Ask HN: How big does an open-source project need to be for a lifestyle business? - <AUTHOR> Specifically, about how many "stars" on Github would such an open source project need to start realistically thinking about turning it into a lifestyle business, since GH stars are probably the most prominent quantitative indicator I know of in this area.
I've got an open source project that has grown fast with relatively little promotion.  I know that a good number of companies are using it in production.  I also know of a good way to monetize it, while keeping the existing software exactly like it is (not "open core" but somewhat related).
Is this a pipe dream, or do I have a realistic chance into making this a lifestyle business that -- with hard work -- can start providing a reasonable income (say $100,000/yr) within a year or two? <comment><USER3> You can turn everything into a business as long as you have a reasonable business plan in place and know that users are willing to pay for some extra features or service.

Story time: 2 years ago I started to learn frontend web development from various online courses. I had zero technical background and no intention to make money. Within few months I learned enough to create my first WordPress theme. It was terrible but it worked . I made few more themes and never did anything with them. I made like 6 themes and just deleted theme few months down the road. Then I decided to submit one theme on WordPress.org just to see if it gets approved. Themes goes through review and someone would evaluate my code and that's what I was after. Long story short my themes now have been downloaded over 1,000,000 times and I have turned it into 6 figure a year business.

While I haven't sold a single theme yet, apparently you can recommend hosting and premium plugins that goes along with your themes and make a decent income.

For those interested you can visit site at: [https://colorlib.com/](https://colorlib.com/)

<comment><USER4> > I have turned it into 6 figure a year business.

> While I haven't sold a single theme yet

What?

<comment><USER3> Yes, that's correct :) Most income comes from advertising, paid reviews, sponsorship, affiliate products (hosting, plugins, premium themes from other developers).

</comment></comment></comment><comment><USER5> Mike Perham has done a great job of turning two successful open source projects (Sidekiq and Inspeqtor) into successful businesses.

If you're interested, I recommend listening to his interviews on the ChangeLog Podcast ([https://changelog.com/159/](https://changelog.com/159/), [https://changelog.com/130/](https://changelog.com/130/), [https://changelog.com/92/](https://changelog.com/92/)) where he talks about how he monetised those products.

I'm pretty sure that succeeding in this is not going to be a matter of how many "stars" your project has, but rather a function of the dollar value of the problem your software solves and how well you market the paid product. You should start that marketing now by providing a link to your project :).

<comment><AUTHOR> Thanks for the excellent resources, I'll look that up.

> You should start that marketing now by providing a link to your project :).

Well, I haven't even created the paid product at this point, it's still early in the game. Just trying to get a feel for the potentials.

<comment><USER5> > Thanks for the excellent resources, I'll look that up.

You're welcome!

> Well, I haven't even created the paid product at this point, it's still > early in the game. Just trying to get a feel for the potentials.

Sure, but you're at the top of Hacker News right now and there's zero downside (and lots of upside) in getting your project in front of a bunch of developers. Even if they don't start using it right away, maybe it will stick in their minds and then six months down the track (when you do have a paid version) they'll Google it.

</comment></comment></comment><comment><USER6> I created Open Exchange Rates[0] as an open source project four years ago, publishing free currency data into a GitHub repository.

It was launched alongside money.js[1] (a minimal JavaScript currency conversion library), designed to work seamlessly together and both found a brilliant response and grew an organic community.

Hundreds of tutorials and thousands of posts and mentions later, GitHub eventually contacted me and politely asked me to take down the exchange rates repository, because they were being hammered by people requesting the data - only at this point did it occur to me that I'd created something of genuine value, and (6 months of fretting and tail-chasing later) I opened up a paid option.

For me the key thing was: I never intended to create a business. It was (and is) a labour of love. We've since grown to be the industry-leader for our area - "good enough data" for the startup and SME market - and count Etsy, KickStarter, WordPress and Lonely Planet among our clients.

Although it's no longer truly open source, 98% of our users are still on the Free plan, which will very soon be expanding to include all features (so, no more limiting by price tiers) - this is how I still feel so passionate about it.

I can't wait to publish the next steps in our journey - where we're opening everything up to the community and marketplace. I don't like where the industry is heading (competitive, closed, secretive) and we've chosen to move towards transparency and sharing.

I like businesses built on a core of open source community, because they're in service to the people who are actually building the products, rather than those in the traditional 'upper levels'. This means there's really no "sales process" (which I'm massively allergic to) - apart from the occasional grilling from the accounting department, who may find it hard to trust a business based on open source principles.

Good luck!

[0] [https://openexchangerates.org](https://openexchangerates.org)

[1] [https://github.com/openexchangerates/money.js](https://github.com/openexchangerates/money.js)

<comment><USER7> I'd like to thank you for creating your API, and for the generous terms on the free plan. I'm using your API to estimate my weekly revenue (internal reporting).

A suggestion: It would be awesome if it was possible to download historic data in batch format (eg. CSV) which would make it easy to copy the data into my reporting database. When I started working on my own reporting solution, I'd have paid $100 just to download a CSV file with 5 years of exchange rates, even though the data is available for free on a bunch of websites, since it's such a hassle to collect.

<comment><USER8> The Bank of Canada have downloads (CSV, RSS) for historical rates [http://www.bankofcanada.ca/rates/exchange/](http://www.bankofcanada.ca/rates/exchange/) \- you may need to convert to eg USD rates but the data is easily accessible.

</comment></comment></comment><comment><USER9> Yeah, so looking at the GitHub Cabal's secret price list, 25,000 GH stars will put you at $102k / yr, so shoot for that.

Seriously though, the fact that you're asking about GitHub stars is... telling. There's plenty of popular repo's on GitHub that I'd refuse to pay any money to, but more to the point, GitHub is a terrible _customer_ experience because it's not for selling software to people, thus the only thing 'GH stars' tells us is... the number of people that have starred a particular repo.

For a purely open-source project, look at OpenSSL. It's probably in production in a significant amount of the entire internet. But until Heartbleed came along and it came to light that the OpenSSL project was _severely_ underfunded, it was limping along with little sponsorship.

Red Hat is probably the most famous open source business, but unfortunately, if you look at their practices, they're abiding by the letter of the GPL, but not entirely the spirit, which they've decided is necessary from a business perspective, so if you're looking to make a lifestyle business based on your open-source project, the question to you is: how comfortable would you be with a lifestyle business based on an entirely proprietary project?

Is this a pipe dream? Chances are, yeah. But do dreams come true? Sometimes :)

<comment><AUTHOR> I now regret choosing to bring up GH stars (was just grasping for some concrete indicator).

I was more trying to start a conversation, which succeeded.

</comment></comment><comment><USER10> It's completely feasible, but you're playing on hard mode when you keep the software open source. If you've got good business sense and are willing to hustle you'll find a way to succeed. If your only strong suit is software, however, you're setting yourself up for failure.

Would you rather make $300k a year writing and selling proprietary software or fail/make $20k a year providing value-added services for an open-source project? This isn't a tough choice for me, but for some people the ideal of open source trumps all.

It's much easier to write software that fits a simple business model, than to figure out how to shoehorn a business model onto an open source project. You can tell which route is the pragmatic one: start from scratch, optimize for easy monetization.

That said, don't let any of this discourage you. It's absolutely possible to create a cool lifestyle business based on an open source project (or anything really). The only way to know if you can do this is to seriously commit to it. If you don't have to support a family it's probably a risk you can take.

<comment><AUTHOR> Thank you for your input, it's sobering, yet encouraging :).

> It's much easier to write software that fits a simple business model

Everyone talks about this, but how do I find this business model? Is there some methodical way to uncover needed software?

I mean, everyone talks about having industry expertise, but I actually do have industry expertise in a non-software-related industry (I only returned to software development after a 10+ year hiatus). But my industry expertise is worthless for this particular task, since this industry is absolutely _flooded_ with software, mostly low quality but also some high quality stuff. The last thing people in the industry need is another software package (and they even say this).

So how do I find these vaunted "business models" for paid software?

<comment><USER10> A business model isn't a unicorn. Your business model doesn't need to be unique or even different. To the contrary: just do what's known to work!

90% of software companies have the following business model:

        * create proprietary software
        * charge money for licences
        * charge extra for support
        * charge extra for updates
        * pay through the nose for enterprise options

90% of saas companies work like this:

        * create proprietary software
        * offer a free trial
        * charge money for it every month
        * (optional) pay through the nose for enterprise options

It's just that simple. No need to overthink it.

Having industry expertise just makes it easier to get to product-market fit. It's by no means a requirement. You may be undervaluing your industry experience. Unless your market knowledge is really generic (e.g. webshops), you've probably got some valuable insights.

(edit: most programmers get paid well, therefore, if you become a programmer you're likely to get paid well. If there are a lot of companies making money in a market, then you're likely to make a lot of money if you enter that market. Inversely, if everybody in a market is struggling [indie games] then you're likely to struggle too.)

<comment><USER11> In the case of the SaaS business models, is the first step even needed? I'm still trying to not be blinded by my idealism but is there really any value in making source proprietary if it's a SaaS business? Would GitHub's popularity be affected appreciably if it were closed? Google's?

