Fold the DOM like paper - <AUTHOR> http://oridomi.com/

<comment><USER3> Author of OriDomi here. Really excited to see this at the top of HN.

I recently pushed out version 1.0 with some new features that make OriDomi easier to use.

It now has an internal queueing system so you can chain up effect sequences instead of dealing with callback handlers. [1] What looks like a chain of synchronous calls will now be deferred and sequenced automatically, e.g.:

folded.curl(50).collapse().setSpeed(2000).stairs(-29).foldUp().unfold();

Secondly, OriDomi elements are now fully responsive, meaning they adapt to changing dimensions caused by media queries, window resizing, etc. You can see this behavior with the demos by resizing your browser, or on the current iteration of my personal site. [2]

Finally, there are two new methods that make it easy to do custom folding behavior and content manipulation, .map() [3] and .modifyContent() [4]. The former lets you pass your own function to define folding based on input angle and panel index.

It's still relatively lightweight with zero dependencies and 7.6KB gzipped and minified. More than anything, a testament to what you can do with the modern browser API.

Looking forward to seeing what else people do with it. Check out the annotated source [5] for a look at how it works.

[1] [http://oridomi.com/#queueing](http://oridomi.com/#queueing)

[2] [http://oxism.com](http://oxism.com)

[3] [http://oridomi.com/#custom](http://oridomi.com/#custom)

[4] [http://oridomi.com/#content-manipulation](http://oridomi.com/#content- manipulation)

[5] [http://oridomi.com/docs/oridomi.html](http://oridomi.com/docs/oridomi.html)

<comment><USER4> This is really awesome, congrats!

</comment></comment><comment><USER5> Lovely work on the annotated source code ... it explains a lot of the tricks and techniques, and makes the otherwise perhaps abstruse math accessible: [http://oridomi.com/docs/oridomi.html](http://oridomi.com/docs/oridomi.html)

<comment><USER3> I owe plenty of gratitude to you for both CoffeeScript and Docco. Both made building this a pleasure.

For those interested in going beyond what the docs cover, the annotated source page is a great place to understand the inner workings.

<comment><USER6> Just curious, why did you check for the existence of "console" on this line:

      console?.warn 'OriDomi: First argument must be a DOM element'

<comment><USER7> window.console is undefined in some versions of IE if the developer tools aren't active.

<comment><USER3> That's right.

</comment></comment></comment></comment></comment><comment><USER8> Funny coincidence, I just started a casual discussion about origami and programming with some friends yesterday:

 _So, my friend Torsten (who is really into papercraft and origami) explained to me the purity hierarchy within the papercraft community._

 _At the bottom is having to cut the paper and use glue in your creations. One level above that is if the form requires only cutting or tearing. Getting more and more pure is the form known as kirigami, which involves cuts but is made from a single sheet of paper as the base. At the top is origami - no glue, no cuts, only folds (although I 'm not sure if there is such a thing as higher order origami), and ideally only one sheet of paper._

 _The comparison with functional programming ( "no glue and cuts" and "no state") is so obvious I'm surprised I've never seen it in the wild - <USER2> because programming has more in common with algebra, whereas origami is geometric?_

Although mostly unrelated to this library, we _can_ conclude that some of the effects in OriDomi should be in a section called KiruDomi. ;)

Actually, from a usability perspective, I see a problem with using those effects, like "twist" and "fracture": once scrambled, it is not obvious from the shape in which way to drag to unfold again, unlike with an effect like "stairs"

<comment><USER9> _The comparison with functional programming ( "no glue and cuts" and "no state") is so obvious I'm surprised I've never seen it in the wild_

Actually, it does occur in the wild ;):

[http://www.cs.ox.ac.uk/jeremy.gibbons/publications/origami.p...](http://www.cs.ox.ac.uk/jeremy.gibbons/publications/origami.pdf)

<comment><USER10> There's also a rich field of algebraic analysis of origami:

[http://www.google.com/search?q=algebraic%20origami](http://www.google.com/search?q=algebraic%20origami)

<comment><USER8> It's always nice to be informed you're wrong in a constructive way. Thank you too!

</comment></comment></comment></comment><comment><USER11> If you're in to origami, check out the Can you fold it-challenge from Tetra Pak: [http://canyoufoldit.com/](http://canyoufoldit.com/)

You get €5,000 for passing the qualification phase. Are you up to the challenge?

Edit: clarification, 10 teams will be selected from the qualification phase for the design phase and awarded €5,000. That's at least how I understand it :) (I am not involved in the competition in any way.)

<comment><USER12> You get 5,000 if you complete the design phase, not the qualification phase. For that you need to complete the qualification phase AND be selected to go there.

</comment></comment><comment><USER13> Edit: Pull request sent (just .coffee as requested).

Looks AMAZING in webkit browsers! Sadly in firefox I get "jaggies" on the diagonal edges due to the lack of antialiasing.

I noticed that adding a transparent outline (outline: 1px solid transparent;) to the class ".oridomi-mask" I smoothed these jaggies. Although they look better they still aren't quite as crisp as webkit.

<comment><USER14> I assume that is because when you add an outline, the whole thing becomes the texture and the texture filtering is better than no anti aliasing it is still worse than properly rendered polygons.

</comment></comment><comment><USER15> I was in the train, I tested it on Safari iOS 7, works great! I love it.

</comment><comment><USER16> Ugh, did I break it?: [http://cl.ly/image/033W3F0b3s1U](http://cl.ly/image/033W3F0b3s1U) It's twist(6). Also, here is accordion(30) on document.body: [http://cl.ly/image/0u0V3Y19342e/o](http://cl.ly/image/0u0V3Y19342e/o) And that's hover in the middle logo section: [http://cl.ly/image/3Y172j1T0P3N/o](http://cl.ly/image/3Y172j1T0P3N/o) That is a nice set of good-looking effects, I hope the project will live on.

<comment><USER3> Author here. Twist and fracture are among the more unconventional, dramatic methods that I left in for those looking for cut-up effects over folding. As you found out, you can even target the body element and the OriDomi will stretch to the window dimensions. That middle portion in the last screenshot looks like a stuck hover state probably due to the fact that you have nested OriDomi instances on the page. Thanks for trying it out.

</comment></comment><comment><USER17> Doesn't work in the latest version of Safari on my Mac. (10.9 Mavericks, latest updates)

Update: Correction, didn't work the first time I went to the link but the second time was fine.

<comment><USER18> That is weird. I'm on 10.9 too and exactly the same happened to me.

</comment></comment><comment><USER19> The horrible aliasing on everything (at least in FF!) makes this a real no go. Everything just looks terrible, and the performance isn't all that good either.

(No IE11 supports at all, I'm hoping it at least runs well in Chrome / Webkit browsers?)

(I hate to be negative, but the aliasing really is quite extreme! Sorry!)

<comment> ux-app jaggies in Firefox can be solved with:

      outline: 1px solid transparent;

added to elements with class .oridomi-mask

It's a hack but it does give nice anti-aliased edges.

Performance is perfectly smooth for me even with the AA hack above on Windows.

<comment><USER19> > Performance is perfectly smooth for me even with the AA hack above on > Windows.

Playing with it more, my performance complaints appear to actually be caused by individual elements losing my mouse when I am clicked down on them and then drag outside of their bounds. This makes it seem like I have to keep re- grabbing things, the end effect is a lot of stuttering as I release and reclick on an element to grab a hold of it ahead.

Purely perceptual, but still nasty.

</comment></comment></comment><comment><USER20> Haha, very cool, great job! Plenty of creative application opportunities!

</comment><comment><USER21> Looks awesome, but it seems like all the examples on the page incorporate a weird "wiggling" effect in addition to the folding. Is it possible to turn this off?

<comment><USER3> Yes. That wiggling is the "ripple" mode I added recently which adds a cascading delay. It's disabled by default when creating new OriDomi instances, but I enabled it for the demos on this page. You can also programmatically turn it on and off:

[http://oridomi.com/#ripple](http://oridomi.com/#ripple)

</comment></comment><comment><USER22> Very nice!

</comment><comment><USER23> Nice

</comment><comment><USER24> Nice

</comment><comment><USER25> It would be awesome if one of these awesome CSS posts would actually test for the features instead of just saying..."IE? SAD TROMBONE FOR YOU!!!!"

<comment><USER3> Author here. OriDomi actually does granular feature tests and has no awareness of what particular browser you're using. While the recent versions of IE do support CSS 3D transforms to a degree, they omit support for the "preserve-3d" transform style which allows the transformations of parent elements to affect their children. Without it, the visual tricks OriDomi does don't work, so the library will disable itself if it finds the client lacks support. Whenever IE begins to support "preserve-3d", OriDomi should start working without modification.

<comment><USER25> Wow. Thanks for responding. You rock.</comment></comment></comment>


Building management for startups - <AUTHOR> http://justcalltony.com/

<comment><USER2> Now that's an idea!</comment>


Online Form Builder for Scaling Businesses - <AUTHOR> https://www.producthunt.com/upcoming/mightyforms <comment><AUTHOR> Mightyforms is just starting out, I am new to Product Hunt, too, so feedback is welcome :) [https://www.mightyforms.com/](https://www.mightyforms.com/)</comment>


Amazon employees plan mass defiance of company communications policy - <AUTHOR> https://www.washingtonpost.com/technology/2020/01/26/amazon-employees-plan-mass-defiance-company-communications-policy-support-colleagues/ <comment><USER2> 340 of over 600,000 Amazon employees! So around 0.05% of Amazon employees? Probably a higher percentage believe that Earth is flat...

