jeronimo The following excerpts score quite high on my BS meter:

\- "Although the purpose and meaning of the manuscript had eluded scholars for over a century, it took Research Associate Dr. Gerard Cheshire two weeks,"

\- ""I experienced a series of 'eureka' moments whilst deciphering the code"

These two alone much more to discredit the "preliminary" claims than any of the remaining arguments in favor of the "discovery".

<comment><USER6> It amuses me that this passed the editor and the peer review process:

"So, from De Rosa's manuscript we understand just why manuscript MS408 is so dominated by female issues, activities and adventures and why so few images of men appear. The only males in the citadel were the abbot, celibate monks and young boys, leaving the women and girls sexually and emotionally frustrated, so they amused and distracted themselves whilst they waited and yearned for male attention to return. They must have jumped at the chance of an adventure when the volcano erupted in 1444, as the citadel would have felt like a gilded cage by then."

</comment></comment><comment><USER7> If it agrees with this guy here I'm sold: [https://www.youtube.com/channel/UC- sW5dOlDxxu0EgdNn2pMaQ](https://www.youtube.com/channel/UC- sW5dOlDxxu0EgdNn2pMaQ)

(he kinda takes off where Stephen Bax left it)

edit: they don't agree I think

edit2: so he cherry-picks from multiple languages to make his theory work? XD</comment>


Something Is Broken in the UK Intellectual Sphere - <AUTHOR> https://medium.com/incerto/something-is-broken-in-the-uk-intellectual-sphere-7efc9a1f154a <comment><USER2> Whine, whine.

</comment><comment><USER3> A prominent intellectual in one field pretends he knows immediately how to be an expert in another field and then subsequently digs in his heels and starts casting aspersions and bragging about great he is once he gets egg on his face?

Why, that's a tale as old as academia itself. The UK ""intellectual sphere"" seems just fine.</comment>


NES Programming Tutorials - <AUTHOR> http://nintendoage.com/forum/messageview.cfm?catid=22&threadid=7155

<comment><USER2> This is the thing I've been waiting for since I was 12

</comment><comment><USER3> These are excellent, I've recently been following them as a hobby project. My results so far are here :) [https://github.com/emmett9001/pong_nes](https://github.com/emmett9001/pong_nes)

<comment><AUTHOR> Awesome! I'm planning on doing a similar thing soon.

</comment></comment><comment><USER4> IIRC there is a C compiler (cc65) that targets 6502, AFAIK it's a dead project :(

Anyone know anything about writing NES programs in C? Writing a NES game really appeals to me, but 6502 ASM does not!

<comment><USER5> Shiru is the only person I know of that wrote anything interesting in C for the NES. Here are his thoughts on the experience:

[http://shiru.untergrund.net/articles/programming_nes_games_i...](http://shiru.untergrund.net/articles/programming_nes_games_in_c.htm)

[http://forums.nesdev.com/viewtopic.php?f=2&t=8493](http://forums.nesdev.com/viewtopic.php?f=2&t=8493)

Take note of the "Optimization" section. The C you have to write for cc65 to generate a somewhat acceptable program is very... unidiomatic. C's machine model does not map well to 8-bit micros at all.

You can't write a game for the NES or any of these old consoles entirely in C, some parts simply will not be fast enough to fit into tiny timing windows. At the very least, your interrupt routines (updating sound, graphics, and possibly scanline "raster effects") will have to be written in assembly. Game logic has a bit more leeway, but you'd still run the risk of taking too long and losing frames with an unoptimized program. Given that, it may still be a productivity win to use C to "script" some optimized assembly language to make a simple game (kinda like how modern game engines use languages like Lua to script optimized C++), but I don't think you can get very far if you're just using C as a crutch to avoid understanding the 6502.

I think 6502 assembly isn't as hard as it sounds (it's fun!), but if that thought really turns you off, others have been much more successful with the C + optimized assembly libraries approach in the Sega Genesis/Mega Drive scene, where the standard dev tools are an older version of the GNU binutils + gcc for C projects. The 68000 is much more amenable to being targeted by a C compiler than a 6502 is.