I remain hopeful that the standard SaaS business model dovetails nicely with free and open source software.

<comment><USER12> Google's certainly would be. Microsoft has dumped millions into trying to get Bing to a point where it can even begin to compete with Google—if Google open sourced their code, tons of competitors would crop up trying to take market share.

GitHub would probably have less of a problem with open sourcing their code because their primary value prop isn't that they've built some brilliant software but that they take the bother out of managing your source hosting.

<comment><USER13> > GitHub would probably have less of a problem with open sourcing their code > because their primary value prop isn't that they've built some brilliant > software but that they take the bother out of managing your source hosting.

GitHub is making money by selling their proprietary pack to other corporations so they could implement it on their own server. If they release it for free, they wouldn't be able to support free code hosting services and remain profitable.

They're also selling premium plans for the regular users, but I don't think that this gives them enough profit to remain profitable.

</comment></comment></comment></comment></comment></comment><comment><USER14> Making money with software is not very correlated with said software's quality - or popularity. I think yours is an unanswerable question, you should probably start from the other side of the equation (i.e. what's the target marget? who would be willing to pay for the software? and, given that we are talking about open source, what would you sell - and to whom - to beat the possibility to just use it? What would the licensing options for commercial usage look like?).

</comment><comment><USER15> Here comes the unpopular opinion: I don't like open-source projects being "turned into a business" at all. Something's always gotta give.

* Paid support: you now have an incentive _against_ improving the documentation. Conflict of interest.

* Selling binary builds: your software can no longer be easily recommended and shared by others.

* "Premium features": I'd rather call this 'crippleware'. You're intentionally crippling the 'community version' to give people an incentive to pay you money. That's certainly not in the spirit of open-source.

Frankly, I don't feel software is a thing that should be sold _at all_. You're always going to be intentionally (and artificially) restricting _something_ to make that business model work - after all, software is infinitely reproducible at effectively zero cost.

Instead, if you absolutely _must_ make a business out of it, offer something like a hosted service (that people can easily replicate themselves, in the spirit of open-source). That way you _add_ something to be sold, rather than taking something from the existing project and asking money for it.

The better option is to accept donations, and put some serious effort into getting those going. I don't really understand why people will spend _weeks_ drawing up a business plan, but for donations they just slap a 'donate' link in the footer of the page without thinking, and then complain after a few months that they're barely getting any donations. Accepting donations requires the same amount of thought to make it work.

EDIT: No bulletpoint lists on HN? :|

<comment><USER16> Unpopular but not unreasonable.

\- software is a new form of literacy. Perhaps at some point in the past literate people could contribute to the communi

\- the fallacy of altruism. Developers working on an open source JS drop list widget are not being altruistic - their contribution to the community could as easily be say working at a soup kitchen, probably with more value to the world.

"Contributing to the community" is something we rely on Adam Smiths Invisible Hand to help us with 99% of the time. So while I use and appreciate the OSS developed to date, it has gone beyond a simple charitable model and into an Eco-system beyond any simplistic approaches. I would like nirvana, but it's dubious as a long term strategy for OSS.

\- conflicts of interest always happen. When it is important enough, say Linus' salary, the community will either whither or find a way to build its own institutions to make the important conflicts managed - like Linus salary. This is part of building strong institutions we hear about so often

\- getting better at begging vs better at selling seems to be the last point you make. Honestly I cannot see that as a honourable position of trade.

We don't have perfect solutions - but we are working on them

<comment><USER15> > getting better at begging vs better at selling seems to be the last point > you make. Honestly I cannot see that as a honourable position of trade.

Asking for donations is most certainly _not_ begging, and I personally find that a somewhat offensive way to present it.

Donations are a voluntary contribution in return for some kind of work that was done; begging, by definition, isn't in return for _anything_. They are two fundamentally different concepts, just as different as 'accepting donations' versus 'selling'.

<comment><USER16> Ok - sponsorship.

Donations is to my mind a charitable endeavour - the small amount of change is thrown over and not considered. In fact lack of consideration is probably the right legal term. Sponsorship involves some contractural form to occur - <USER2> so implies a trade of value.

To be fair you could have been saying get better at donations by rebranding them as sponsorship instead of better at soliciting uncontracted contributions.

But I still think we need to find a new and better way to monetise OSS contributions.

</comment></comment></comment></comment><comment><USER17> You would never know unless you started exploring. Stars have nothing to do with revenue - it's purely a function of how much value you can add to the enterprise. Basically, you have to demonstrate quantitatively that you can charge $X to help them save $Y where Y >> X.

Here's what I would suggest. Reach out to a few people from these organizations and ask them for their general views on your project and what their major pain points are. I'm sure they will be more than happy to talk to you about it if they're indeed already deriving great value from it. Once you have established a good rapport (i.e. warming up the lead), set-up a call with them to pitch your vision for the paid product. A call is crucial because email and text can only communicate so much - you can get a far better idea of their domain and problems through a quick 45 min call. Scheduling this should not be a major problem once you have established a good email channel previously.

If you can get about 8-10 people interested in exploring your paid offering you have something that's promising. After that you can think about scaling the business with self-service etc.

<comment><AUTHOR> I hate phone calls, but I suspect you're right about this. But calling potential customers is definitely concrete advice I can do.

BTW, everyone discounts Github stars, but the one thing stars gives me is a very easy-to-access list of potential customers.

<comment><USER18> Great attitude! Making these phone calls is like building up a muscle. It will become easier, I promise. And I think you'll be surprised at how pleasant many of them will be. My best to you.

</comment></comment></comment><comment><USER19> Sell your expertise as an integration/support engineer to companies who want to use your project but don't want to dedicate the internal staff time to become experts on same.

Every company that emails you asking you for help is a sales lead. "I'm happy to implement/configure this for you. I charge $X per hour, and what you're asking for is about Y hours of labor." To the client, X*Y is often cheaper than the opportunity cost of pulling an engineer away from other work. Also, don't be afraid to make X >> $100 if nobody else offers the same expertise.

You can do as much of this as you want, without changing anything about how the software is licensed or packaged.

</comment><comment><USER20> There are a few podcasts that have discussed this. Typically it is done via support for existing OSS, offered to companies who need to be able to depend on full knowledge & stability of that code. A couple of examples:

1) Redhat

2) "some guy" from one of the podcasts I can't think of at the moment who forks Ruby and keeps a stable, supported version for his corporate clients, while dealing with patches & upgrades on his own to his fork

In both of these cases, you can see that is isn't actually "how many users", but "how many corporate users who need a service that keeps software X completely stable and managed"

So I think from what you've said that it would be a good thing to look into. You may want to contact the guys from [http://www.tropicalmba.com/](http://www.tropicalmba.com/) for a few pointers - this is right up their ally and they are very willing to discuss

<comment><USER5> RailsLTS ([https://railslts.com/](https://railslts.com/)) is probably the product you're referring to in (2).

</comment></comment><comment><USER21> I manage a small open source project ([https://github.com/frappe/erpnext](https://github.com/frappe/erpnext)) that churns 100+k per year and helps me manage a small team. It took me 4-5 years to reach here. We make money by providing hosting and also help to other developers working on our platform.

I would start with a services plan and a beautiful website. If you are not a designer, do hire one. Good design and quality can go a very long way towards achieving your dream.

If your project is an app, you can also go the SAAS (softare-as-a-service) way. But beware, building a multi-tenant platform, and working on user onboarding, marketing your site can be 2x to 3x of your original project your project.

The good thing is that once you are there, 1/2 years is a reasonable time, this will only grow.

</comment><comment><USER22> Yes, it is definitely realistic. We've seen several projects like Sidekiq ([http://sidekiq.org/](http://sidekiq.org/)) that did it.

Another quantitative indicator you can use is number of downloads on relevant package manager (npm, PyPi etc.). These indicators only tell you how big your audience is and not whether your project could provide income. However, having big audience increase chances of success - you have a good position here.

Check out MinoHubs ([https://www.minohubs.com](https://www.minohubs.com)). We provide tools that will help you get started with monetizing your project in several ways very quickly. Let us know if you have any questions or if you're missing anything.

</comment><comment><USER23> It is less about how many stars you have an more about how many enterprises use your software. GitLab has 15k stars on GitHub (we moved the canonical source to GitLab itself a while ago) and more than 100k organizations are using it. But most of our income is coming from larger enterprises in the United States. It you can offer them extra features and market it properly you can expect something like 1% of your users to sign up for a paid plan. Please let me know if you have any questions.

</comment><comment><USER24> There is no sustainable way to monetize an open source project, except to offer a "premium" service (which, unless you are comparable to Redhat by market cap will probably unprofitable - I think Orable is losing money on MySQL) or you offer closed source "enterprises" version, like so many do, but it must be an exceptional tool, like nginx, varnish or nessus.

So I am very sceptical about monetization of community-driven momentum (the moment you close the code it begins to stagnate and die). Unless you are leader in your niche the chances for earning living from a project are close to zero.