</comment><comment><USER3> Bezos pays one set of employees to report on the activism of a second set of his employees in direct response to actions of a third set of his employees.</comment>


Agricultural – fastest growing robotic sector - <AUTHOR> http://www.eetimes.com/document.asp?doc_id=1329273 <comment><USER2> I'm life long friends with with family that owns a 80,000 acre grain and soybean farm, and they looked into drones last year or so for crop assessment, but found it wasn't really effective from either an analysis or price perspective. The drones didn't really have the range or endurance to properly sample the fields (we're talking fields of several square miles each), and the resolution of the camera just couldn't give you the detail you needed. It was basically just a waste.

Perhaps if there were more specific imaging sensors on the drones or something, you'd have something, but a simple visible light camera just doesn't reveal enough info.

<comment><USER3> I would like to have a conversation with you or them to convince them otherwise. I have been operating my own ag robotics company for 2 years and have contracts with biggest ag producers in Canada. 80,000 sounded big but not as big as biggest producers of wheat or corn!

<comment><USER4> I'd be interested in hearing your arguments/use cases for drones over broad- acre properties, we've got(generally wheat) producers here with properties > 150'000 acres.

<comment><USER3> shoot an email to "amirbeta" on outlook and we will have a discussion.

</comment></comment></comment></comment><comment><USER5> I'm doing work in venture capital with a specific focus on computer vision. I've looked into the agricultural robotics topic with some scrutiny. Here are some comments:

* feasibility of this new technology is due to the commoditization of three necessary components over the last few years: cameras (improved immensely in both quality and cost due to the smartphone revolution), drones/UAVs/small satellites themselves, and services like AWS that allow small enterprises to crunch huge amounts of geospatial data at little cost.

* there's good reason to believe that the commoditization of those components (i.e. availability and quality) will increase in the next few years.

* drones of the popular quadcopter type are a mixed bag -- their range is very limited because the batteries required to operate them are very heavy. This is tough because they have to survey huge areas. For large areas, many drones are required, which poses a significant overhead cost. However, what's nice about them is that they can be used with surgical precision: if something looks weird, drones can fly very close to the ground and take high-res pictures.

* conversely, what's nice about UAVs and small sats is that they can capture geospatial data on huge areas much more easily (though in lower resolution).

I think we're generally going to see a kind of two-tier approach, in which a high-altitude machine (a UAV mini-plane, or even higher up, a small satellite) does the broad aerial surveillance, and a low-altitude machine, i.e. a quadcopter drone, is sent out for random sampling to cross-reference the geospatial data, and for surgical investigation of abnormalities. The economic benefits of such a scheme could be quite significant for farmers.

I'm also looking forward to drones with more sophisticated sensors -- for example, heat or IR cameras. These are pretty rare on the market so far. Regrettably, they aren't being commoditized in the way that regular cameras are, so progress on this front may be a little slower.

<comment><USER4> "can capture geospatial data on huge areas much more easily"

What are you referring to as a "huge" area? All the work I'm seeing done with drones has been limited to ~700ha/day, if you've got perfect conditions. Normally it's much less.

What do you think drones with heat or IR cameras are most applicable too? When we've got machinery mounted sensors such as a biomass/NDVI camera or a weed- seeker, and the machinery has to make a pass over the field anyways, why not have those sensors onboard the machine? We're seeing Weed-seekers pay for themselves in the first year of use.

<comment><USER6> That comment was referring to the use of UAVs or small satellites for broad surveillance (but at a lower resolution).

</comment></comment></comment><comment><USER7> See also some of the cool work going on at UC Davis; e.g. a phenotyping robot for reconstructing various plant geometry on the fly:

[http://ucanr.edu/sites/dcslaughter/UCDavis_High- throughput_P...](http://ucanr.edu/sites/dcslaughter/UCDavis_High- throughput_Phenotyping/)

(Disclaimer: relative of PI.)

</comment><comment><USER8> SV ag tech conference at CHM on May 6. If anyone is interested in this, or other agriculture technology. [http://www.svagtech.org](http://www.svagtech.org)

</comment><comment><USER9> I have to point out that this article is not factually accurate. TerrAvion (YC W14), is actually crushing the whole electric drone market and switching people who hold 333 exemptions and own drones to using manned planes for collection tens of thousands of acres at a time.

<comment><USER9> [http://www.terravion.com/blog/the-market-is-speaking- terravi...](http://www.terravion.com/blog/the-market-is-speaking-terravion- collects-more-acres-every-week-than-electric-drones-do-in-year)

<comment><USER10> That's neat to see - I had always expected large vehicles to dominate the surveillance space. Will you guys go unmanned when, 10 years from now, the FAA lets civilians fly Predator like UAVS? Also, what's your perspective on the commercial smallsat imagery market? I've long been of the view that large UAVs will wipe those guys out.

<comment><USER9> Yes, someday TerrAvion might go unmanned, but as a former military drone unit commander, I both look forward to the day and think it is further off than people in the Valley think. We've had the technology for unmanned trains for 60 years and yet when all you care about is price per ton/passenger mile, sometimes an operator is the last part of the labor fraction to take out. Mapping is a similar price per pixel type operation.

Smallsats are cool, but they are really only attacking price and reliability of satellite--they aren't even close to say Pleaides or WorldView3 constellations on performance, let alone matching RapidEye for agriculture.

Regarding the disposition of the civilian mapping data market, I think if you look at what the military did in Iraq and Afghanistan the unlimited defense budgets of the 2000s might give an idea of what civilians of the 2020s will be doing. The satellites mostly got used by division and theater level staff to answer long term questions, say 20% of questions. Hand launched drones, which were ubiquitous in company storage rooms, but not in operations answered a few micro questions say 5% of aerial data needs. The remainder of planning questions got answered by air-breathing aircraft of one type or another. Not sure why the venture community has not largely not noticed this.

<comment><USER10> I think VCs are scared by the sensible business plan and the larger capital costs. Drones also get a pass from scrutiny as VCs get excited about investing in the platform, which allows VCs to project their 100x dreams.

I would guess your biggest challenge is sales - convincing farmers that they need this. Is this true? Also - out of curiosity, what do you fly?

</comment></comment></comment></comment></comment><comment><USER11> True innovation happens in amazing places. I'm really excited to see the future of agriculture enhanced by robots and AI.

One Bay-area company doing awesome stuff, not mentioned in the article, is Blue River Technologies. They make lettuce crops (of all things, lettuce!) insanely efficient with AI and hyper-fast distributed systems computations. This stuff is so cool.

</comment><comment><USER12> How Agriculture Majors Are Going To Save The World [http://www.buzzfeed.com/zjm5066/how-agriculture-majors- are-g...](http://www.buzzfeed.com/zjm5066/how-agriculture-majors-are-going-to- save-the-world-290fe)</comment>


The Functional Web: The Future of Apps and the Web - <AUTHOR> http://blog.quixey.com/2013/03/07/the-functional-web-the-future-of-apps-and-the-web/

<comment><USER2> Your dream about opening apps with URL is already true for many apps. E.g. the URL yelp:///search?terms=karaoke will open the page you used as an example in the native Yelp app on iOS. See <http://handleopenurl.com/> for more examples.</comment>


Everything you need to know to install SteamOS - <AUTHOR> http://arstechnica.com/gaming/2013/12/everything-you-need-to-know-to-install-steamos-on-your-very-own-computer/

<comment><USER2> It's nice to see they started with Debian and not Ubuntu - hopefully some good contributions find their way upstream.

<comment><USER3> Steam GNU/Linux!

</comment></comment><comment><USER4> Well, this guide is great but it doesn't tell me the most thing I need to know: Why should I install SteamOS?

For people new to to this whole Steam/SteamOS thing, who like me have Roku, iPad, and XBox, etc., why a having a box with SteamOS a good thing to have? It currently doesn't have HBO Go, Netflix, or Hulu on it, so not truly a STB that I want. Is it a just competitor to game consoles?

<comment><USER5> If you have lots of Steam games, you can, with a SteamOS box, just play those in your living room like a console if you want. You can stream them from your PC (yes you could do this now with a PC - minus the streaming). It also has a pretty cool controller for better FPS gaming on the couch. This is just the beginning of SteamOS and I am excited for another good nix gaming platform. Apple devices were the first really big nix based game system and that took over handheld.

In the end the SteamOS box might put the beginning to the end of DirectX over OpenGL for PC gaming which is good for more games on nix and mac as it is easier porting. I am excited for anything that starts to make console gaming more like PC gaming and nix based gaming systems focused on OpenGL.

This also moves away from the proprietary console hardware and libs that make that more costly to develop, granted XBox and PS are now x86 based to help that more. SteamOS may help standardize across consoles that anything standard OpenGL/CL etc will be more portable rather than locked to console manufacturers with their high devkit prices and selective publishing.

</comment></comment><comment><USER6> I'd like to know how to install it on an existing partition rather than having the installer wipe the entire drive. Maybe it could be done by installing on a virtual machine and copying the virtual drive to a real partition and then add a boot loader entry?

</comment><comment><USER7> So SteamOS is not affiliated with Gaben or Valve?

I am confuse.

<comment><USER8> What makes you say that? It definitely is a Valve product...

<comment><USER7> I was confuse. I am now happy.</comment></comment></comment>


Slack's Shares Plunge After It Predicts a Larger Loss - <AUTHOR> https://www.nytimes.com/2019/09/04/technology/slack-earnings.html <comment><USER2> _Stewart Butterfield, Slack's chief executive, said in an interview that it would take time for the market to understand his company since it had created a new category of software, unlike soda or cars_

We've had public business software companies for decades, they all created a new "category" of software, why does he think his is something new?

Fundamentally speaking, how is Slack any different to the first email program? The first operating system? The first chat system?

We've had this sort of software, and companies that sell it, for a very long time now.

<comment><USER3> Thanks! I mean it, THANK YOU!

We were using HipChat at a previous company (2013, I think), and I never understood the switch to Slack. I was like: Wait, but what's the difference? Everybody knew about Slack, and no one about HipChat.

I also don't think they introduced a new category of software, they just spent an absurd amount of additional money in marketing. That's it.