[http://gendev.spritesmind.net/forum/viewtopic.php?t=14](http://gendev.spritesmind.net/forum/viewtopic.php?t=14)

[http://gendev.spritesmind.net/forum/viewtopic.php?t=1373](http://gendev.spritesmind.net/forum/viewtopic.php?t=1373)

EDIT: Also, from experience writing some simple demo programs for the NES, I think understanding the PPU and writing a program that can be bank-switched effectively dwarfs the challenge of learning to program in assembly language.

<comment><USER6> I suppose it depends on the CPU. GCC can generate high quality, compact code for the 8-bit AVR. Of course, AVR was designed for C, it has 32 registers and good indexing modes.

</comment></comment></comment><comment><USER7> What is the point of learning 6502 now?

I've wanted to try writing for NES. Learning 6502 seems like a fun intellectual exercise - certainly the most fun way to learn assembly.

Even if I could write NES code, I probably can't find working NES hardware to test it on. There are emulators, at which point I may as well write in another language.

<comment><USER5> Why do people have Renaissance fairs, use film cameras, paint instead of using Photoshop, etc? Why do anything? It's fine if it doesn't interest you, but it's not like you need a practical reason to have fun making something.

>Even if I could write NES code, I probably can't find working NES hardware to test it on.

NESes themselves are readily available. Flashcarts like the PowerPak and the Everdrive-N8 are somewhat expensive, but not outrageously so. Some people also gut old games or buy repro PCBs to create test cartridges with somewhat easily-rewritable EEPROMs.

>There are emulators, at which point I may as well write in another language.

As long as you periodically test on the real deal, I fail to see how this would be a problem. It's certainly faster to load a ROM in an emulator than it is to copy it to an SD card or rewrite an EEPROM. Not to mention, there are obvious advantages to having access to a software debugger.

</comment></comment><comment><USER8> Also be sure to check out [http://nesdev.com/](http://nesdev.com/)

</comment><comment><USER9> I have a little NES programming experience. The 6502 assembler I use is NESASM, which is also the one those tutorials recommend. There are others called Asm6 and CA65 that I haven't tried.

The syntax that each assembler recognizes is slightly different so source code that assembles properly in one assembler may not assemble properly in another. This is something to watch out for when looking at code examples on the nesdev.com forums.

HAVE FUN with NES programming! :) I've only ever made simple programs. However, the only limits are your imagination. The homebrew game "Battle Kid: Fortress of Peril" was created recently, which is one of the best NES games in my opinion.

</comment><comment><USER10> This is interesting, as I was recently asked to teach 6502 programming for the purpose of programming the NES (I never have programmed an NES, my (limited) background in assembly language was for the Apple II).

After much searching, it seems a lot of the materials are poorly organized despite the wikis and such out there. This set of tutorials by far the most approachable and understandable material to go from not knowing much about the NES to being able to get Mario to move around.

</comment><comment><USER11> Just don't read the comment thread, it will hurt your brain.

<comment><USER12> Stuff that hurts your brain is the kind of stuff that's fun to dive into. Except empty swimming pools :)

<comment><USER13> I think he means the deeper in the comments you go, the closer it becomes an 'e-peen' measuring contest. But the first post is the only thing you should dive into.

<comment><USER9> I became a member of that site when it started; "e-peen measuring contest" is an accurate way to describe it.

</comment></comment></comment></comment><comment><USER14> Sounds like fun. Perhaps a productive way to procrastinate.

</comment><comment><USER15> YES! I'm so grateful that these guys scooped up all this useful info into one place.</comment>


City of Portland Concludes Investigation into Uber's Use of Greyball - <AUTHOR> https://www.portlandoregon.gov/saltzman/article/655540 <comment><USER2> How does this fit into the bigger picture? Is there any punitive action?

<comment><USER3> From the audit[0]:

> Based on this analysis, PBOT has found that when Uber illegally entered the > Portland market in December 2014, the company tagged 17 individual rider > accounts, 16 of which have been identified as government officials using its > Greyball software tool. Uber used Greyball software to intentionally evade > PBOT's officers from December 5 to December 19, 2014 and deny 29 separate > ride requests by PBOT enforcement officers. On December 21, 2014 Uber ceased > operations in the City of Portland. Uber received a permit to operate in the > City of Portland during an initiated Pilot Period beginning April 24, 2015. > Uber has provided documentation which shows the Greyball tags were removed > on April 24, 2015. After April 2015, PBOT did not find any evidence > suggesting that either Uber or Lyft attempted to use a software tool to > evade PBOT's officials in their efforts to protect TNC consumers or to deny > consumers rides based on their location.