Wordpress or other themes is a different kind of offer.

</comment><comment><USER25> I have had a few open source projects with around 250k installs (web apps and Wordpress plugins). One of them I was able to monetize for about $1k per month. I was getting inundated with support requests so finally I created a "product" by putting up a "buy now" button for $250 installation support. I then ran some google ads to promote it. This was an encryption product so it had business users.

If you make it easy for people to give you money and you have a useful product then there usually will be a small percentage of users who will pay. But I'm a firm believer that to make money you have to put effort into sales.

</comment><comment><USER26> Pipe dream.

a) 100k / year is not 'reasonable', it's _huge_ in microisv terms. The modal revenue for independent software vendors is $0 (stats from payment processors). To get there in 2 years is even less common.

b) The number of 'stars' has correlation r=0 with ability to monetize. I'd even speculate - the more stars, the more ingrained in people's heads it is 'this is open source, ergo free', the harder it will be to make money. If you're selling support for something only slightly popular, customers will have no other options - but on support for Wordpress, you have to compete with other devs, with 2$/hour rentacoder people, with Amazon selling 'teach yourself Wordpress in 60 minutes' books etc.

c) What incentive do companies have to pay for it? You have to be able to articulate it clearly before going down this path. Your wording makes me think you are thinking 'this is my secret sauce, I can't give it away', which is (frankly) very naive. If your idea is even a little bit good, you'll have to stuff it down people's throats to accept it. I don't know of any business that makes money OS software (on the software itself, not the consultancy around it) without having a dual licensing model - GPL or commercial. And if that was really a cash cow, Trolltech wouldn't have been sold a dozen times (or so) over the last 10 years...

To judge whether your product has commercial potential, you need to

1) Describe your customers. In detail. Not just 'anyone using a database', but 'medium scale accounting businesses with on-premises case database' (idiotic example, of course). You need to do this in such a way that you can derive a strategy from it on how to find them. E.g., accountants meet at industry events, where you could book a booth.

2) Identify a sample of, say, 100 of them, using the methods from step 1.

3) Start calling them. Preferably after you've taken a sales class (just 2 days will give you life changing insights, I promise). Not emailing, actually talking to people. For the 100 from step 2, identify how many would buy your product.

4) Get sales promises, 10 or 15 or so. People who you can excite so much about your product that they promise (informally) 'yes, I'll buy this if you offer it within 6 months' or whatever.

5) If you can't even do this, you have no (OK, 'barely any') hope of succeeding.

The main skill you need is marketing to succeed at an endeavor like this. The quality of your software, or its popularity amongst the crowd that uses Github, is of secondary importance at best. That's not to say that you can succeed with selling people crap product, snakeoil style, just that your life as a software vendor is 10 or 20% of software development, at best (or worst, depending on your perspective...)

<comment><USER27> Any particular sales class/course you'd recommend?

<comment><USER26> No, I took one from a local small firm, I didn't arrange it so I didn't do much research on it. I think the stuff we covered was so basic that anyone in sales would go facepalm on how basic it was, and yet for us (room full of engineers) it was so outside of what anyone of us knew, that it was one new insight after the other. Also, it did a lot of role playing exercises, which I find awkward but useful. I don't think it matter much which course somebody at my level (0 sales skills) would take. It's similar to any high school teacher being able to explain a linear function - you don't need a maths PhD for that.

</comment></comment></comment><comment><USER28> I have a little over 1000 stars (1044 at time of post) and have made $10 in Bitcoin (Which is worth less than $10 now). That being said, my project is extremely-side-projecty[1].

Others have discussed busies models, so it should be a simple calculation of how much you can charge for a model vs how much it will cost you to run your business and if you can live with the reminder after taxes etc... then I would say do it.

[1] - [https://github.com/joeblau/gitignore.io](https://github.com/joeblau/gitignore.io)

<comment><USER29> Just have to say, thank you very much for creating this. Use it every for every single new repo I setup, saves loads of time. It's just awesome!

</comment></comment><comment><USER30> 1 star. If you are starred by a big tech biz and they are willing to finance you up to $250k/year (or maybe a million per year?) to keep the project running and clean bugs by the very own creator of the project. Because your project is handling infrastructure for them that runs a multi-million dollars business.

100,000 star. If you are starred by your average to not-so-average (high or low) developer. There is no clear monentization plan. But given the popularity, ads and affiliates might bring you $1 per star (assuming a star is 40-50 visits/year).

Think about it. You have a bridge between Queens and Manhattan. I'm sure the US, NYC and people are willing to finance, pay you, or buy you. For what-ever big price (might be unreasonable too, to the cost of creation) you ask.

But if you have a bridge between Antarctica and the French Southern Antarctic lands (just randomly picked), it'll be certainly an amazing and well-known artefact but I'm not sure how you are going to finance it (especially that Tourism is not huge there).

</comment><comment><USER31> In regards to the GitHub stars, I don't think that a high amount of stars actually correlates to the amount of people using the repository.

Cachet ([https://github.com/cachethq/cachet](https://github.com/cachethq/cachet)) has 2.6k stars but I know that the amount of installs is actually far higher.

<comment><AUTHOR> Fair enough, and to be clear, I'm nowhere near 2.6k stars, although the project has grown quickly with no promotion.

The only reason I pulled that particular indicator out of the hat was to provide some reasonable benchmark for comparison.

But perhaps it was not a reasonable benchmark, after all.

<comment><USER32> I would think merged pull-request (aka community patches that doesn't suck) would be a better indicator on gh - at least for open source project. Fixed issues a close second.

<comment><AUTHOR> Linux and LLVM have no merged pull requests on Github. And a lot of these "Awesome x" (Node.js, Rust, Go, React, etc) will merge just about anything.

Also, I know of several project that fix tons of issues, but are relatively unpopular (perhaps because they have so many issues?).

I think the bottom line is there are no perfect indicators of open source project popularity.

<comment><USER32> Linux has lots of merged patches though. That they don't have merged prs isn't surprising as they handle patches via email.

</comment></comment></comment></comment></comment><comment><USER33> I've got one data point for you, though I don't think you can guesstimate income based merely on one factor, especially not github stars (we only have 295).

My company is based on Open Source software (Webmin, Virtualmin, Cloudmin, and Usermin), and it sounds sort of similar to your situation. When we started the company based on this stuff we had several major companies in our target market (and we chose our target market, and chose to focus on Virtualmin rather than other features of Webmin, because that market already knew us and used our software in visible ways) using at least one of our projects, almost a million downloads a year, and my co-founder and I had both been making a decent living doing contract work based on it and writing about it.

Today, Webmin has about 1 million installations worldwide (and has grown to ~3.5 million downloads per year). We make enough money from our small proprietary extensions to Virtualmin and Cloudmin to support three modest salaries. It is not $100k/year for any of the three people working on it, though it's not an outrageous dream to think we could get there..we've had much better years than we're having this year or last year, however, so revenue is not necessarily growing like gangbusters, despite our userbase roughly tripling in the time the company has existed and still growing at a comfortable clip annually. Ours is sort of an open core model, though the core is very large (~500kloc) and the proprietary bits are very small (~20kloc), which may be part of our revenue problem.

I think there are some things you're probably underestimating (not to say it should discourage you, I'm just trying to open your eyes to some challenges you will face that you might not expect):

When you sell Open Source software, support is your biggest value add, even if you don't want to be a support company. Support costs a _lot_ of time and money to do well. Time and money has to be balanced between making things better and supporting existing users on the current version (true of proprietary as well, but proprietary vendors don't have a million people using the free version and expecting help). Growing the free user base (which can be a side effect of having people working full-time on it) can paradoxically lead to less time and money for making the software better. We fight this battle all the time. To make our current customers and OSS users exceedingly happy with our level of support is to severely limit our ability to deliver next generation solutions. We run on such a shoe-string, and compete with such huge players, that it's always a struggle to deliver both (and we fail plenty).

So, plan to hire someone to help you support the software, eventually. If we were comfortable leaving our forums to "the community" and not bothering to have an official company voice present every day helping answer the hard questions, we could increase our own salaries by a lot (we pay our support guy more than we pay ourselves), but I don't know that we'd continue to see the growth we've seen in our user base, which we also value. We make things because we want them to be used, not just because we want to make money.

Get used to having demands thrown at you every day. The level of documentation and completeness and rapidity of development expected of a product is vastly different than that of an Open Source project, or at least the way you have to respond to it is different...even for users of the Open Source versions. We have over 1,000 printed pages worth of documentation, plus a couple hundred pages of online help, and still get complaints about our documentation regularly. And, we have more "features" than any other product in our space, including the two big proprietary competitors, and yet still get feature requests all the time (and it's harder to say no than to just implement it, which can hurt usability). A million users generates a lot of feedback. It's a very high volume of demands to answer to. Ignoring them pisses people off, saying no pisses people off, and saying yes often risks making the product worse or more complex for the average user, hurting long-term growth. Even saying, "Not right now" pisses people off. You're going to piss a lot of people off, even if you're just trying to make the best software you can and make a decent living.