<comment><USER4> My company switched from HipChat to Slack around 2015. I won't say hype didn't play into the decision, but IIRC there were two other motivations: 1) more reliable performance, 2) better integrations with Google Docs.

At the time it was claimed that this was really a whole new way to organize data and work. In practicality, not that much changed from HipChat. Pinned items and the ability to rifle back through conversations saved my bacon a few times, but looking back on it, I don't think they outmatch properly-organized documentation and wikis.

<comment><USER3> We were kind of heavily invested in Atlassian stack, which means we used Confluence a lot.

We had a good system for creating and looking for documentation in our wiki system, so I hope that was not a selling point for Slack. Unfortunately we (Tech) never really knew why we switched.

EDIT: Also, on the performance side, we were there for the beginning of both systems, and both had their good amount of issues initially. By the time we switched, I don't remember that many HipChat outages. I remember a lot of Slack outages starting up as well, and these days I have issues with Web interface connectivity at least once a week (native works).

<comment><USER5> I can tell you my experience of having witnessed some companies move to "slack", "Jira" etc. There were multiple similar cases.

It went something like this:

"We are now 'agile'

Ok what are all the cool agile dev ops companies using?

Aha Jira&Slack. Ok let's use that"

From there it gets even more crazy. The tools get included as a standard question for evaluating vendors on RFP's. Vendors that use a similar toolset are rated more highly.

When you question why. The response is along the lines of:

"Oh if they are using Jira/slack/other tool, it must be an agile/dev ops/chat ops shop"

Put another way sometimes these tools end up being used as a "signal" to others rather than intrinsic value. The value is in the signalling, driven by social proof.

If one can pull this of when marketing your product you have a win. Effectively you have associated a movement (I.e agile) with your product (I.e Jira). So the buy decision is driven by the need to show they are doing {x}.

There must be some basis Of this and reading on how this is done? The broad topic would be marketing but what specifically?

Notes:

* This is merely an observation. I am not judging the accuracy of the statement that using a specific product = demonstrating some property.

 __These associations may not be applicable in all markets and I have seen them change over time.

<comment><USER6> equal parts sad and funny

cargo cult driven marketing

</comment></comment></comment></comment></comment></comment><comment><USER7> I don't know enough about the Slack product or business model to comment authoritatively, but I'm really confused how they're losing money (and so much of it) and I sense a bit of "weirdness" around unit economics/user conversion/pricing.

I've long thought that they've essentially built beautiful native/mobile/web clients for IRC-type chats and provide hosting/IRCOp services. Charging per- seat to enterprise seems like a very, very lucrative proposition for this type of product/service.

There are a couple of eyebrow-raising financials:

1.) 100,000 paid users @ $6.67-$15/mo = $667k-1.5m MRR = $2m-$4.5m QRR

2.) 13m DAUs @ $0/mo (free tier)

3.) They lost $30m Q3 '18

4.) They lost $300m Q4 '19 due to 'stock based compensation' (which from my perspective should have been accrued Q4 '15 onwards)

And for all the above... a $5billion unicorn valuation considering chat is a solved problem?

Three major questions:

1\. Has any other SaaS or company in human history ever had a 1:130 ratio of paid:free users with a hard cap of $15 on MRR?

2\. Does quarterly losses between $30-$300m on $4.5m in revenue make sense considering the unit economics of cloud-based chats?

3\. Does 100k paid subscribers seem a bit low for a 6 year old company?

Really weird situation from my "knows enough to be dangerous" perspective and I'm all ears because from my perspective:

1.) There's really not enough innovation or a big enough TAM (considering competitors) to drive a unicorn valuation

2.) Which shouldn't matter because this is still a potentially lucrative market

3.) And yet... they're losing money hand-over fist

Weird, weird weird. Feel free to share your thoughts, I just ask that you consider this message comes from a perspective of "confused guy trying to make sense of these crazy times"

<comment><USER8> > 100,000 paid users

It can't possibly be just 100,000 paid users. That's clearly nonsense. Oracle uses it and they have 80,000 employees alone!

<comment><USER9> Thing is, Slack makes it _far_ too easy for orgs to use it for free.

I work at a megacorp, and we use Slack without paying a single penny.

We have a Slack account setup per project, which typically have 5-50 members. We don't care too much about search or history, we just want a simple chat and audio call solution that isn't horrible to use. Slack fits that bill.

To be clear, this doesn't sit well with me; we should be paying for a service we make good use of - but Slack makes it so damn easy for us to get away with it!

Maybe this is part of some long-term strategy, to basically give it away until it becomes ubiquitous, and _then_ scale back the free tier?

<comment><USER10> I feel like that is an outlier. For most companies the benefits of having all the data logged is worth the cost.

<comment><USER9> Unless a deal is done at the corporate level to get access for all users, at large orgs, it's not just the cost - it's the internal purchasing process. In short, if I was to buy software or pay for a SaaS, it's very, very difficult to do so. I have to raise requests in our service desk, and constantly battle with them for months (yes, _months_ ) to reopen the tickets they invariably close without comment, and spend time chasing random VPs to approve something they have no idea about. In short, I'd rather chop a leg off than waste so many frustrating hours on it.

</comment></comment></comment></comment></comment><comment><USER11> I'm sorry but comparing it to Uber is highly misrepresentative. Uber has serious Cost structure that can not be removed: the cost of the driver is essential to the operation of it's busienss. Slack on the other hand is just a SaaS. Why are their costs so high? They said stock based compensation, but that doesn't begin to tell what it's for. Their user acquisition costs don't need to be really high, as far I know they started off with a great deal of virality and without too much paid acquisition. Between then and now, what happened? Naive question: Couldn't they simply cut most of their engineering/marketing and be wildly profitable?

If I were to take a wild guess, I'd say it was they tried to grow too quickly and overspent on marketing, getting a barely decent ROI on ad spend.

<comment><USER12> The stock has also bounced back already, so the headline is no longer accurate.

</comment></comment><comment><USER13> >> Revenue rose to $145 million from $92 million a year earlier. Slack said it had more than 100,000 paying customers, a 37 percent increase over last year.

They should be fine. $307m of the loss was stock-related compensation.

How could you screw up a business who has a product as popular as Slack?

<comment><USER2> Might say the same about ICQ, Skype, Messenger, etc.

All communications platforms so far have come and gone in vogue.

I remember in 2005 when everyone in our office communicated over MS Messenger.

Maybe Slack is to instant messaging as Facebook was to social networking and will get some longevity. But it's too early to tell yet.

<comment><USER14> I use Skype daily and have never had a problem with it, I've never understood the hate if i'm honest.

<comment><USER15> The Skype of today is crap compared to the first Skype I used and loved. It is completely unclear what it tries to be now and the interface is horrible.

I have an unlimited-Europe plan with it and a phone number attached to it, but I'd rather use something else some day. I haven't found any cheaper alternatives though. Maybe someone here can point one out to me.

<comment><USER14> > It is completely unclear what it tries to be now and the interface is > horrible.

Instant messenger, internet phone and video/presentation conferencing.

Am i missing something here because its literally my primary business communication tool.

<comment><USER15> It isn't aimed at being a good business communication tool though. It has a strange design that obviously tries to be cool and hip, but lacks proper visual hierarchy and contrast. It is hard to use if you aren't tech-savvy. My mother ends up calling me on Telegram of all things because in her mind Skype isn't something you call with anymore. Even though I then call her on Skype because Telegram doesn't have video. She used to have a Skype-phone (physical unit), but support for that has died out pretty quickly.

</comment></comment></comment></comment></comment></comment><comment><USER16> I'm surprised investors aren't more scared of the competition, particularly Microsoft and its Teams product that is part of Office 365.

Maybe it's not a huge deal because the overlap of Slack customers and Office 365 customers isn't that big?

<comment><USER17> If they can fix teams so everybody who uses it doesn't hate it, I'm sure they'll absolutely dominate.

<comment><USER18> There is also the possibility of Microsoft buying Slack to fix Teams.

<comment><USER19> It's very unlikely considering they thought about doing that a few years ago.[0] I don't think they'll rapidly push forward with adding features characteristic for Slack as well. Teams is just yet another corporate tool that is easy to sell to existing customers of Office 365.

[0] [https://www.businessinsider.com/microsoft- canceled-8-billion...](https://www.businessinsider.com/microsoft- canceled-8-billion-slack-bid-due-to-bill-gates-and-satya-nadella- pushback-2016-3)

</comment></comment></comment></comment><comment><USER20> Leaving aside the costs of their listing and related compensation (which are crazy high!) they made a $57m loss on $145m in revenue.

Considering that they are a pure software company this is quite shocking and, to me, a sign not to touch them with a barge pole.

<comment><USER21> A business that's doing great can have numbers that look like this if they're investing heavily in growth. In that case, they're losing money deliberately—if they wanted to, they could optimize for profits and be making money, but at the cost of growing slower and presumably sacrificing greater profits in the future. If you're a shareholder, you probably don't want that.

I don't know whether Slack is in this position, but simply looking at revenue and losses doesn't give you enough information to judge how well they're doing on its own. You need to look at things like CAC and growth rate.

<comment><USER22> That's always the excuse. It's an outlier when it happens.

<comment><USER23> Slack's Denver office very recently came online and I know a ton of colleagues who were hired in their sales department.

<comment><USER22> If they need to hire aggressively for sells that means their customer acquisition costs are about to increase and there are still doubts about how deeply they can get into large enterprises where the lifetime value of a customer will be worth it.

Also, selling into the enterprise is a long slow process.