So I believe the Portland Bureau of Transportation (PBOT) considers the temporary shutdown in 2014/2015 was enough. They do state, however:

> it is important to note that finding no evidence of the use of Greyball or > similar software tools after April 2015 does not prove definitively that > such tools were not used. It is inherently difficult to prove a negative.

So they're taking it somewhat seriously.

[0]: [https://www.portlandoregon.gov/saltzman/article/638525](https://www.portlandoregon.gov/saltzman/article/638525)</comment></comment>


An interview with Apple's first CEO, Michael Scott - <AUTHOR> http://www.tuaw.com/2011/05/24/an-interview-with-apples-first-ceo-michael-scott/ <comment><USER2> Link to actual interview: [http://www.businessinsider.com/apples-first-ceo- michael-scot...](http://www.businessinsider.com/apples-first-ceo-michael- scott-2011-5)

</comment><comment><USER3> I knew Michael would find something good after leaving Dunder Mifflin.

<comment><USER4> I thought the same thing at first, sadly.

</comment></comment><comment><USER5> I wonder if he has a hidden store of rage towards his fictional namesake like David Herman's character did in _Office Space_.

</comment><comment><USER6> On topic, an old interview with John Scully about Steve Jobs. I believe it's been posted to HN before.

[http://www.cultofmac.com/john-sculley-on-steve-jobs-the- full...](http://www.cultofmac.com/john-sculley-on-steve-jobs-the-full- interview-transcript/63295)

</comment><comment><USER4> Great read. Though the same story has been told many times before, it still amazes me that 4 people, in a garage, created a company that is now thousands of employees big and generates many billions of dollars in profit quarterly.

<comment><USER7> Just think about what 8 people in four bedrooms created.</comment></comment>


Hackers Can Kill Diabetics w/ Insulin Pumps? Facts vs. Fear Mongering - <AUTHOR> http://www.hanselman.com/blog/HackersCanKillDiabeticsWithInsulinPumpsFromAHalfMileAwayUmNoFactsVsJournalisticFearMongering.aspx

<comment><USER3> As per the other post:

tl;dr

Scott's most relevant points:

1\. "This is a key fob that looks like a car alarm beeper that some pump users use to discretely give themselves insulin doses. However, I feel the need to point out as a pump wearer myself that:

Not every Insulin Pump has a remote control feature. Not every remote- controllable insulin pump has that feature turned on. Mine does not, for example."

2\. "all he requires to perpetrate the hack is the target pump's serial number. This is like saying "I can open your garage door with a 3rd party garage door opener. Just give me the numbers off the side of your unit..."

3\. If you are a diabetic on a pump who is concerned about this kind of thing, my suggestion is to turn off your pump's remote control feature (which is likely off anyway) and turn off your sensor radio when you are not wearing your CGM. Most of all, don't panic. Call the manufacturer and express your concern. In my experience, pump manufacturers do not mess around with this stuff. I'm not overly concerned.

\--

Also - someone asked how much entropy was in the serial ID's on these units ?

Even if entropy is low are - how are you going to randomly select a person, and know their serial ID ? Unless you know what units are distributed to what hospitals/doctors - at exact times - at exact shipments and then from the sample delivered know the exact unit given to any person at any particular time.

Sure, if you know a "set of id's" you could try each one sequentially until you finally get a hit - but even then, you must somehow ensure the person being targeted has remote connection turned on. I'm pretty sure walking up to them and saying "oh, hai 'dere! ... plz turn on ur remotz connetz'n 4 me?" [ said in this voice - <http://www.youtube.com/watch?v=xh_9QhRzJEs> ] - is going to make them pretty suspicious.

There's a lot of "ifs" in there and frankly - if your aim was kill them - <USER2> would be a lot faster to do it some other way because to actually get all these things to line up perfectly .... your chances are pretty slim.