I think what I'm trying to say is, think about it for a while before committing to your plans. If you currently have steady income, hang on to it while you sort out a few details.

Try to firm up what your users would pay for your value add. Try to figure out how many of your users would pay for your value add. The only sure way to do this is to actually have users pay you something for your value add.

Try to figure out how you will automate support (hint: You can't, because automated support almost always sucks; even Google has awful automated support, and they're good at almost everything.) At least figure out how you will streamline it and offload it; have an active forum already? If not, get one. Have a community of people talking about your software already? Get one. If Open Source based business were a Pokemon, community would be its special ability. So, you should start cultivating that now, even before money is coming in.

<comment><USER32> Interesting to hear from someone both brave enough to bet on webmin, and lived to tell the tale! :-) I'm afraid I don't have the best impression from webmin etc - but then again I'm not the target customer.

Having had a look at your product page it strikes me that you seem to be under pricing though? $99 seems _way_ cheap if you add any value at all. I suppose it's a though market, but $500 or even $1000 sounds more reasonable. Loose half customers, make more money, have fewer to support?

I'm guessing you've gone back and forth on this a lot; just hoping a completely outside perspective might help - even if you end up going with your current pricing model.

Best of luck!

<comment><USER33> We're experimenting with lower pricing, at the request (demands) of a handful of loud users. It has, so far, been a mistake. Revenue is down despite increased sales...sales didn't increase enough to make up for the lower prices.

Our previous pricing was $139 up to $499 for the first year of Virtualmin Professional, depending on number of domains hosted, and renewals costing about 1/3 that. Current prices are $99 to $249, I think. So, it is significantly discounted.

This is also a bit of a stop gap while we rewrite our store and license manager to accommodate monthly subscriptions and to better handle reseller accounts (users who are hosting providers that buy many licenses and expect steep discounts because our competitors provide steep discounts to hosting providers). This all coincides with a migration from Drupal 6 to Drupal 7, which has been a nightmare and has taken longer than every previous website migration we've done, including two migrations from completely unrelated content management systems and shopping carts.

Anyway, you're probably right about pricing. We'll decide after we launch the new site and have ways to provide more flexibility in purchasing to our various types of customer.

I'd like to hear about your poor impression of Webmin. What, specifically, makes Webmin not something you would consider for your servers? I know about some of the persistent myths that follow Webmin around: Insecure, breaks things, incompatible with my favorite distro, ugly code (this is kinda true). But, many of those come from grumpy hard-line command line administrators that think no one should be allowed to be a system administrator if they can't do it all in a shell...we'll never win those folks over. But, I still like to know what negative things people think of Webmin and why they think it. I've pretty much devoted my entire professional career to Webmin and things related to it (my previous company also was based heavily on Webmin, and I wrote a book about it). It matters a lot to me that it always gets better; and, it matters to me that people are judging it on its actual merits (and flaws) rather than inaccurate beliefs.

<comment><USER32> > This all coincides with a migration from Drupal 6 to Drupal 7, which has > been a nightmare and has taken longer than every previous website migration > we've done, including two migrations from completely unrelated content > management systems and shopping carts.

Aww, I'm so glad I'm not on your team for that ;-) Even without following Drupal closely I can imagine your pain: new programming/design patterns, new php language features, major refactoring and a change to more modern rendering pipeline, templates and perhaps a new caching layer on top of perhaps a restructured data-layout? Am I close?

> I'd like to hear about your poor impression of Webmin. What, specifically, > makes Webmin not something you would consider for your servers? I know about > some of the persistent myths that follow Webmin around: Insecure, breaks > things, incompatible with my favorite distro, ugly code (this is kinda > true).

Mainly bad code and insecure (way back). But:

> But, many of those come from grumpy hard-line command line administrators > that think no one should be allowed to be a system administrator if they > can't do it all in a shell...we'll never win those folks over.

That's me ;-) As I said, not your target customer. Mainly I don't really want the level of access webmin needs to be effective, exposed as a web service. While that might be mostly religion at this point; I also realize that it mostly makes sense if _no other core data_ is exposed as a web service. This is obviously the case for many people and businesses. [ed: just not for me as I _prefer_ ssh/the command-line]

So again, best of luck :-)

<comment><USER33> Would two-factor authentication and certificate-based authentication help alleviate some of those security concerns? Because Webmin has both of those.

We actually take security seriously, as any software that provides root-level access to a million servers must, though I don't pretend we will ever be bug- free or that we can ever guarantee security (even SSH has had major security bugs). We're considering setting up some sort of bug bounty to help sniff out security bugs, but haven't figured out how best to implement that.

<comment><USER32> I actually thought a bit about that after posting. I would be more inclined to use a web based admin interface today, than just a few years ago; the TLS stack is not as bad as it was; we've come further wrt ciphers - and the web servers themselves have seen (more) hardening.

The thing is; I already use ssh. Adding another network service doubles the attack surface.

Then there's the ux problem for browsers and certs. Using certs with ssh is complicated enough (it's still on my todo-list, I use/require keys - but key management is _not_ trivial for more than a handful of servers).

Ssh also finally have easy/proper 2fa support now: setting up totp+keys is quite trivial. Add password+totp for sudo locally and you have half-decent ux and security.

And while ssh _has_ had some security issues, it's been a while since the last big one. In contrast with all the things that go wrong with web apps (xss, session-hijack etc).

All that aside, certs+2fa (and the ability to disable pw auth) goes a long way.

<comment><USER32> Btw for any other grumpkins reading; I just discovered scoop and found out powershell seems to finally be usable in windows 8.1 pro even for part-time ms users.

Run>powershell

      set-executionpolicy unrestricted -s cu
      iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
      #yeah, I know - no signarure, code from curl...
      #but this is windows, beggars can't be choosers
      scoop bucket add extras #optional
      scoop install ssh

If you want oneget, it's in the extras-bucket iirc:

       scoop install oneget

But while scoop could use some love (eg vlc is a point release behind oneget/chocolaty) -- it's _much_ nicer than the FindPackage mess IMNHO.

More at [http://scoop.sh](http://scoop.sh)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> As others have said, the number of stars is irrelevant. The most important factor for success is not the popularity of your project, but the problem it solves, and whether there's a way to monetize it.

I started making money in 2011 with a GUI for an open source command line tool. The open source software was available completely for free, but compiling it was a hassle, using it was annoying because of a few serious bugs, and you had to use it from the command line.

I made money by making an existing, free tool available to people who didn't want to use the command line or compile their own software. I charged a modest fee (initially just $5), and people gladly bought my app to solve their problem. Nobody cared about the fact that it was open source and they could have solved their problem for free; they just considered my app a fair deal.

(I still sell this app, MDB Viewer for Mac, but I've since completely rewritten the open source library it depended on)

</comment><comment><USER34> You've made fantastic steps towards making money from your project. It's use in production shows that it has business value.

[http://nathanbarry.com/authority/](http://nathanbarry.com/authority/)

I think Nathan's book describes an excellent outline for success in this regard. Basically you can look into "tiers". You give away "free" resources. Blog posts and the liberally licensed open source software itself. You can also paid resources. A book, perhaps screencasts that accompany the book for a premium price. Workshops and onsite training provide another tier. At the very top is consulting at ultra-premium rates.

This is oversimplified, but this is the idea. The "free" stuff is critical, and builds the basis and "proof" for the paid offerings.

</comment><comment><USER35> It really depends on what the software does. I've mostly seen people make money off of their open source software by consulting for companies that use it. For example, I know a couple companies paid the creator of core.typed to develop it further. But those were one off gigs, not recurring revenue.

</comment><comment><USER36> When you get the hype, for example front page of HN, that would probably be a good indicator that it should be possible to make a living on it. It doesn't even have to be your own project :P

There are excellent comments in this thread btw. I've bookmarked it.

</comment><comment><USER37> What's your "good way to monetize it"? The typical approach I have seen is selling support (paid custom features or forks) but that doesn't scale well. You'll basically be a freelancer specializing in the project you wrote.

<comment><USER38> Note that he wants to create a lifestyle business, not a startup. Not sure how important scalability is for that.

</comment></comment><comment><USER39> One star, if it's from the right person.

Revenue is number of people willing to pay you time the amount they're willing to part with. Neither of those can be inferred from number of stars on a GitHub page (it probably has the most correlation with the number of people willing to pay, but there's going to be a scaling factor there that will vary dramatically based on the nature of the project).

</comment><comment><USER40> If the project is popular because it's a free alternative to something that costs then I imagine charging would kill it completely.

</comment><comment><USER41> Is your goal to be paid to write your software? Have you considered looking for a job where you would be paid to develop this software by a company that needs it?

How do you envision your open source lifestyle business once it is up and running? (do you want to be paid to develop software or are you hoping to make a business that "runs itself"?)

</comment><comment><USER42> Does your landlord or local supermarket accept stars on github as payment?

There's your answer

You need to provide a service connected to your project, this is regardless of how many people use your project.

<comment><USER43> My local supermarket does! It's called GitPay. I just provide my github username at checkout and they deduct starts from my repositories. The exchange rate is roughly 10 euro per 26.2 stars. I generally get better rates at the bank by the convenience of GitPay has made it hard to resist.