</comment></comment></comment></comment></comment><comment><USER24> Slack's long-term value prop isn't chat, it's the platform. If you've used any of the great bot apps it hosts (PTO Ninja for example), it's easy to imagine a future where these kinds of apps replace whole swaths of bloated Saas-ware. I'm excited to see more of these and a competitive eco-system emerge within Slack the way Apple built the app store. Slack should invest heavily in building a platform for developers if it wants to grow, if it can pull this off it's going to look a lot more like Salesforce.com in 5 years where whole industries are built on its back. This is also the moat they have against MS Teams. Microsoft hasn't been as successful in building wildly productive developer ecosystems since the Windows 9X days.

<comment> brown9-2 I think some people are wildly overestimating how much of management or timekeeping style apps people want to use inside a chat interface.

</comment></comment><comment><USER23> Slack is back up at or above where it was at end of trading hours yesterday. It plunged after-market, opened at $26, and is back near $31 again now. NYT should just start using AI to write negative articles about tech companies when their stock swings more than 5% and put their journalists to better use.

</comment><comment><USER25> I get that they are the most obvious comparisons for recent IPOs, but it's disappointing to see Slack being conflated with Uber, Lyft, and We, none of which have a remote chance of ever making more than a razor-thin profit in their respective industries. Whereas Slack is a SaaS company, with the real potential (whether it's likely or not) to become highly profitable down the road.

<comment><USER26> If they can figure out how to get cash out of the gigantic amount of people who use slack without anyone paying for anything, it'll be phenomenal.

Really hope the answer isn't ads!

<comment><USER27> Slack doesn't seem to be the sort of company who will go with an Ad strategy for monetisation.

A number of free users upgrade over time by upgrading their free account or by highly recommending Slack at their workplace.

<comment> dorian-graph > Slack doesn't seem to be the sort of company who will go with an Ad strategy > for monetisation.

I feel like I've definitely heard that said a few times before.

</comment></comment></comment></comment><comment><USER28> I just wish they had not acquired Screen Hero. That was a beautiful standalone product that I wish I could still use.

<comment><USER29> Screenhero cofounder here. I'm working on a successor to Screenhero. It's currently in private beta: [https://screen.so](https://screen.so)

<comment><USER30> Interesting, so the acquisition agreement did not have a non-compete clause or golden handcuffs to Slack? If you don't mind me asking, how come you left Slack?

<comment><USER31> (I'm not affiliated with either Slack or ScreenHero. But I loved ScreenHero.)

It would be common for an acquisition agreement to shackle the founders with non-competes. It would also be common for those non-compete clauses to have limited durations. (I have seen 2-3 years in documents.)

Slack bought ScreenHero over 4 years ago. The non-competes have likely expired.

</comment></comment></comment></comment><comment><USER32> Slack feels like employee surveillance beyond the chatting capabilities

<comment><USER33> Are the alternatives any better? For instance is discord protecting your chats?

<comment><USER34> Mattermost, IRC, etc.

<comment><USER33> IRC is great, but I've never thought of it as protecting my privacy. It's definitely public and almost always logged by a myriad of bots if not the server.

<comment><USER35> You can run your own server.

</comment></comment></comment></comment></comment><comment><USER36> Slack is overrated and over priced. Its not like messenger platforms are difficult. We have had msn messneger, yahoo messenger, whatsapp, rocketchat, facebook messneger, messenger, gchat, skype. Slack doesn't do anything particularly special.

<comment><USER27> I disagree. Slack is not just about chat, they are about communication. We moved from Skype to Slack and it was incredibly different for us.

Open channels meant - more transparency and anyone can join and contribute. All those hella bots are extremely handy.

Overall, i would say we became more transparent, focussed and it made communication across a single company SIMPLE.

<comment><USER37> I've heard it described as having IRC channels with skype capabilities

<comment><USER38> > with skype capabilities

I'd be interested to know the stats on people using the video feature. My experience is that companies on slack primarily trust Hangouts and Zoom more than Slack for video conference.

</comment></comment></comment></comment><comment><USER39> I don't understand. They are already back up. Is this even relevant anymore?

</comment><comment><USER40> Slack is essentially an IRC. IRC is pretty much dead nowadays, Slack is just the same concept but with a cloud integration and a modern client. It is neither new nor a particularly good implementation, discord is faster and better as a communication tool and possibly more clones are coming. The only lucky thing for Slack is that it was in the right time in the right place and introduced 30 year old concept to the corporate folks - but this advantage can go away anytime.

</comment><comment><USER41> One of the most useless product of our generation. The fact that they believe themselves that they make "work happen" is a level of self-koolaid-drinking that I rarely saw even in Silicon Valley. I'm happy that the stock is plummeting.

</comment><comment><USER42> Well if they'd just implement dark mode or a dark theme on desktop...

<comment><USER43> You can hack it in

<comment><USER44> Been waiting years for official desktop app dark mode support. The lack of it is sheer stupidity, considering they have dark mode in the iOS Slack app.

</comment></comment></comment><comment><USER45> It'd be really interesting for Slack to go the Atlassian or Microsoft route - acquire companies that solve adjacent problems, and then bundle the products to enterprise customers. The sales get harder to ignore, and it'd make Slack as a company even stickier.

A couple things come to mind, like file sharing, calendar & room management, project management (around tasks, mainly), VoIP integration for sales calls, and maybe even _gasp_ email.

<comment><USER46> I think this is their strategy, and I think what's more they will want to solve these things vertically 'on top of' slack as plugins and apps. They started filling the pipeline for this a while ago by literally funding startups building such things. Acquiring some of the more popular ones is surely one of the goals, should this work out.

</comment></comment><comment><USER47> New category of software? Such a statement shows how disconnected leaders can be from reality.

Collaboration and communication software has existed basically since computer networks exist. More specifically icq, MSN, even Skype falls into the same category of software...

They created a succesful startup - a lot of kudos for that. The company, as so many others this year, fails to proof itself in the public market.

</comment><comment><USER48> Earnings run-up aside, it's only down 7% or $2 from this past Friday. That's a lot, but not in comparison to it's drop since IPO.

</comment><comment><USER49> Good! Slack product managers are arrogant and the product is garbage. Lots of dark patterns.

</comment><comment><USER50> Seems even nytimes reporter is embarrassed by what slack actually is (chat app) calling it "business software".</comment>


Has Silicon Valley Lost Its Edge? - <AUTHOR> http://www.investmentu.com/2011/March/has-silicon-valley-lost-its-edge.html

<comment><USER2> Not for software financing, almost all of the funds I'm applying to are in the valley - and I live in Canada... the place still has pull.</comment>


Agile vs. Waterfall: Is Agile Web Development All It's Cracked Up to Be? - <AUTHOR> http://www.econtentmag.com/Articles/Editorial/Feature/Is-Agile-Web-Development-All-Its-Cracked-Up-to-Be-124547.htm <comment><USER2> Is this for real? The introduction reads like a parody of Agile-fandom.

There were decades of non-waterfall design processes before the Agile Manifesto.

Steven McConnell's 1996 book "Rapid Development" describes the major ones (prototyping, iterative development, etc.) in detail.</comment>


Ask HN: I Am Stuck Between A Rock & A Hard Place. What's Next? - <AUTHOR>

I am in the process of creating a web based service for small businesses. So, I went out and got feedback from as diverse a group of people I could find within my immediate environment (I live in India).
The feedback I got was troubling to say the least. The thing is that although after an extended conversation and repeated cold calling people understood and appreciated what I was trying to offer. They're still refusing to use it in a small private alpha. Why?
The thing is that I am asking them to store their financial records with me and, although privacy is not an issue, they are worried about tax. In fact, they have an elaborate culture in place to tackle just this. This ranges from bribes, destruction of all financial records at the end of the fiscal year to purposeful inventory mismanagement to throw off the sales data. For example, if they got ten boxes of something they'll put in 5 and keep the rest black.
Since, the paper trail is huge and the honest tax authorities like to trap big-wigs. they get away with it. So, if they opt into my service in the longer run the noose tightens on them. The obvious way out would be to encrypt the database and allow for regular erasures, but that undermines the core benefits of my service.
Moreover, I intend to stick around for a while. So, it's pretty inevitable that I'll have a messy legal situation on my hands down the road. The precedent has already been set and it's disturbing to say the least (see: http://knol.google.com/k/david-sarokin/google-ordered-to-reveal-blogger/l9cm7v116zcn/7# ).
It also doesn't help my cause that I am still a teenager. It's quite obvious to everyone that I cannot possibly know what I am talking about. It's a trivial issue, but it's amazing how such things tend to bias conversations.
So, any tips on what I should do?
Thank you. <comment><USER2> _So, any tips on what I should do?_

Find a co-founder, preferably someone who is a) not a teenager, and b) exudes enough gravitas to convince prospects that you guys know what you are doing.

The other things you might want to do is to meditate a while on your value proposition. If your potential customers are telling you that external factors (such as the desire to keep data off the books) are large enough to render the benefits of your service moot, you need to take that seriously. There are a number of ways out of that conundrum: increase the benefit of using your service, so that it outweighs the negatives (of potential exposure to the authorities); alternately, find a way to mitigate the negatives (i.e., a higher level of security/deniability, that would allow people to maintain their current practices); or, pivoting to another related idea that does not have the complications fo this one.

</comment><comment><USER3> Don't be disheartened. You came up with a product, and it does not fit your market (tax cheats, apparently).

I would search for customers who do not have such a problem with being honest about their financial situation.

You don't want to get into the business of helping people evade tax. That's a good way to spend a long time in prison.</comment>


Teen Reported to Police After Finding Security Hole in Website - <AUTHOR> http://www.wired.com/threatlevel/2014/01/teen-reported-security-hole/ <comment><USER2> In high school I was blacklisted from an admin position for demonstrating that you could write in Digital Command Language a program that simulated the login environment, stored login attempts, and then after three tries exited to the real login environment to let the user in. In college I was nearly expelled for just mentioning to the IT guys that they didn't have a password on some database, and I could get in with just telnet. These attitudes haven't changed much since 1990 at least.