I'm a bit of sceptic on this 'hacking' - not to say that it's great that it has been uncovered - but your dealing with minute hardware where every single ms of processing power counts. Simple encryption should be utilized [but then this might be easily hacked anyway ?] but for units placed inside the body [pacemakers and the like] - splitting the units resources between keeping the patient alive vs. encryption for wireless protocols seems to weigh more heavily on the former than the later given how unlikely - for the majority of the world - these 'attacks' are going to be.

<comment><USER4> The "Just give me the numbers..." counter-argument isn't valid.

Right now, a hacker _can_ kill a specific person, within 30 days, given the following assumptions:

      - that person is wearing an insulin pump with the
        remote control feature turned ON

      - the serial number is 32-bits or less

      - the attacker can test 5000 serial numbers per second
        for at least 8 hours per day, every day

So, given those assumptions, here's a scary scenario: Let's say a hacker wants to kill you, and knows where you live. He builds a transmitter and plants it next to your house, for example behind your air conditioner. The device is configured to 1) detect when you're there, then 2) try to guess your serial number every second you're within range, then 3) kills you.

If the attacker then retrieves the device (so it doesn't fall into the hands of law enforcement), there would be absolutely no way to prove he killed you.

Obviously, this is an incredibly unlikely sequence of events. Nevertheless it IS possible, which is very irresponsible of the medical industry.

<comment><USER5> I've never encountered a community as poor at cost/benefits analysis as computer security. You see it every time when some new "irresponsible" loophole is gleefully broadcast by some smug cracker. There are far, FAR more economical and efficient ways of getting away with murder. I mean, several orders of magnitude easier.

<comment><USER6> Excuse me at being unrealistic, but I like to think that I should not be able to kill someone with a GNU Radio setup and a cheap laptop.

I am not actually afraid that people are going to start doing this, however such flaws and failures in security thinking are _systemic_. Bad security is not limited to insulin pumps, but insulin pumps are a great way of getting the publics attention and (hopefully) getting programmers to consider the impact their laziness could have on the world.

<comment><USER7> _I like to think that I should not be able to kill someone with a GNU Radio setup and a cheap laptop._

If you want to kill someone, there are considerably cheaper options available at your local big-box store's home and garden center.

Seriously, though, I do agree with your concern for systemic problems in security thinking. Given the vastly more concentrated effort required, I don't think it's a problem that one could theoretically kill with GNU Radio and a laptop, versus any of the hundreds of tools more readily repurposed as a murder weapon, but such exploits are best addressed while they are unfeasable.

</comment></comment></comment></comment></comment><comment><USER8> As a diabetic (something few of the posters seem to be) I find this discussion quite interesting if a little wrong in some of its assumptions. The first is the idea that turning off the pump will cause the wearer to expire. In most cases, not true. If you want to (and lets wave our magic wand and enable the hack skipping the tech problems mentioned) kill your target, you are going about it the wrong way. Don't turn off the supply---turn it up, way up. You need to create an overdose based on the size of the individual and their tolerance to insulin. Now without knowing the details of the pump industry, I'd guess that there are built in limiters concerning overdoses. This makes the problem far more challenging, even if you know the individual in question. How often do you discuss with your diabetic friends just how many units it would take to kill them? At a guess, even if you know they are diabetic, this is probably not part of normal conversation. There is also the assumption that the wearer never checks his equipment. In the single photo in the article above, I notice a screen crowded with information. Again jumping over the problems listed both in the article and here, the hack would have to adjust the display so as not to warn the victim. Given the in-ability to decipher the signals transmitted, this seems a bit problematic at best. No, I think the best method of attack is the one with a hammer---'Wow you wear a pump huh? Can I see it (victim looks down to pull up shirt) villain applies Maxwell's hammer as solution.'

<comment><USER9> I helped watch a friend's kid last weekend who has a remote-controlled insulin pump. The remote control refuses to dose without a recent blood-sugar test. Kid wants to eat, no you need to wait, we need to do a finger-prick test first ON the the remote so it knows your glucose level.

That, and the remote needs to establish an insulin baseline every few hours.