</comment></comment><comment><USER44>

</comment><comment><USER45> My question for those that have spent years building a product:

Was it worth it open sourcing your product?

Did you get lot more leads and exposure?

I'm afraid of open sourcing because I'm not sure if it will do anything for me, and that I'm giving away years of work away for free.

<comment><USER46> I think working on open source, both unpaid and paid, projects definitely has been worth it for me professionally. Independent of self gratification and such (rather important IMO), it has lead to offers for interesting jobs and by that increased what kind of remuneration I could get. Above what I think the additional years of experience themselves would incur.

I think it's harder to answer that on the angle of open sourcing projects. I've, together with colleagues, spent the last few years doing paid for feature development for an open source projects. It's possible to have a company around that and support, and grow. But it's not easy.

My impression, more from the side lines, being a technical person occasionally involved in sales, is that it help in lead generation, but that the conversion ratio tends to be lower than with leads for a closed product.

<comment><USER45> >My impression, more from the side lines, being a technical person occasionally involved in sales, is that it help in lead generation, but that the conversion ratio tends to be lower than with leads for a closed product.

This is what I'm seeing. Even when I had free trials, vast majority of people were just free loaders, some even going as far as using a prepaid card to get past the requirement.

Which is why I'm hesitant to jump on the Open source wagon, I don't want an army of freeloaders now demanding and whining, like I see all the time on github.

<comment><USER46> On the other hand lead generation is cheaper...

I think it's hard to answer you questions without more information about the type of product. My impression is that plays a large role in viability. ISTM infrastructure type pieces have a bigger chance to open source successfully.</comment></comment></comment></comment>


Show HN: Choremate, The chore chart you're alone without - <AUTHOR> https://choremate.co <comment><AUTHOR> Hey, I'm Keyan and I built Choremate, a consumer SaaS web app. fml. lol.

I'm currently learning how to sell it. :)

The problem: People stop cleaning when they live together, mostly because no one wants to be the only one cleaning up after everyone else.

The solution: Choremate is a chore chart that restructures (dis)incentives so that cleaning actually happens and everyone is held accountable.

The insight: It's a tragedy of the commons scenario. Fix the tragedy by integrating work done in economics on effective commons management. Namely: provisioning rules, graduated sanctions, and monitoring wrapped in a fun UX.

</comment><comment><USER2> Scrolling through the site, one seizure-inducing color change to the next, I find that just one word or small phrase per page is ... not conducive to actually reading anything, nor conducive to wanting to explore the service.</comment>


Wechaty: A Wechat ChatBot Framework for Personal Account - <AUTHOR> https://blog.wechaty.io/news/2016/12/04/welcome-to-wechaty.html <comment><AUTHOR> Build the world's smallest wechat bot by 6 lines of JavaScript.

Powered by Node.js & Docker.

[https://github.com/wechaty/wechaty/](https://github.com/wechaty/wechaty/)</comment>


Germany Privacy Foundation closes down and terminate services - <AUTHOR> http://translate.google.com/translate?hl=it&sl=de&tl=en&u=http%3A%2F%2Fwww.privacyfoundation.de%2F

<comment><AUTHOR> That's not recent news: it was announced in June, but today was first day that connection to GPF DNS server was not working.

In the page they also announced that now: " The Swiss Privacy Foundation operates uncensored DNS server, which is also the test domain welcome.gpf. See: [http://www.privacyfoundation.ch/de/service/server.html](http://www.privacyfoundation.ch/de/service/server.html) "

What do you guys think? Does this changes something in terms of trustworthiness?</comment>


Darwin's theory wrong, nobody saw ape turning into man: Minister Satyapal Singh - <AUTHOR> http://www.hindustantimes.com/india-news/darwin-s-theory-scientifically-wrong-nobody-saw-ape-turning-into-man-union-minister-satyapal-singh/story-hZ6R2BihRNfd93sDGWwbuN.html <comment><USER2> Since nobody saw it all the other evidence can be summarily dismissed? Then again, this isn't what Darwin's theory is concerned with in the first place. Darwin was concerned with how animal morphology changes to fill in ecological niches. His answer was Natural Selection - which is something we've actually seen.

<comment><AUTHOR> "Since nobody saw it all the other evidence can be summarily dismissed?"

What evidence is there proving that new species morph out of old ones? There is none. New species are created by symbiosis and Darwin knows nothing about symbiosis.

"Then again, this isn't what Darwin's theory is concerned with in the first place."

Darwin's theory is an academic dogma. It has no meaning because it has infinite meanings.

"Darwin was concerned with how animal morphology changes to fill in ecological niches. His answer was Natural Selection - which is something we've actually seen."

So you chose to select this angle of Darwin's theory. What is natural selection? Don't try to answer because it has as many definitions as there are biologists.

</comment></comment><comment><AUTHOR> I admire his courage and I congratulate him for speaking out against all these academics who try to fit nature to their scholastic master's sacred text.</comment>


Ask HN: Best way to send MMS - <AUTHOR>

We're trying to build a website that can send MMS messages to cellphones, worldwide.
It does not seem to be a technical problem (plenty of MMS gateways out there, SMTP2MMS providers, etc ...) but a business issue.
Basically, the impression I'm getting is that most carriers do not want 'small fish' like us to send MMS messages on their network without approval.
I'm disappointed with the state of MMS, makes me think of the locked-in world of WAP 8 years ago.
So: has any of you tackled this issue? Is there an easy solution or should we just accept this is going to be messy? Any pointers? <comment><USER2> For 3 years I worked on a startup that built SMS applications. Although we did not work with MMS, I am very familiar with the struggles regarding carriers and just getting set up. Ultimately our startup failed - our costs were just too high, our slice of the pie was too small, and to reach the volume that we would need to become self-sufficient would require a bigger financial investment in advertising than our CEO was able to acquire or willing to make. Anyway....

I read over a long email string that I had with reps from several carriers regarding setting up direct relationships with them. At the time, our company was working with the carrier aggregator (middle-man) mQube - they were then the best, but we wanted to cut them out of the picture. If you don't already know this, carrier aggregators are essentially the gatekeepers to the carriers, and if you want to do ANYTHING substantial, you need to go through an aggregator. The alternative is to have direct-binds with the carriers themselves using lease-lines or special relationships. Through my correspondence, direct-binds are no longer offered, therefore it is pretty much impossible to become an mQube (Verisign became an mQube late in the game only by purchasing mQube). The next problem is that mQube's UI and customer service is pretty horrible, and you have to go through it if you want to get your program brief approved. Getting your program brief approved will most likely be your biggest challenge, and program briefs are like $1000/mo at least. The different carriers have different requirements, etc. You'll probably have to peruse and follow something like this: <http://www.mmaglobal.com/bestpractices.pdf>

We spent months trying to convince mQube that we weren't going to spam people and that our app was legit. We were a non-subscription based service that supplied information/content only when a user initially requested it. That type of application is in the VAST minority of SMS apps, as most out there are horoscope type subscription services that people have trouble opting out of. In short, you are always going to be playing the carriers' game, and you will probably never win or even break even unless you have BIG BUCKS.

In Europe and Japan, if I remember, and it may have changed, there is only one cell provider ie Vodaphone, and it is much easier to get things done. The CTIA has the potential to create some standardization, but I don't see that happening.

Best of luck

</comment><comment><USER3> > Basically, the impression I'm getting is that most carriers do not want > 'small fish' like us to send MMS messages on their network without approval.

EXACTLY!

The way we circumvented the system a few years ago (2006) was to get a plain unlimited SMS plan, and then programatically send and receive SMSs through a real phone connected to the server via USB (not sure about MMS, but it is probably similar). This is very slow (12 seconds per message), and most carriers tell you "unlimited" but there is an actual limit in the fine-print.

I would recommend this solution only so you can bootstrap it. If you really take off, the carrier will block you immediately, so a business model that can sustain the MMS costs is a must (as swombat pointed out).

Feel free to email me if you need more info on this SMS hack.

</comment><comment><USER4> Accept it's messy. As long as big carriers are involved, you're going to see locked down monopolistic behaviours.

Basically:

\- expect it to cost far more than you'd think

\- don't count on any "big wholesale rebate" - it'll be insignificant even if you hit a respectable scale

\- don't even bother talking to the carriers until you have a huge volume; as long as you're a small fry, you'll have to go through gateway providers

MMS is a still-born technology, imho, in large part because of the telco's involvement. First of all, it doesn't work half the time, secondly, it costs way more than it should, thirdly, it's almost impossible to make a viable business sending MMS's other than by being a gateway.

<comment><USER5> MMS is sort-of solving a 10 year old problem - and it's a 10 or so year old telco answer to the problem of "how do we extract money from customers and lock them in?".

It's on the way out, too, being supplanted by email.

There's a lot of die-hard MMS users in Europe though, and it's quite common to be sent MMS pictures by people who aren't particularly computer literate and just want to send you a picture. Say, if you're calling up for a car for sale on the other side of the country.