<comment><USER3> Funny enough, I did the exact same thing when I was in high school, only we were running Novell on NT4 and I did it in basic and started it from autorun.bat which loaded before the network login screen.

It would let you try one time, tell you you entered the wrong password (saving it to file) and exit, at which point windows would load the novell login screen that looked exactly the same.

Good times.

<comment><USER4> Hah! Exact same thing, I used... Borland Basic, IIRC, to build the executable that I called from autorun.

I collected many passwords - I never used them or intended to, I just wanted to see if I could do it.

I made the classic mistake though - I told someone about it. A few days later word got around. I was suspended for a week and was banned from computers for the rest of my time there.

Edit: Now that I think about it (I haven't in years): What kind of response is that? Someone shows some creative thinking and does so in a way that is obviously[1] quite naive/without ill intent. While I understand that you want to discourage the specific behavior, perhaps steering the culprit to use talents with more foresight would have been a better answer.

[1] Looking back, I was something of an asshat in the personal skills department so it's entirely possible that they simply didn't believe my lack of nefarious intent.

<comment><USER5> Actually, I doubt it had anything to do with your personality (and if it did, shame on the authority figures - and the same is true if they were reacting to being made look foolish). No, instead I imagine this was a pure security play: you had a bunch of passwords, and you hadn't done anything with them _yet_. But they would have had to believe that (and chances are they had no way to independently verify this) and in addition that you would _never do anything with them in the future_. The second claim is rather tougher to believe than the first.

So in the simplest possible manner you became a "known threat", and they dealt with you in the simplest possible manner, digital ostracism.

Now we can all tell the alternative story, about the wise teacher who sees something special about us in the misdeed, and who takes the time and the risk to cultivate that positive seed rather than throw the baby out with the bathwater, so to speak. Our very own Mr. Miyagi to safe us from a misspent youth, and who understands our behavior as an expression of exploration ignoring limits, outsmarting the system, rather than your basic mean-spirited destruction for no reason. (Although tagging and hacking do share many qualities, and both are driven, I think, by a young man's desire to prove himself, and yes, even aggrandize himself as someone special - bold, clever, crafty, and someone who can't be "kept down by the man". Rebellious, but also desperately needing to prove himself.)

(Of course in this story the Mr. Miyagi would have hacked onto your personal systems, encrypted the passwords you'd stored, and then left a personal message notifying you that if you wish to understand what he did and how he did it, he'll meet you after school in room 10 for a primer on _real_ hacking.)

</comment></comment></comment></comment><comment><USER6> I was put into isolation for three weeks during high school when I was found to be hacking my way through the network. In reality I had found access to the remote server through the winword.exe open dialog that didn't require passwords and was displaying in the list of network drives, but didn't in explorer.

Because I found this, I was able to find the RM _(Research Machines)_ Management Console and use a teachers (actually the deputy head) password "teacher" (no word of a lie) to create a hidden admin user in the list of student accounts. Through this I could get to RM Tutor 3 which allowed me to control every PC in the school.

I was gathering information to give to the IT staff, but I was grassed on instead, so I was in the wrong. I spent 3 weeks explaining everything and how to fix it, then I was allowed to continue my quest so long as I asked permission and gave info straight away rather than hoarding it.

Apparently if I had denied it they would've got the police involved, but I was honest and upfront when they asked me.

My brother started the same school three years ago (I've been gone for 8 years) and I was still able to access a few things with the remote panel — after which I alerted the school to it. _I don 't think they were best pleased to hear from me..._

<comment><USER7> > Apparently if I had denied it they would've got the police involved, but I > was honest and upfront when they asked me.

The problem is that this is usually a terrible gamble to make. I'm glad it worked out for you, but my general advice for anybody else would be _not_ to talk to the administrators, the same way you should never talk to the police.

You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it _without_ already having a confession from you.

<comment><USER6> > You never know if they're going to involve the police anyway after you spill > the beans, and if they do, you'd rather they do it without already having a > confession from you.

I was definitely worried about this, but I figured that if anything, I've not lied to anybody, so I'd be happy with myself.

<comment><USER7> > if anything, I've not lied to anybody, so I'd be happy with myself.

Unfortunately, that's not the way police encounters work in practice. Even if you've done nothing wrong, talking to the police can really only hurt you. For example, this re-enactment is based on a true story in which an old lady in Baltimore was convicted of drug possession because some neighborhood children had left a dime bag under her sofa (which she didn't even know about) [https://www.youtube.com/watch?v=s7RYH8Py6lY[0]](https://www.youtube.com/watch?v=s7RYH8Py6lY\[0\])

Just because you think you've done nothing wrong doesn't mean others will agree, especially when it's their _job_ to think you're guilty.

[0] This is part of an hour-long video which shows several more cases like this, but for some reason I can't find the full version anymore.

</comment></comment></comment></comment><comment><USER8> It's definitely more harmful long term to arrest rather than reward. Arresting people for reporting security vulnerabilities only causes the people whom would do so reluctant or even afraid of the repercussions. Meanwhile those who exploit maliciously will continue to not report their findings. If I was to find a security vulnerability in a site I frequent, I'd most likely stay quiet about it out of fear of legal ramifications.

<comment><USER9> After such a motivating action from the govt., they'll simply sell the vulnerabilities for some BTC to someone else.

</comment></comment><comment><USER10> ...and now, all future holes in that site will be sold instead of reported to the owners.

I'm fine with that.

<comment><USER11> The problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result.

This is bad news for everyone who runs a website.

<comment><USER12> This is why you should have a page describing your security reporting process.

> (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) > respond promptly with a "security flaw ID".

[https://news.ycombinator.com/item?id=640367](https://news.ycombinator.com/item?id=640367)

</comment></comment></comment><comment><USER13> This seems to be the state of society we are in: If somebody uncovers a problem that exists, he is reported to the police. But if one organization spies on everybody and uses the data in irresponsible ways, they are promoted.

I have no doubt, that the coming generations will have big difficulties to distinguish between right and wrong.

We don't have the problem now with single fallen states, but with a fallen human kind.

</comment><comment><USER14> And thus, once again, it's proven that full _and anonymous_ public disclosure is the only way to notify website owners of their vulnerabilities.

<comment><USER15> And every time that happens a bunch of apologists appear shouting "Why didn't they inform the site operators first? That is really irresponsible"

And then some poor teen believes it and thinks "maybe it's wise to inform the site first" and subsequently goes to jail for doing the 'responsible' thing. And so the cycle continues.

<comment><USER16> Wouldn't combining the two tactics be the actually responsible thing to do? Inform the operators anonymously, and tell them that in four weeks a copy of this e-mail will be publicized.

<comment><USER17> Because that might seem like blackmail to some people...

<comment><USER18> You definitely have to phrase it kindly and explicit and be open for other options of how to proceed. Otherwise, the point of staying anonymous is to protect oneself from unnecessarily enraged admins or other responsible people.

</comment></comment></comment></comment></comment><comment><USER19> When I first read _The Cuckoo 's Egg_ by Cliff Stoll, I was wondering if anyone would think to criminalize connecting something to the network that had no protection. So instead of throwing teenagers in jail, they would make an example of systems administrators. Perhaps that would have quickened the advance of internet security awareness.

At one time, there was a law in Minnesota that it was a misdemeanor to leave your car unlocked in a public place, so the idea is not totally without precedent.

<comment><USER20> There are similar laws in many other jurisdictions.

I think there should be a digital whistleblower law to protect people who report such things in good faith. It should include a clause to make it negligence to ignore such a valid report.

</comment></comment><comment><USER21> In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff.

I was thinking of writing an email to the IT, but fuck that. I'm not paying for someone else's mistake.

<comment><USER22> Send an anonymous email or other notification to them? I agree it's scary to be penalized for "hacking" the system (in their eyes), but I also think these things can't be left alone. It'd be cool if you found a way to let them know.

<comment><USER23> What's an anonymous email? Even Tor is subject to tracking if the endpoint IPs are monitored [1].

The issue of anonymous disclosure is a real issue if you don't

Why do you think Wikileaks was such a big/new deal?

[1] [http://www.forbes.com/sites/runasandvik/2013/12/18/harvard-s...](http://www.forbes.com/sites/runasandvik/2013/12/18/harvard- student-receives-f-for-tor-failure-while-sending-anonymous-bomb-threat/)

<comment><USER22> Lol, you've never opened a gmail account using fake data and sent from there? Yahoo? Hotmail?

The FBI will help your sys admin investigate a bomb threat, obviously. Reporting a security hole will unlikely draw their interest. Yes, just using a fake gmail account is tracable without more protections (like correctly accessing Tor). Again, I doubt the FBI is going to investigate.

But hey, I'm all for paranoia and extra caution.

Plus, rtfa you linked. It says clearly in the first few paragraphs that Tor did NOT fail this guy, but that he's an idiot in how he accessed it.

Lastly, as mentioned, send an anonymous letter. It's not hard, kids!

<comment><USER23> If what you're reporting is significant enough to threaten the livelihood or reputation of people important enough, they can and will find a way to trace you via your fingerprints/IPs … or do you think Google won't simply roll over on you when they get a subpoena/warrant?

<comment><USER22> I already gave you the answer. Send an anonymous letter. Done.

</comment></comment></comment></comment></comment></comment><comment><USER20> _In the U.S., hacker Andrew Auernheimer, aka "weev", is serving a three-and-a- half-year sentence for identity theft and hacking after he and a friend discovered a hole in AT &T's website that allowed anyone to obtain the email addresses and ICC-IDs of iPad users._

I don't understand why weev is mentioned in the same article as this teen. Weev was allegedly discussing the practicalities of making money through fraud using the information he obtained. It's almost certain he wasn't wearing a completely white hat. This teen sounds like he was doing the proper white hat thing, but then got reported to the police anyhow, at least according to the information provided in the article.