It's unclear whether the dose limiting is also hard-coded into the pump or is on the remote side only.

It does seem like a "one in a billion" attack but, given time and repeated access to the pump radio, it seems possible to say the least.

I assume that an adult diabetic is very aware of how glucose levels affect their ability to function and would notice when they start to drop off unexpectedly.

</comment></comment><comment><USER10> The notion that you can kill a person with diabetes by hacking their insulin pump is absurdly ridiculous. I can't think of an insulin pump that does not have a setting to limit the maximum bolus. In addition, the setting typically has a sane value and is enabled by default. Further, when a pump is setup with a doctor/nurse practitioner, this value is set to number that is tuned to the person with diabetes. There is also feedback when the pump is delivering insulin. I know this is the case with Animas and Medtronic pumps.

So even if someone got in range, had your serial number, knew the protocol and attempted an insane dosage, the worst that would happen is someone didn't notice the delivery feedback and hit the max bolus. While this would be worst case breach, it is not lethal. Within an hour, the victim will feel hypoglycemic, check their blood glucose and correct it.

</comment><comment><USER11> I'd have liked a medical approach to this FUD.

Can anyone with more insight than me (medical background perhaps? Or 'experienced' diabetic, since I think this leads to a specific background just as well) tell me what attack vector this could open?

I don't want to play this down, the argument just doesn't match with what I (think to) know, so - please educate me.

Isn't the maximum dose limited by the pump? And the models I've seen seem to take a long time to inject something (with a step motor, for these things).

What could you do to the 'victim'?

Supressing the basal/ongoing rate would send them on a high level of blood sugar, something that I'd expect leads to a very clear reaction: The person, if ~experienced~, will feel nasty, check the pump (maybe the battery died and you didn't hear the alarm. Maybe something with the injection needle went wrong), measure glucose level again and - depending on the result - apply a 'fast' insulin via direct injection. Am I glossing over something here?

Injecting a large(r) amount of insulin would, with a delay that seems to be related to the type of insulin used, send the person into dangerous low levels of blood sugar. Unless this hits at once though, I'd again expect the person to _know_ that there's something wrong if you start craving for every food you can imagine. Probably you'll feel like shit and start shaking etc. pp. I assume this is the more dangerous route, but again the first reaction is probably 'Fuck diabetes, what's going on with my levels', a check of the current sugar levels and direct counter measures (if it's not too bad: Juice, fructose etc. Otherwise you probably have again an injection nearby).

After typing all this I DO wonder what happens if someone causes this in your sleep though...

So - can someone tell me how wrong I am and tell me about the purely medical dangers?

<comment><USER12> Dropping an unexpected dose of insulin would be much more dangerous than simply disabling the pump.

Disabling the pump would result in an increasing level of blood glucose over a fairly long period of time (likely a day or two). I would be very surprised if a 'victim' didn't notice the issue with their pump long before there were any detectable side effects.

Dumping an unexpected shot of insulin into the victim's system would crash their blood glucose over a fairly short period of time (an hour or two). One of the first side effects of hypoglycemia is confusion, which would reduce their chances of noticing something is wrong.

Long story short: I wouldn't worry about "DoS'sing" the pump, but I would worry about triggering extra insulin "dosings".

My experience with insulin pumps is limited to dealing with patients who are having some sort of blood glucose related emergency (as an EMT).

</comment></comment><comment><USER13> I'm much less concerned about vulnerabilities which will allow people to kill me than about vulnerabilities which will enable people to steal my data or money.

There's far more people who want to steal my data or money than who want to kill me, and if somebody _does_ want to kill me and can get within range of me then there's several thousand other ways to do it.

<comment><USER14> You're assuming a mass harvesting in the theft instance, and someone with a personal grudge against you in the second.

I wouldn't be worried about Mysterious Assassin out to kill Pavel Lishin, Diabetic With A Pump. I'd be worried about Teenage Sociopath, war-driving past a clinic.

<comment><USER15> It could happen. Teenage sociopaths exist. But they're very, very rare. You're falling victim to the Columbine fallacy here. TV news makes a poor reference for risk management.

But yes: if this exploit is easy, eventually some diabetic is going to be murdered through it. Far more diabetics will kill themselves via poor diet choices, however.