Personally, I wouldn't deploy anything new on MMS.</comment></comment>


New 'Brexit Party' fails to register domain, gets claimed by pro-Remain group - <AUTHOR> https://mashable.com/article/brexit-party-domain-pro-remain/ <comment><USER2> Pretty clear case of domain squatting, as they do not posess the same org name and clearly did this out of spite. Clever, but not sophosticated. I can imagine they have a strong case with icann.</comment>


SnailTrail: Critical Paths for Online Analysis of Distributed Dataflows [video] - <AUTHOR> https://www.youtube.com/watch?v=h5kPd59v0U0 <comment><USER2> Link to the (open access) paper: [https://www.usenix.org/conference/nsdi18/presentation/hoffma...](https://www.usenix.org/conference/nsdi18/presentation/hoffmann)

</comment><comment><USER3> Oh man, what an unfortunate name. Is this intentional?

[https://www.urbandictionary.com/define.php?term=snail+trails](https://www.urbandictionary.com/define.php?term=snail+trails)</comment>


Mikko Hypponen: How the NSA betrayed the world's trust - <AUTHOR> http://www.ted.com/talks/mikko_hypponen_how_the_nsa_betrayed_the_world_s_trust_time_to_act.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TEDTalks_video+%28TEDTalks+Main+%28SD%29+-+Site%29 <comment><USER2> I especially liked the quote Mikko made from Marcus Ranum:

"United States is right now treating the Internet as it would be treating one of its colonies. So we are back to the age of colonization, and we, the foreign users of the Internet, we should think about Americans as our masters."

No one likes the feeling of being suppressed or colonized. I think this bad feel can be used to mobilize larger masses in demanding a future with much more controlled and transparent surveillance.

</comment><comment><USER3> Thank You for posting my talk.

<comment><AUTHOR> Thank you for the insightful talk, Mike.</comment></comment>


ESL - compiler for new programming language - <AUTHOR> http://code.google.com/p/esl/

<comment><USER2> I like the idea of a new language to replace C for embedded programming.

The name has some amusing connotations for me: when I started school in Canada, ESL stood for "English as a Second Language". Since I didn't know the language at all, I spent a couple of years in ESL programs in primary school.

The way records are implemented is nice. It's essentially an extensible product type. However, since you already have product types, you may as well get sum types! These are fairly useful and have a natural symmetry with products.

The particularly interesting thing to look at is how sum types could have sub- typing. With records, sub-typing is very simple. If you have a record with fields a and b, it has accessor functions:

       record -> a
       record -> b

Now you can define a record with an additional field; let's call this record1. This type has _three_ accessor functions:

        record1 -> a
        record1 -> b
        record1 -> c

Since the first two have to be the same as for record, you can use this wherever you could use a record. Since the memory layout is going to be consistent between the records (since you can only add fields to the end), this is also very natural to implement. (Now, _arrays_ of records are a different story!)

We can now write that record1 <: record, or that record1 is a sub-type of record.

Sum types are, in a sense, the opposite of products. This is, in fact, a mathematical fact to do with duality[1][2]. More particularly, a sum type contains an element of _one_ of the sum's types. So a sum of a and b contains _either_ an a or a b. An important thing to note is that the alternatives are _tagged_. That is, if you have a sum of int and int, the two ints can be differentiated because the sum type keeps track of which one (left or right) it was constructed with. This corresponds to a disjoin union in math.

[1]: <http://en.wikipedia.org/wiki/Dual_%28category_theory%29> <br /> [2]: <http://blog.ezyang.com/2012/10/duality-for-haskellers/>

Where records have accessor functions, sum types have constructors. Let's imagine a sum containing a and b:

        a -> sum
        b -> sum

Essentially, we just took the record's functions and flipped them.

When we use a sum type, we have to match against the possible cases. So we need a case statement that has a branch for each possible type in the sum.

So what happens if we try to define sub-typing the same way as for products? We would get that sum1, which contains a, b and c, is a sub-type of sum. That is, sum1 <: sum. However, this doesn't work! A sum type contains a value of _one_ of the types, and you don't know which one at runtime. So if you used a sum1 where you expected a sum, and the sum1 contained a value of type c, you wouldn't know what to do. In fact, we _also_ need to flip the sub-typing relation. So instead of sum1 <: sum, we get sum <: sum1. That is, wherever you could use a sum of a, b and c, you can use a sum of just a and b.

Now this makes sense. Whenever you write a case statement for a sum of a, b and c, you have to have cases for a and b. So if you pass in a sum that could only have options a and b, you can obviously handle it.

So a sum type would fit naturally with the existing product types. But would it be useful? I believe it would. Now, I'm no expert in low-level programming. However, I believe there is a somewhat common idiom in C that looks something like this:

        struct sum {
          int tag;
          union value {
            float a;
            int b'
          }
        }

This is essentially a way to get a proper sum-type out of a union. A normal union is somewhat hard to work with; you usually want to know which type it currently contains. That's what the tag does. In essence, you've just implemented a real sum-type in C.

Now, this pattern isn't used _too_ often, but I think it _is_ useful. The main reason you don't see it much is that it's fairly complex and not immediately obvious--especially to somebody not familiar with sum types. However, if it was part of the language, I imagine it would see more use and make some code easier to write and less bug-prone.

Also, it seems the language does not have any way to replace C's union. So a sum type would be a natural and safer replacement, giving ESL more parity with C without sacrificing convenience.

</comment><comment><USER3> I clicked the link expecting to find more about the language, but instead of the hello world or any other example, it was just a wall of text. Tried clicking around to find some example code, but no luck. I still have no idea how the code looks like.

This is not how one should mark new language.

<comment><AUTHOR> Under the downloads <http://code.google.com/p/esl/downloads/list> there is a reference manual [http://code.google.com/p/esl/downloads/detail?name=ESLProgra...](http://code.google.com/p/esl/downloads/detail?name=ESLProgrammingLanguage.pdf&can=2&q=) and examples [http://code.google.com/p/esl/downloads/detail?name=esl- examp...](http://code.google.com/p/esl/downloads/detail?name=esl- examples.tgz&can=2&q=)

</comment></comment><comment><USER4> Awesome, it's definitely an improvement on C from what I can tell.

If you're looking for examples, check out its source: [http://code.google.com/p/esl/source/browse/#svn%2Ftrunk%2Fsr...](http://code.google.com/p/esl/source/browse/#svn%2Ftrunk%2Fsrc)

I think the world needs more better C's, C++ sucks. It's old technology, now matter how much it's amended.

A C replacing language is in my opinion a language that: Is not (implicitly) garbage collected, makes use of a preprocessor, allows explicit memory access and passing hints to the compiler, allows inline ASM.

What else should be a feature of a C replacement?

</comment><comment><USER5> Seems to be a cross between C and Go; It uses a simple syntax much closer to Go's than to Cs, but keeps control at the C level - e.g., no garbage collection.

Nice work.

</comment><comment><USER6> CPlus - <https://github.com/orangeduck/CPlus>

Good to see.. these developments..</comment>


Nearly all binary search and merge sort implementations are broken (2006) - <AUTHOR> http://googleresearch.blogspot.com/2006/06/extra-extra-read-all-about-it-nearly.html <comment><USER2> _It is not sufficient merely to prove a program correct; you have to test it too. Moreover, to be really certain that a program is correct, you have to test it for all possible input values, but this is seldom feasible._

This statement is tantamount to saying "you don't merely need to prove Fermat's Last Theorem, you also have to test it for all possible input values". By this line of reasoning, most of mathematics should be thrown out.

If you've proven a program correct, _it is correct for all input values_ , whether you have tested them or not. If your proof ignores complexities such as the range of data values, it isn't a correct proof to begin with. And yes, proving programs correct is often possible -- in fact, the highest levels of software verification actually require explicit proofs of correctness for much of the code; see [http://en.wikipedia.org/wiki/Evaluation_Assurance_Level#EAL7...](http://en.wikipedia.org/wiki/Evaluation_Assurance_Level#EAL7:_Formally_Verified_Design_and_Tested)

<comment><USER3> Mathematics sits atop a very small set of trusted axioms. Computer hardware is not so reliable; the parts are made in China as cheaply as possible. So even if you've proven something correct in theory, it doesn't matter because of all the additional variables that the real world introduces.

The big insights in computer science look very much like mathematics; the mechanics of a binary search work perfectly in theory. But in practice, it's easy to make a simple mistake in implementation and accidentally throw your proof out the window. The proof remains valid, but your implementation isn't doing what the proof says.

The fact that a famous book on proving correct and then implementing a binary search ended up being slightly wrong underscores how easy it is to make this mistake. (I find binary search a little annoying because of the integer division. Do you round up or round down? What does your language implementation do? Now you see why you need to mentally prove that you've written the right algorithm, and then test to make sure your computer is doing what you think you're telling it to.)

<comment><USER4> Actually most bugs are being introduced in the translation between pseudocode and your working programming language. For instance pseudocode does not deal with 32-bit integers that can overflow.