<comment><USER24> You beat me to it. The weev paragraph was a total non sequitur; he wasn't arrested for pointing out their lax security, he went down for attempting to profit from it.

</comment></comment><comment><USER25> Disclosure DOs, Disclosure DON'Ts

A 30c3(30th Chaos Communication Congress) talk by Nate Cardozo(a lawyer) of EFF.

[https://www.youtube.com/watch?v=oSi6PxVBOx4](https://www.youtube.com/watch?v=oSi6PxVBOx4)

My take on it? Don't do it, You will gain nothing and can loose everything.

</comment><comment><USER26> (DEVIL'S ADVOCATE)

Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intranets, people's computers, etc. It's best to pentest as a professional, with willing victims or wait for a "pentest" contest.

<comment><USER27> > Am I allowed to go to businesses and try to pick the locks, look inside, and > then report to the business owner that their lock was pickable? Well... yes, > but I'd probably be reported to police.

Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish people with honorable intentions vs. those without, why risk telling them?

If you tar the helpful with the same brush as the crooks then you shall always learn the hard way from your mistakes.

<comment><USER28> The articled states that the kid used SQL injection techniques to access the site and gauge the vulnerability.

<comment><USER29> It's perfectly possible to accidentally stumble across SQL injection.

E.g. my street address growing up was 1901 Mayor's Road.

<comment><USER30> Yeah, I had a hard time with my street address: 5987 O'Drop Table users; Go

</comment></comment></comment></comment></comment><comment><USER31> I'm most shocked by the fact that the news agency reported the white-hat. I thought revealing a source was looked down on in journalism.

<comment><USER32> Where do you see that the paper gave them the kid's info? All I see is he contacted them directly, and no indication that the followup from the paper is where they got his info.

<comment><USER33> >When The Age called the Transportation Department for comment, it reported Rogers to the police.

Last sentence in the third paragraph.

<comment><USER16> I assumed that "it" refers to the Transportation Department.

<comment><USER34> It went like this. Kid didn't get a response from PTV, so he contact The Age. The Age went and called PTV to call them out. PTV responded to The Age and then stupidly went "whelp we have no choice but to notify the Police".

</comment></comment></comment></comment></comment><comment><USER35> Back in high school I found a vulnerability in the website of a major online DVD retailer.

I notified them about it, and included information on what specifically was wrong, the impact it had (over 6 million credit cards, social insurance numbers, addresses, full names, and telephone numbers), and they hired me to help them fix it.

I often look back on that event and am quite thankful for how it turned out. I've read about plenty of stories where the person who found the vulnerability was not as fortunate.

</comment><comment><USER36> The article isn't to specific but they imply he used SQL injection.

It's pretty simple people this is against the law in most countries. SQL injection, default passwords, remote injection are illegal.

The big thing for me is not what happened to him but young people thinking this is legal. Why didn't he try and be anonymous?

Don't care whether it should or should not be legal to hack sites but how could he not know it was illegal? (I guess that's slightly rhetorical, he was 16)

</comment><comment><USER37> A lot of these kind of things we seen in news these days is a result of a highly networked society colliding with a hierarchical administration/governance system.

A typical college management or government is designed to take orders from top. A persons ability to make decisions and process information is not often correlated with this position. But in this real world a 16 year old can beat a 50 years on basis of pure merit. As a society we are adapted to it but governments and management practices haven't. So when a teen calls up to report a security hole the lower level of administration panics.

</comment><comment><USER38> Clearly, the government department is wholly responsible for putting up a rubbish website, but from another article on the story, _" He first contacted PTV by email on Boxing Day.."_. I wonder if the "white-hat hacker" didn't time his notification quite intentionally knowing there was a much lower probability of action being taken promptly. If they'd just patched the security hole he wouldn't get any exposure. It makes me wonder if there's more to this story than we're hearing - that he actually found the security flaw much earlier and sat on it for a while for example. Or that he downloaded all the available information first.

As ever, a couple of short articles may not be giving us the big picture.

<comment><USER39> By that logic why would he even bother reporting it and have security experts poking around the logs and potentially find traces of his download.

Personally i would have sold it to the highest bidder. Being "white hat" gets you in trouble more often than not.

Il stick to "gray hat" thank you very much. If i ever choose to disclose any vulnerability to the owners i will not reveal my identity and after arbitrary amount of time say... (1 month) if it's still present sell it to the highest bidder let them deal with the consequences.

You have to be strict when teaching people and this is no different. If you let them set the rules they could choose and unreasonable length of time like 1 year before they allow you to disclose anything.

You are the one in the position of power never let them take that away from you. By revealing you identity you give away all your power.

If you're not a threat people don't take you seriously.

<comment> mike-cardwell Your statement:

      Being "white hat" gets you in trouble more often than not.

Is beyond absurd.

<comment><USER40> I would argue that your reply is the one that's absurd. Why is the quote you mentioned unreasonable?

<comment> mike-cardwell Because "Being white hat gets you in trouble more often than not." is so obviously untrue to anybody with even the vaguest relation to the industry. It implies that more than 50% of the time, when you disclose a vulnerability responsibly you get in trouble. When it's more likely much much less than 0.1% of the time.

People getting in trouble for reporting vulnerabilities is highly rare. Show me 100 cases of it, and I'll still tell you it's rare.

<comment><USER39> Most of the industry wouldn't characterize themselves as "white hat" just ask them and they will say their more "gray hat" then white hat.

At least in private anyway if you ask them in public their force to keep up appearances.

Now we can argue about the percentages all day but you have to agree being "gray hat" and keeping the power on your side by not exposing your identity is the safer way to go about it unless you want bragging rights which is whole other level of psychology.

I'm not after the attention I'd rather be the guy who nobody notices.

</comment></comment></comment></comment></comment></comment><comment><USER41> It's about time for legislation making it a crime to report whistleblowers to the police and a criminal offense to search or seize their equipment. Perhaps an independent review body could be set up to arbitrate these situations?

<comment><USER42> It should never be a crime to report something to the police.

It should be the police's responsibility to make a decision about whether reports should be followed up or not. We should hold the police, prosecutors and the courts culpable for making reasonable judgements here, not random uninformed members of the public.

<comment><USER43> "It should never be a crime to report something to the police."

I am not sure about that:

[http://www.wired.com/politics/law/news/2008/02/blind_hacker?...](http://www.wired.com/politics/law/news/2008/02/blind_hacker?currentPage=all)

<comment><USER44> False reporting is already a crime, and I think it's fair to assume that by 'something' (parent (parent)) meant 'a crime', rather than assuming that he meant false reporting should be made lawful.

<comment><USER43> Finding and reporting a security problem should not be a crime; neither should whistleblowing. Sending the police after someone who demonstrates your incompetence or corruption should be a crime.

</comment></comment></comment></comment></comment><comment><USER45> While I agree that the websites response and the response of many organizations is overly harsh and draconian in situations like these, if the teen in the story did use SQLi to exfiltrate 500 records then he crossed the line. He should have just shown that the vuln existed without pulling customer data. If the organization pushed back and said it didn't see a problem, then he could offer to write a proof of concept to pull that data, but to just go from discovery to pulling credit card data is a bad move on his part.

</comment><comment><USER46> A lot of comments here:

\- complain how white-hat practice are not well understood;

\- advise to report, but anonymously.

It sounds like a simple enough website to set up. It would encourage script- kiddies to report anonymously, send a warning to the right person, and include explanations — maybe free best practice tips and references to known security professionals if necessary. Now that Scheider is in the news, his name could help reassure uninformed admins that this is not a racket.

I'm not a coder, and the furthest thing from a security professional, though.

</comment><comment><USER47> To me this is really weird. If a neighbor knocks on your door to tell you that you forgot the keys in the keyhole outside you thank him, you don't call the police...

<comment><USER28> This is a bit different and would be like the neighbor opening the door and waking into your bedroom to tell you.

<comment><USER14> No, the kid didn't log into the website and make some postings to their internal communication systems (forums, email listings, etc). He attempted to contact them through official channels but was ignored.

After that, he went to the local news agency. This is totally different.

<comment><USER28> OK, so he went into your room, you weren't there, and he came back to knock on the door to let you know he went to your room to find you. It's close enough.

Edit: I just want to clarify that I don't think the kid should be prosecuted, but I also don't like the fact that he went as far as to check for sensitive information inside of their system.

<comment><USER48> It would be like a passerby finding your door continuously wide open, stepping into your foyer and shouting to let you know, you weren't there or didn't respond, so he told your neighbor to tell you. Then you call the police because of trespassing.

</comment></comment></comment></comment></comment><comment><USER49> It's sad but most people would rather you didn't tell them about a security issue. until they get hacked and then they wished someone warned them prior.

</comment><comment><USER50> I think the difference lies in finding the security hole and testing the security hole. In most of the cases that the hacker is persecuted, the hacker has tested the hole, i.e. downloaded data illegally.

If the hacker simply notified the people responsible before retrieving any data, I don't think that the hacker would be persecuted.

</comment><comment><USER51> I wonder how it would go if you went to the police, showing them a website which displays tens of thousands of customers' personal data, and tried to get the website owner busted for violating privacy legislation?

</comment><comment><USER52> And the Streisand effect occurs again...

</comment><comment><USER53> Perhaps he will get medal from security officers, that is why he was reported... Oh wait...

</comment><comment><USER54> Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

<comment><USER55> Physical metaphors DO NOT WORK in this scenario. This is not a house or a car or commercial warehouse or anything else... it's a website. There are far too many _relevant_ differences between physical locations and web sites for metaphorical reasoning to work.

<comment><USER20> _Physical metaphors DO NOT WORK in this scenario._

Well, we need to know more about the particulars. It says it was SQL injection. It's entirely possible, given the limited information, that he just sent a correctly crafted GET request. In that case, a more apt analogy would be a warehouse where stepping on a particular part of the sidewalk unlocks the door.