<comment><USER13> And even the Columbine sociopaths were targeting people they knew, rather than random strangers. Random murderers targeting random strangers are even rarer.

</comment></comment></comment></comment><comment><USER16> The gentlemen who wrote this post takes an approach I'm not comfortable supporting: The signal and commands haven't been successfully reversed engineered yet so this isn't a real threat.

A little bit about my background: 10+ years successfully (legally) reverse engineering software technology that required both client software and packet manipulation in industries that have been very proactive against it.

Seeing as the medical devices are hardware items issued to unique individual recipients the issue could easily be fixed with a 1024+ Public Private Key- Pair between the devices unique to each issuance.

However, this does nothing to protect the many millions of individuals, using today's devices, potentially exposed to the threat described by Jay Radcliffe.

<comment><USER17> It's a little less severe than that. First the device has to support remote management, then the device has to have remote management turned on, and finally the attacker would have to have the device's serial number (which seems to be used as a security mechanism) in order to successfully send the device commands.

Also, if you don't like needles, don't watch the youtube video at the bottom of the post :|

<comment><USER16> This is assuming you only want to control the pump. If the individual is unable to view any information on their monitor, or their monitor is displaying improper data, it may cause other serious health issues in high risk patients.

Not to mention that some devices may be controlled by the monitoring device and it may require a constant stream of good data.

I agree that not all setups and individuals are at risk but some most likely are.

</comment></comment></comment><comment><USER18> I'm unsure where I stand on this subject, but this excerpt from Jaron Lanier's "You Are Not A Gadget" seems relevant:

"There are respectable academic conferences devoted to methods of violating sanctities of all kinds. The only criterion is that researchers come up with some way of using digital technology to harm innocent people who thought they were safe. ...

"If the same researchers had done something similar without digital technology, they would at the very least have lost their jobs. Suppose they had spent a couple of years and significant funds figuring out how to rig a washing machine to poison clothing in order to (hypothetically) kill a child once dressed."

<comment><USER19> Don't people get paid to look for security vulnerabilities in pretty much any engineering field? There are people who work full-time on thinking up ways that a terrorist could potentially rig a chemical plant to release deadly gases, for example.

<comment><USER18> I suppose there are, but I'm not so sure they have fancy open conferences devoted to chemical plant terrorism.

Like I said, I don't know where I stand.

<comment><USER20> Would you feel more comfortable if a few smart people figured out the same things and _didn't tell anyone about it_ , but instead used it for profit or to cause harm to innocent people?

</comment></comment></comment></comment><comment><USER21> To be honest, the facts are kind of boring, and the fear-mongering is kind of dramatic.

I can definitely see how, if they didn't care about the abstract concept of truth, people could prefer to pay attention to the fear-mongering.

<comment><USER9> You're right, it /would/ make for good TV drama: an evil nursing home wants to kick some malingering diabetics off of their rolls in order to make space for newer and more lucrative patients. The management cook up a scheme to hack the patients' insulin pumps in order to kill people quietly in their sleep. Our crack team of hackers is called to the murder scene when an potential victim's relative notices them behaving strangely on a morning when they visit along with an anomalously low blood sugar reading!

Yeah, it sounds a bit far-fetched even for TV.

</comment></comment><comment><USER22> This was the plotline of a 3rd season episode of Law & Order, "Virus". <http://www.imdb.com/title/tt0629490/>

</comment><comment><USER23> The Weekly World News once reported that a new, deadly computer virus could make your computer explode. Seems sort of prophetic now, given the media frenzy. [http://books.google.com/books?id=9ewDAAAAMBAJ&pg=PA40...](http://books.google.com/books?id=9ewDAAAAMBAJ&pg=PA40&lpg=PA40&dq=weekly+world+news+computer+virus&source=bl&ots=2G50Gert-I&sig=zuxQYUAqCz_Lzs7q5qnxTvJapo8&hl=en&ei=kQA8TqKGNuriiAKqkKz0Cw&sa=X&oi=book_result&ct=result&resnum=4&ved=0CDAQ6AEwAw#v=onepage&q=weekly%20world%20news%20computer%20virus&f=false)</comment>