But that's not the fault of the algorithm, or the fault of its proof and it also has nothing to do with the origin of your computer parts.

Also, the "mechanics" of binary search work perfectly in practice. I see no evidence to the contrary, either in your comment or in the above article and that same implementation described works perfectly in Python.

<comment><USER5> Upvoted for the first two paragraphs, but I can't make sense of the second sentence of the third paragraph. The algorithm given in the article works in Python because Python has different overflow behavior than Java, C, or C++. When you say you "see no evidence", it seems like you are saying the implementation given in the article _does_ work in Java etc.

<comment><USER6> Technically, the naïve implementation is perfectly fine for C/C++, so long as size_t is at least 268 bits long on your platform. :)

</comment></comment></comment></comment></comment><comment><USER7> Previous, extensive discussion: <http://news.ycombinator.com/item?id=1130463>

I once ran a programming challenge based on this, but I discontinued when I started to get threats of physical violence from people whose code didn't pass the tests.

The Dictionary of Algorithms and Data Structures on the NIST site has a correction I submitted on exactly this point:

<http://xlinux.nist.gov/dads/HTML/binarySearch.html>

And my blog post: [http://www.solipsys.co.uk/new/BinarySearchReconsidered.html?...](http://www.solipsys.co.uk/new/BinarySearchReconsidered.html?HN)

</comment><comment><USER8> An interesting article that links back to this one:

[http://reprog.wordpress.com/2010/04/19/are-you-one-of- the-10...](http://reprog.wordpress.com/2010/04/19/are-you-one-of- the-10-percent/)

The claim is that even ignoring overflow, only 10% of programmers can correctly implement a binary search. When I tried it, I thought I got it working, but it was later pointed out that I didn't handle empty lists correctly.

Programming correctly is hard.

<comment><USER9> I hope that means "10% get it right first time" and not "only 10% can do it at all, even given a computer and a whole day to do it."

Couldn't resist that challenge (although the thread is nearly 2 years old.) I think mine works, at least it gives the right answer for all my test cases.

<comment><USER10> It's even hard to come up with all the relevant test cases - if you miss a corner case in the implementation, it is likely you will oversee it also in the test case generation. Only an exhaustive search would somehow be able to discover this.

With e.g. templates in C++, this is possible in some cases. You can test a template version using the limited range of an unsigned char, while your real implementation will use a uint64.

But instead of implementing e.g. a binary search, I prefer to take a proven implementation from e.g. the STL and adapt it for my needs. Experience and programmer lazyness have taught me this is a good way :)

</comment></comment></comment><comment><USER11> While true, it seems that if your array is _that_ close to the inherent size limit in indexing by ints, this is at most a temporary fix. How fast does your sorting requirements go from 2^31 to 2^32? It seems that you should be using size_t here, not int.

<comment><USER12> size_t is actually 32-bit on some 64-bit platforms; you want uint64_t.

<comment><USER13> If that's true, that's a bug in the platform, not the program. The whole point of size_t is to be however many bits you need to represent the size of things in your address space.

</comment></comment></comment><comment><USER14> Nice to see that the Go gets it right:

            func Search(n int, f func(int) bool) int {
                    // Define f(-1) == false and f(n) == true.
                    // Invariant: f(i-1) == false, f(j) == true.
                    i, j := 0, n
                    for i < j {
                            h := i + (j-i)/2 // avoid overflow when computing h
                            // i ≤ h < j
                            if !f(h) {
                                    i = h + 1 // preserves f(i-1) == false
                            } else {
                                    j = h // preserves f(j) == true
                            }
                    }
                    // i == j, f(i-1) == false, and f(j) (= f(i)) == true  =>  answer is i.
                    return i
            }

[http://code.google.com/p/go/source/browse/src/pkg/sort/searc...](http://code.google.com/p/go/source/browse/src/pkg/sort/search.go?name=weekly.2012-01-27#57)

<comment><USER6> I expect at least one of the Go authors was well aware of this very incident (the Java breakage), it was fairly well publicized before Go ever saw the light of day.

</comment></comment><comment><USER15> Bypass the borked formatting (original is JS dependent; link below is to Google text-only cache):

[http://webcache.googleusercontent.com/search?strip=1&q=c...](http://webcache.googleusercontent.com/search?strip=1&q=cache:http%3A%2F%2Fgoogleresearch.blogspot.com%2F2006%2F06%2Fextra- extra-read-all-about-it-nearly.html)

IIRC, this made the rounds a few years ago, in case it sounds familiar.

<comment><USER16> Thanks. The site is so broken on the ipad, asks if you want a static view which goes to the front page, or an "unsupported" dynamic view which actually turns out to work and is the same page. Google this is so broken! Just make html that works in a browser!

</comment></comment><comment><USER17> I'm tempted to solve it with:

      low/2 + high/2 + (low & high & 1);

That side steps the overflow condition completely.

<comment><USER18> It would sidestep the overflow, but _prima facie_ it appears to be slower than the provided:

        low + (high - low)/2;

Your solution takes, depending on the architecture, between several more and nearly double the trips to the ALU.

Gimmie a sec; I've got bugger all to do at work. I'll compile it and profile it.

<comment><USER17> Would be interested in seeing the profile. Re-ordering it to the following (which the compiler might do too)

      low&high&1 + low>>1 + high>>1

Should compute in a single cycle if the register coloring is working in the pipeline. The <reg> >> 1 come out of the barrel shifter stage, the low&high&1 resolves in the load, so you end up with a single sum of three operands. Since its being stored in a separate register that would avoid a write stall in the pipeline as well.

</comment></comment></comment><comment><USER19> I'm tempted to suggest that the fixed C/C++ version is still not correct with respect to this issue, namely on architectures where INT_MAX == UINT_MAX. (Or really INT_MAX <= UINT_MAX < 2 * INT_MAX, which is valid in C99 for INT_MAX >= 65535.)

<comment><USER20> INT_MAX == UINT_MAX is the only valid failing case, because elsewhere in the standard integer types are restricted to pure binary representations. This means that if UINT_MAX is greater than INT_MAX, it must be at least INT_MAX * 2 + 1.

<comment><USER19> That can't actually be taken for granted, relevant Usenet discussion begins here:

[http://groups.google.com/group/comp.std.c/browse_thread/thre...](http://groups.google.com/group/comp.std.c/browse_thread/thread/6f1c599324bb2c2e/cd31b3e5003c45f9)

<comment><USER20> I concur with Dan Pop's interpretation.

</comment></comment></comment></comment><comment><USER21> I don't like the index variables and splitting in half part. I like to write my binary searches with bit patterns:

1) figure out the number of bits required to cover the largest index (= a little bit of cheap bit-twiddling)

3) initialize your index to 0

2) flip a bit on in index, starting from the highest bit available from step 1)

3) if data[index] is smaller than what you're looking for, leave the bit on

4) try with the next-lowest bit and loop to 2) until at bit #0

It's pretty easy to write it out in a way that's just obvious, instead of requiring the reader to wrap his mind about which variable is the lowest and highest bound and whether the indexes are inclusive/exclusive in which ends, etc.

<comment><USER7> That's really cool - would you care to post some example code so we can see the clarity obtained by this novel approach?

Did you come up with it yourself, or did you see it somewhere else?

<comment><USER22> I think one of Jon Bentley's "Programming pearls" books contains a version of binary search that works more or less that way and shows how to get there from a naive and more obviously correct implementation by successive small transformations. IIRC it ends up having a particularly tight inner loop. And it doesn't, I think, require a power-of-2-sized array. My copy of the book is at home and I'm at work so I can't check any of my recollections right now.

<comment><USER7> You're right - Programming Pearls, column 8 "Code Tuning." It's not quite like this, and it's in some variant of BASIC, but when you squint, it's there.

Thanks.

<comment><USER22> You're welcome. In the second edition, which is what I happen to have, it's column 9 (because the old column 4 got split into two) and the code is in a pseudocode that's much more like C with the semicolons deleted than like any version of BASIC.

I wasn't quite right to say that the inner loop is very tight; rather, the code assumes a particular size of array and unrolls the loop completely. But, indeed, the size doesn't need to be a power of 2.

Here's the (pseudo)code, in case anyone cares. It's for an array of size 1000. I've changed a variable name from "l" to "m" because of the usual l1I| thing. I've removed a couple of helpful comments because anyone who cares enough to bother reading them will probably have more fun figuring everything out on their own. I've also elided some obvious repetitive code and formatted it slightly differently from Bentley. Any errors in the code were probably introduced by me.

      m = -1
      if (x[  511] < t) m = 1000-512
      if (x[m+256] < t) m += 256
      if (x[m+128] < t) m += 128
      /* ... */
      if (x[m+  2] < t) m +=   2
      if (x[m+  1] < t) m +=   1
      p = m+1
      if (p>1000 || x[p]!=t) p = -1 /* i.e., not found */

Bentley says this is "not for the faint of heart". I agree, but I do think it's lovely. Though personally I'd be inclined to use a value of m offset by 1 from what Bentley does (initialize to 0, look up m+255, m+127, etc.) and save a line of code and a couple of cycles.