</comment></comment></comment><comment> guard-of-terra Always pastebin it on reddit anonymously.

And if you care about users' private data being leaked, said users can always use the assassinaton market to dispose said sites' admin staff.

I'm dead serious on both point. I would love to see somebody die a violent death over such shit as exposing user data and then reporting white hat to the police without even securing the system in the first place.</comment>


Show HN: Kyubin, the bin that works like a queue - <AUTHOR> https://stackb.in/ <comment><AUTHOR> Thanks for checking out and for your comments ! Kyubin works like a queue with a capacity of only one item. To see what is inside the queue, you have to append an item to it. Doing so pops the previous item for you to read and replaces it with the one you just pushed.

Simple rules can create complex behaviours and I wanted to see what people could create with this.

</comment><comment><USER2> I don't get it, this really needs some explanation.

<comment><USER3> Same here

</comment></comment><comment><AUTHOR> Ok added purpose, this could be improved with realtime updates through websockets I guess</comment>


EC2 Users Should be Cautious When Booting Ubuntu 10.04 AMIs - <AUTHOR> https://silverline.librato.com/blog/main/EC2_Users_Should_be_Cautious_When_Booting_Ubuntu_10_04_AMIs <comment><USER2> We ran into what we believe to be this very problem at SimpleGeo and spent a long time figuring out what the cause of the JVM locking up for tens of minutes at a time were; we believe this bug (or general class of bugs) to be responsible. Upgrading to 10.10 has caused the majority of the symptoms to disappear.

My personal hunch is that there are probably startups and developers that dumped Cassandra due to "stability issues," which were in reality symptoms of this bug. There's obviously no way of confirming or denying this, so I'll reiterate that it's just a hunch.

<comment><USER3> Instead of 10.10, I would suggest switching to Debian Or CentOS.

Due its short support cycle, Maverick isn't suited for servers.

<comment><USER2> You're neglecting the fact that which distro you choose has a large influence on the kernel version you get to run. With the amount of work going into stabilizing the kernel when running in a virtualized environment, chaining yourself to a slow-moving distro will cause the exact opposite of stability when running on Xen. See: this blog post.

<comment><USER4> Recompiling a Linux kernel with a custom patch is in the core set of skills that I would expect any Linux admin to have. It's not that hard. It's not even that hard to take existing distro kernels and add a patch to them, and maintain your patch going forward as the distro continues their refinements.

When you have Linux on your server, you _own_ it. You can do whatever you want. The distro is the beginning of your power, not the end of it. If you're running a Linux server and you currently have the attitude that you are boxed in by your distro I recommend that you immediately dig into the relevant packaging system and learn enough to put your own patch on top of any existing software package, and recreate the package in the relevant manner (new RPMs, new .deb, whatever).

(Yes, there's a cost/benefit tradeoff to each such patch you have to carry on, but there is still economic value merely in _having_ the option.)

<comment><USER5> It's 2011, and screwing around with kernel compilation is a waste of my time. It should 'just work'.

The only time I recompile a kernel is when I'm working on kernel code. If UNIX distributions are doing their jobs, a _sysadmin_ should never have to touch it.

<comment><USER4> It's 2011. _Everything_ should just work.

Alas.

</comment></comment></comment></comment></comment></comment><comment><USER6> librato has an amazing product and continues to have a great blog. I love how they dig into the root cause (linking to the typo in the patch that introduced the bug) and also have easy graphs to take in the impact.

</comment><comment><USER7> Is this strictly a Ubuntu/Xen bug, or does this have impacts on other VM environments (Virtual Box/VMWare)?

</comment><comment><USER8> Honestly if you're using Ubuntu for a server then performance is not your priority anyway.

<comment><USER2> What is your recommendation?

<comment><USER8> CentOS if you can't use RHEL.

<comment><USER2> Do you have some benchmarks handy that indicate that CentOS or RHEL are more performant than Ubuntu?

<comment><USER9> Any performance differences should be negligible. Use what you're used to. I personally use Amazon/CentOS/RHEL because I know where everything is and how everything goes.

<comment><USER2> ;)

</comment></comment></comment></comment></comment></comment><comment><USER10> This applies to any AMI, Ubuntu or not.

Ubuntu shouldn't be used for web servers to begin with. You should be using a distribution with a long and thorough stable release cycle with minimal packages, such as Debian.

<comment><USER11> Can you clarify? I wouldn't use non-LTS on servers, but the LTS ones have a stable and long enough shelf life.

I've personally found Ubuntu more bare bones out of the box than CentOS.

<comment><USER10> The main difference between Ubuntu-LTS and Debian is that Debian's stable release cycle is longer and more thorough. This means that Ubuntu-LTS will have slightly newer software, but Debian will likely have less bugs.

Debian's primary concern with its release cycle is stability. Other distributions like Ubuntu or CentOS trade a little stability for newer software.

My method: Use Debian but when you _must_ have newer versions just add an unofficial repository to your apt sources (assuming you're prepared to deal with the complexity and inconsistency this might introduce).

<comment><USER12> > The main difference between Ubuntu-LTS and Debian is that Debian's stable > release cycle is longer and more thorough.

I believe that the debian stable release cycle is currently at about 2 years, w/ a very short support cycle afterwards. The LTS cycle is 2 years with a 3 years of additional support afterwards.

<comment><USER11> I have to agree more there. We recently moved from Debian to Ubuntu and like it far more.</comment></comment></comment></comment></comment>


Happy? Sad? Forget age, Microsoft can now guess your emotions - <AUTHOR> http://www.theguardian.com/technology/2015/nov/11/microsoft-guess-your-emotions-facial-recognition-software <comment><USER2> Wonder how well it detects people with BRF - [https://www.youtube.com/watch?v=3v98CPXNiSk](https://www.youtube.com/watch?v=3v98CPXNiSk)</comment>


Gen. Michael Hayden: I'd also thought of nominating Mr. Snowden [for a hit list] - <AUTHOR> http://arstechnica.com/tech-policy/2013/10/ex-nsa-chief-jokes-about-hunting-down-snowden-advocates-targeted-killings/

<comment><USER2> Wherein Hayden nominates himself for conspiracy to the premeditated homicide of a U.S. national living on foreign soil.

I just hope that before he's convicted (and if necessary, extradited) he is able to enjoy the rights to due process that he so openly seeks to deny his would-be victims.

</comment><comment><USER3> Is there a clear distinction between an "assassination" and a "targeted killing of enemy combatants"?</comment>


Ask HN: Does your company invest in SAST/DAST? - <AUTHOR> What tool does your company use, and how effective is it for you? <comment><USER2> Combination of Whitesource, Checkmark, SonarQube, Semmle, and Acunetix Vulnerability scanner. Pretty effective but lots of duplications require reviews.</comment>


US Prohibitions on Huawei Can Apply to Transactions by Non-US Companies - <AUTHOR> https://www.akingump.com/en/news-insights/reminder-commerce-department-prohibitions-pertaining-to-huawei.html <comment><AUTHOR> Some quotes:

"nonpublic U.S.-origin technology necessary to produce a toothbrush may not be provided to Huawei by a company outside the United States without a BIS license."

""Software" is defined as a "collection of one or more programs or microprograms fixed in any tangible medium of expression.""

"if U.S.-origin 5D002 encryption source code is used to compile 5D002 object code outside the United States, the foreign-made object code would be subject to the EAR when exported to China"

"The prohibitions are blind to the nationality of the exporter, reexporter, or transferor of the commodity, software, or technology being transferred to the listed entity. That is, they apply equally to U.S. and non-U.S. persons."

"Violations of the Entity List prohibitions by a non-U.S. company can lead to civil or criminal penalties, or other sanctions that would affect its ability to receive U.S.-origin items"

Basically the US is asserting the right to control all trade in technology in the world, as long as (at some point) that technology used or was developed on US technology. Seems a bit excessive, and not sure why any other country would be happy with such an arrangement.

<comment><USER2> Some countries are worried about extraterritorial enforcement of US trade policy, but they're afraid of confronting the US over the issue. Here's a recent discussion on Radio France Internationale about the issue: [1].

France would like to confront the US over the issue of extraterritoriality, which many view as undermining French sovereignty, but they can't do so without support from Germany. Germany is afraid of tariffs on its auto industry, so it won't go along with France in standing up to US overreach.

For the moment, the US is able to act in this manner. As long as no coalition of countries forms to push back, the US can force everyone else to stop doing business with Iran, with Huawei, and whomever else it chooses to cut off from the world economy.

As a report for the French Senate points out: [2]

> The European Union and its Member States have shown unity in affirming their > determination to counter the effects of aggressive use by the United States > of its economic and geopolitical pre-eminence. What is at stake today for > Iran could also, tomorrow, apply to other countries targeted by American > diplomacy.

I think this sort of behavior sets a very bad precedent, though, and will undermine the post-WWII order that the US played a central role in establishing. The US agreed to bind itself within a framework of international institutions, as a form of enlightened self-interest, but more recently, the US has increasingly acted in a manner that appears purely self-interested and short-sighted.

1: [https://player.fm/series/geopolitique-le- debat-65224/geopoli...](https://player.fm/series/geopolitique-le- debat-65224/geopolitique-le-debat-extraterritorialite-des-sanctions- americaines-les-enjeux-geopolitiques)

2: [https://www.senat.fr/notice- rapport/2018/r18-017-notice.html](https://www.senat.fr/notice- rapport/2018/r18-017-notice.html)</comment></comment>


Ask HN: Has anyone sued social media or gaming cos for addiction/depression? - <AUTHOR> Now that it's widely accepted that social media causes depression and these companies work hard to continue the dopamine feed to addict users, has anyone attempted a lawsuit?<p>If so, how did it go? If not, what is the legal hangup that would make such a suit unsuccessful? <comment><USER2> > what is the legal hangup that would make such a suit unsuccessful?