</comment></comment></comment></comment></comment><comment><USER23> This bug requires either (1) low/mid/high are pointers [edit - I don't think this is valid; IIRC pointer arithmetic is only sane for add/subtract an int from a pointer, not divide a pointer or add two pointers]; or (2) item_count > INT_MAX / 2, which means memory_size >= sizeof(your_array) == sizeof(item) * item_count > INT_MAX / 2, which means either 1-byte or 2-byte array elements, or that your ints are smaller than your pointers. So is it really "nearly all"?

<comment><USER24> The author is claiming that nearly all binary search implementations are wrong under those specific conditions, not that binary search implementations are wrong under nearly all conditions.

<comment><USER23> ...bah. I keep forgetting that 64-bit C/C++ compilers are generally LP64 (or even LLP64) instead of ILP64, so "int" being possibly too small is in fact typical.

Still. In the example (Java) implicit down-converting isn't allowed, so this is a result of the spec putting arbitrary limits on array size (must be indexed by nonnegative 'int' values). In C or C++ there is no such limit and I think more modern compilers (llvm) will give a warning on loss of precision, so either you have that warning ignored/disabled/unavailable or you have 32-bit code with a billion-element array. I guess what I'm thinking with this is, with a sane language/compiler, the only way to trigger this should be to fill half of your theoretically-logically-addressable memory with an array with single-byte elements.

</comment></comment></comment><comment><USER25> I don't understand why I need Javscript enabled to merely read a blog post on blogspots.

<comment><USER26> To be fair, there's a classic version (but the link to it discards the article id, for some unfathomable reason).

This works: [http://googleresearch.blogspot.com/2006/06/extra-extra- read-...](http://googleresearch.blogspot.com/2006/06/extra-extra-read-all- about-it-nearly.html?v=0)

</comment></comment><comment><USER27> _The general lesson that I take away from this bug is humility: It is hard to write even the smallest piece of code correctly, and our whole world runs on big, complex pieces of code._

It surely does if everyone has to write their own binary search implementation when most standard libraries have one and several of them have one that is flexible enough (either due to the language's features or the binary search routine itself) to not just search through a container but through a solution space in an optimization problem. So I'm surprised the author hasn't concluded with the lesson that would be somewhat more practical: _It is hard to write even the smallest piece of code correctly_ , so don't do it and use whatever's in your stack unless you have a good reason not to.

</comment><comment><USER28> Why are overflows silent?

Shouldn't use cases where you want the overflow behavior be more explicit?

</comment><comment><USER29> So C, C++, and Java don't have good support for arithmetic. What else is new?

<comment><USER30> +1, this has nothing to do with binary search and everything to do with the fact that almost any application written in those languages will have bugs that do not show until numbers nearing INT_MAX are used. Another given is that all applications that use recursion is bound to run into stack overflow errors/bugs when used on big data.

</comment></comment><comment><USER9> Almost the same bug: [http://code.google.com/p/guava- libraries/issues/detail?id=61...](http://code.google.com/p/guava- libraries/issues/detail?id=616)

</comment><comment><USER31> an old story but still well worth the re-reading</comment>


Python dictionary algorithm and hash table vulnerability (history view) - <AUTHOR> https://www.vladimircicovic.com/2020/05/python-dictionary-algorithm-and-hash-table-vulnerability <comment><USER2> I think this is only about historic vulnerabilities from many years ago. I don't see anything about a new vulnerability.

<comment><AUTHOR> True - I just explained history and facts. Did does not want to have a title that sounds as this still exists. In the end it is explained.

<comment><USER2> That title tweak clears things up - thanks!</comment></comment></comment>


Ask HN: Looking for Beta Testers for CallStop, a 100% Effective Robocall Blocker - <AUTHOR> Hacker news recently requested a solution to the robocall epidemic. I've created one that is 100% effective and uses number forwarding, temporary PINs and whitelist requests. The app is called CallStop and will be released on iPhone first.
I'm looking for Beta testers. The app takes 30 seconds to set up and will block 100% of all robocalls forever. It can be easily toggled to let anyone reach you whenever you want. You can also set and manage direct PINs from within the app which you can then throw in your email footer, Slack, or wherever people reach you from the most.
You can drop an email in the form here and I'll send out invites in the near future: https://www.callstop.com/
In case you're curious, here's the default message unknown callers here when calling you once CallStop is set up: https://gainsboro-flounder-4736.twil.io/assets/Default_Placeholder.wav
This is easily customizable from within the app and you can record your own personalized message. The product has a similar interface to WhatsApp.
There's no cost to try or use CallStop right now, but I may have limited Beta spots. I want great feedback and to keep improving it.
It's just like Adblock, but for phone calls. See the comment section for a brief technical explanation, and try it out by calling: 650-300-0574
Thanks everyone. <comment><USER2> It looks like this app is based on whitelisting. While this would indeed be 100% effective at stopping spam calls, it would also be 100% effective at stopping urgent calls from numbers that you're unfamiliar with. For example:

\- A hospital or police department calling to tell you that your spouse has been injured in an accident.

\- Your doctor calling you back from one of several outgoing lines in her office whose number you don't know.

Do you want to rely on these callers being able to figure out how to get through your spam blocker in an emergency? They're calling from landlines, so they also can't text you or receive a text from your app.

<comment><AUTHOR> To solve this issue, I've included:

The ability to set PINs, which means people who know your number but aren't whitelisted can reach you at any time (think doctor, police, school, etc).

When you list your number on any form just include a PIN. You can add as many PINs as you want and include a description for each.

When calling a CallStop number, an unknown caller hears this default message:

"You have reached a phone number protected by CallStop. If you know this person, press 1 to send a whitelisting request with a quick note. If you have a PIN to reach this person directly, press 2 and enter the PIN."

<comment><USER2> How would the police who pulled your spouse from a car wreck know your PIN?

How would someone store your PIN in a contacts list that didn't include a field for a PIN?

This system places obstacles in the way of someone who may need to reach you urgently. Is that a good tradeoff to make for not receiving spam calls?

<comment><AUTHOR> >>How would the police who pulled your spouse from a car wreck know your PIN?

You need to let organizations know a PIN. Later on, automated channels and PINs can be created that each user opts into--like whitelists for public services (police, government etc.). Those could work with automatic notifications/updates for those organizations. You could also opt in to whitelist certain numbers on signup (like public services) once SHAKEN/STIR is ready (so that commonly whitelisted numbers aren't spoofed). I understand I'm describing a long term solution and I'm being very idealistic here.

>>How would someone store your PIN in a contacts list that didn't include a field for a PIN?

PINs are for organizations and groups to store. Contacts are to be used more in scenarios with whitelisting. You may be able to store contacts with PINs that you can dial, but I haven't had time to play around with the pause functionality in Apple contacts yet. I think organizations will easily store PIN info.

>>This system places obstacles in the way of someone who may need to reach you urgently. Is that a good tradeoff to make for not receiving spam calls?

More than half of all calls are spam calls. In my mind it is. I used to get 5-10 spam calls every day. But, that's part of the reason I'm running this test :)

</comment></comment></comment></comment><comment><USER3> iOS 13 has a setting built-in that if it's on, it only allows calls through if they're in your contacts. Otherwise the calls go straight to voicemail and still show up in your recent calls.

I hope you know this. You can see this in the Beta builds.

<comment><AUTHOR> I do. I've talked to lots of people and the problem with that solution is that if you work with large groups of people, they can't get through. That's why the PINs feature is useful. Lots of people work with supplies, business networks, etc so they can't just reject non-whitelisted people.

Also, whitelist requests are effortless with CallStop. I don't think Apple's solution has any concept of that.

There's a lot more that could be added to CallStop too. Think about limiting the number of times a certain number could call you (think your internet provider, etc.) and also automatically implementing time based rules (you can only be reached for work between hour x and hour y daily).

</comment></comment><comment><USER4> I'm curious how it works technically. I thought Apple did not allow Apps access to the phone functionality.

<comment><AUTHOR> It doesn't need to have access to Apple's functionality.

Try pulling out your phone and dialing *72 followed by another number. It will forward your device calls to the number you dial.

That's the key here. You forward your device number to CallStop, which uses VOIP Pushkit to receive calls. In that way, each CallStop user can set code level rules on who can reach them and when. It's like a firewall for phone calls.

Here's a sample number you can call to try this out: 650-300-0574

You should be able to get a good idea of how the service works by selecting different options when calling it. Try pressing 1 and check out the text you get to add a whitelisting note, or 2 and try entering a PIN. CallStop users get push notifications for whitelist requests and rejected calls.

One of the cool implications if a service like this is adopted is that phone numbers for anyone can be public and it will no longer matter.

<comment><USER5> Will *72 forward SMS messages as well?

<comment><AUTHOR> No, just phone calls. With CallStop: You receive incoming calls through CallStop. You can make outgoing calls as normal through the Apple app, and also I've added outgoing calling functionality into CallStop. Texts are not forwarded, though this is something I'm researching for future features. Text spam is the second thing to eliminate here.</comment></comment></comment></comment>