You say that it's "widely accepted that social media causes depression". Are there any studies in the peer-reviewed scientific literature that have shown this? Are there any studies that have shown it's false? If this ever went to trial, each side would have to bring expert witnesses to testify to these conflicting claims, and a jury would need to decide which side was more credible.

Also, a plaintiff who claimed that social media or gaming caused their depression would have to prove that this was actually the case. How would they prove that their condition wasn't caused by something else in their life (or just by genetic predisposition) and that their addiction to social media wasn't just a symptom of their condition? Will your psychiatrist testify to this on your behalf? (Don't have a psychiatrist? So how do you know that you're actually suffering from depression?)

Finally, chances are that most of the members of the jury will be social media users who enjoy it or at least don't consider their lives to have been damaged by it. You'll have to convince them that something that they do every day without ill effects has somehow harmed you.

</comment><comment><USER3> Should people with alcohol addiction sue alcohol businesses? Should people with obesity sue fast food? Under what circumstances should we blame it on lacking self control or gut bacteria or not having acetaldehyde dehydrogenase gene mutation? Being a gaming addict, I want to sue video game companies to get some free games.</comment>


Ask HN: have you ever marketed the same product under two different names? - <AUTHOR>

I remember that, a few years ago, two French smog check companies had ad campaigns explicitely comparing each other, even though they were actually owned by the same group and were providing the same service, just under two different brands.
The goal was to raise awareness of both brands at the same time and make each other look like a leader in the market: if company A is comparing itself to company B, it must be because company B is a leader. (didn't Fedex do something like that by presenting itself as #2?)
I can find plenty of reasons why it would be a terrible idea: brand dilution, distraction from actually building the product, extra work…
But I can also think of reasons why it might work: you're effectively A/B testing your whole branding; if you create a market, having two "players" makes it look more important; in some cases, people want to be able to compare, even if the products end up being the same thing, etc.
What do you think? Have you done it? Do you have examples of successes or failures with that? <comment><USER2> Yes - it works _spectacularly_ well for a lot of software. Spolsky said that most customers only use 10% of any program's features, just not the same 10%. This presents you with a real marketing problem. Selling the same product under different names allows you to tailor the marketing messages to particular verticals or use-cases.

I did some work recently for a company doing SaaS for small businesses. Their product was quite easy to use but difficult to sell, with a huge number of pre-sales enquiries about whether the product would suit a particular business. A lot of work went into improving the website to answer that kind of question, but nobody really bothered reading any of it.

Eventually, they bought a couple of hundred domain names and wrote unique copy for each, emphasising benefits and savings specific to a particular business. The product itself was identical across all the branded sites. Sales skyrocketed, covering the cost of that work within a matter of hours. Every part of the funnel improved substantially - more search traffic, better ad click-through, cheaper clicks, lower bounce rate, better conversion. Curiously, there was also a marked improvement in retention.

</comment><comment><USER3> This is done in consumerland. I remember 30 years ago when my first child was born, I looked into diaper services. There were dozens, but when I dug deeper they were all fronts for one or two firms. If you look at laundry detergent, they all come from a small number of firms.

It might even work on the consumer side of the internet, e.g. generic dating site, dating site for jews, christians, academics, CS (good for girls looking for intelligent hard working husbands, not so good for guys ;-).

However it wouldnt work so well for technical/business products. Can you imagine doing a technical evaluation for several products only to find the only difference among them was the logos.

<comment><AUTHOR> Good point about laundry detergent. I remember in particular Procter&Gamble who was marketing Ariel and Vizir at the same time (in France). Similar packaging, same base product, similar pricing.

One thing I remember now is that they had (in the 80s-90s) introduced a little ball in which to pour your liquid detergent to put in the middle of your laundry. Both brands had it obviously, so I imagine that made the _other_ brands look like they were lacking something.

Instead of having brand A with new unknown feature X, competing with brand B without X feature, you have two brands A1 and A2 with that feature and B without. I'd expect consumer to start thinking "well these two brands have it, so that must be good". Instead of comparing A and B, they're now comparing A1 and A2 instead.

Clever.

I'm not sure either how well two brands could work for tech/business products, but I wouldn't be surprised if the above example with the specific feature could work a bit: if you're trying a different approach to a problem but bring it through two brands, in a way it validates the approach. (if you don't know better)

</comment></comment><comment><USER4> > _I can find plenty of reasons why it would be a terrible idea: brand > dilution_

If you are trying to pitch the same product to two different markets, creating a second branch would _prevent_ brand dilution.

I highly recommend Ries and Trout's book _Positioning: The Battle for Your Mind_ (and _Marketing Warfare_ ). They argue strongly against "brand extension" (e.g. Coke, Diet Coke, Coke Zero).

<comment><USER5> > They argue strongly against "brand extension" (e.g. Coke, Diet Coke, Coke > Zero).

What a strange example to use in that case, namely because it's successful. Diet Coke was marketed to the calorie-conscious, and later when they discovered that "Diet" didn't sell well to men, they came up with Coke Zero. Sure, there's some cannibalization, but also more market share. All of that doesn't look like it's hurt the Coke brand in the least.

<comment><USER6> Brand extension has worked well in starting to transition the UK across to digital radio, too, as argued (by someone other than me) in this blog post: <http://james.cridland.net/blog/its-all-in-the-brand/>

Rather than filling the dial with unknown names, like "The Groove", "BBC 7" and "Liquid" as they tried (and failed) in the early 2000s, broadcasters have transitioned to using extensions of familiar names.

If you already know and enjoy Absolute Radio, or BBC Radio 4, on your FM radio, you're more likely to try out Absolute Classic Rock, or Radio 4 Extra on your shiny new digital set. Good, well-targeted extensions can only help widen the reach of any particular brand rather than dilute it.

</comment></comment></comment><comment><USER7> We've never tried it before, but we've thought about it. We've decided not to do this, because it would be too expensive, and take too much time. This means you'll spend 2X money and time on marketing for the same product with different names. It already takes quite some time and money to build product awareness for one product with one product name.

In my opinion, this is something you should do in case you're a big company and have a lot of money.

I think if you want to do A/B testing you just have to create different landings pages that discuss a different problem. On each landing page you explain how your product solves a specific problem.

Is there a specific reason why you want to do this?

<comment><AUTHOR> I'm currently trying to decide between two names and tried a little AdWords campaign to see if there was a significant difference in click-through rate just based on the name. (result so far: there's a little one but not huge)

I started to wonder what effects launching both names could have. But I'm by myself for now, so this is pretty much out of the question.

I also realize that a name doesn't make or break a product/company. But since I need to pick a name, I started to think about that.

<comment><USER8> Of course, it has the significant advantage that the code has to be designed to accommodate 2 names.

</comment></comment></comment><comment><USER9> It's pretty easy to reskin an app.. I'll usually at least add an extra feature or something though.

(Kind of related/fun fact: Most sunglasses are made by the same company: <http://en.wikipedia.org/wiki/Luxottica> )

</comment><comment><USER10> For something you are marketing/selling directly, it is not effective to hedge with two names to the same market/consumer. Even if each name pulls slightly better in different ways, you are losing a potentially larger market that needs to be hit with an exposure threshold to your brand before they buy (lookup 'advertising rule of seven'). Also _very_ confusing when customers who reference each other as part of purchase process are using different named versions.

In almost all cases, better to have a single brand, then test different marketing or solution approaches to placing that brand.

</comment><comment><USER11> Related: brand proliferation, when one company creates many (somewhat different) products in one niche and invests heavily in advertising. (example: Cereals). This increases the barrier for entry for new players onto this market by effectively saturating the market with a wide variety of products. Economies of scale also help – e.g. if you're one big company it's easier to negotiate with retailers. Usually done by FMCG companies.

</comment><comment><USER12> I've known companies to do this to get around Google slap issues with products, yes. Typically, in the affiliate world.

In that space, once you've found a winning product (ie. tons of sales), it makes sense to replicate under a different brand/imagery - not to compete, but to actually advertise on Adsense (for example) without 'duplicate content' penalties.

I don't have to like it, but it is a winning strategy in that space.

</comment><comment><USER13> My ex's father ran a catering company in a small city with 3 different names. One was kosher, and the other two were just different brands.

</comment><comment><USER14> No, but I am about to.

I recently launched my already a niche product and found a possible niche of that. It caters to a completely different market (one being designers, the other being disabled people)

you can read about my first month here <http://www.000fff.org/incomereport>

<comment><USER15> Your graphs need work.

What you've got is a series of linear ranges at different orders of magnitude. The peak in the middle of the x range is probably smaller than the Forrst peak, while the area under the HN peak is probably larger than everything else together. The graph does not communicate any of this clearly.

If you want to do pseudolog, use 1-2-5-10. But if you're using Excel, you can just right click on the axis, choose format axis, and tick "logarithmic scale."

<comment><USER14> thnx!

</comment></comment></comment><comment><USER16> I remember a story about a business man who imported one quality of socks from China. He then branded one product as a high quality(expensive) and the other as a low quality(cheap) product. Then he would sell both batches to supermarket chains across the country, making millions....

</comment><comment><USER17> Yes, we do this right now. Three of our web properties sell effectively the same collection of products, but with different branding, somewhat different pricing, and different target demographics. Most of our efforts target just a few main properties, so the marginal resources allocated to the "lesser" properties don't negatively impact our focus to a notable degree.</comment>


Comparing Mesos and Kubernetes - <AUTHOR> http://www.developintelligence.com/blog/2017/01/comparing-contrasting-apache-mesos-vs-googles-kubernetes/ <comment><USER2> This report is written by a company that provides Kubernetes support. The thing I found most offensive was that it implies Apache Mesos isn't an open source product.

(I don't use Mesos or Kubernetes; I just think it's dishonest.)</comment>