Hacker News Reader

Good advice. Remember, people may not care about the code as the company is folding. But if it turns into something and money starts to flow then people's memories become foggy.

> Sanitize servers ...

A side note here: that can be impossible on a cloudy service where your data may have moved between many nodes over its life, and difficult to guarantee in other circumstances. On future projects consider encryption at rest for all data then all you have to worry about is destroying all copies of the relevant keys. Still try a wipe at the end of course, in the name of security in depth, in case there are keys errantly floating around out there.

If you are performing a secure wipe, don't go OTT with 37 sequenced passes (if your threat model "requires" that then you have other matters to concentrate on!) don't make the final stage zeros: fill the volumes with cat pictures/videos, or if you are feeling evil use shock images instead. Give the cracker that tries to poke around something to look at!

> ... and services by trying to overwrite data with junk values before canceling

Also impossible unfortunately, though again you should try if only to show due diligence. Always assume that once your data is out there it is out there for good. Just like a delete is not often a real delete (just a soft delete where a "deleted" flag is set), an update often only affects the current value leaving it and any previous values still present in history or audit structures.

(not that I'm saying this piece of your advice is bad, I just feel it just needs a few caveats to be explicitly stated)

Yes. Do the best you can. Especially if they use something like paper_trail on Rails or other soft deletes. Maybe ask to the vendor to search/purge databases/files and overwrite free disk space manually too.

For certain types of data and with experise, it might be wise to run your own servers (colo) and encrypt the drives. After surviving to a certain scale, you'll want to save money by running hybrid bare metal+cloud anyhow. Then, you'd have control to nuke your servers (DBAN), local snapshots and encrypted backups. Hybrid infrastructure should allow pinning systems to prevent migrating to or sending snapshots to third-parties.

> Do the best you can.

Aye. While guaranteeing the information is absolutely gone is often impossible, you should at least do what you can make it more difficult to retrieve or be accidentally revealed.

> and encrypt the drives

If you are using VMs then full disk encryption within the VM will work just as well, and most cloud services can offer effectively the same thing with their containers.

You just have to be very careful with key management, which in some cases may be inconvenient (blocking restart until you intervene to provide keys, if you don't want them stored on or directly accessible by the same provider) depending on how paranoid you feel the need to be. Of course if you are truly paranoid, by character or by contractual necessity, keys in memory on shared infrastructure even temporarily could be an issue at which point you need "dedicated cloud" resource or colo/self-host for the affected parts of your apps/infrastructure.

I'm a little confused because this doesn't seem to answer the question OP is asking: how to sell the code he's been left with as a part of the wind-down.

My takeaway was don’t try to sell the software you have. Try to find a problem someone has (and will pay you to fix) and try to fix it.

Sad to say it, but a bunch of code from a failed startup is probably nearly valueless without context. I think that motivates an answer based on extracting value from it combined with the context on it that a founder has.

Oh, agreed, but it would have been nice if the top-rated comment in the thread actually explicitly said that ;)

You should note that OP actually asks three questions: #1 What now #2 Should OP contact the startups #3 What to do first, while also adding they don't know what's involved in selling a resource like this.

If they wanted a detailed question of what to do AND WHY, they could pay a consultant. A consultant would go over around the same points as duelingjello, but also explain why. As an Internet forum answer, it honestly goes above and beyond.

The answer basically strips into two -- first get rid of any and all 'ball and chain' from the old company, existing customers setups and data. Then put the IP to work, making money.

The answer does skip over the general unasked question of "Can I just sell the code?" to which the answer is generally "no." You'd need an existing enterprise or source that knows the code, wants the code and can use the code, which in the modern age is just not going to happen: Startups come and go and everybody wants to make their own solution. Most engineers I know would look at "existing code" as bloat or a hindrance in general, and would look at it as "a sales team problem." If anything, you'll get peanuts for selling the actual code itself.

Building a new enterprise that has a technical team to handle the code and a sales team to sell the code, potentially with an existing customer base sounds like a much better plan. Does it involve risks? Yes. Does it still answer OP's question of wat do? Absolutely.

It costs $500/yr to run an LLC (Incorporation/renewal fee, registered agent, and a P.O. Box), unless you have no assets and don’t plan to have any assets in the next 2 years then I would strongly recommend incorporating before you have any sort of liability.

All it takes is one oops at a client to have a $1m judgement hanging over your head. LLC (in your state, don’t get fancy) sooner than later. Business insurance is typically another $500-800/yr for software startups, but I wouldn’t recommend that until you have something to protect (like money in the bank)

Do you happen to know how much for a Delaware C Corp?.

I.e. not the formation, but year to yeat maintenance?

For the pure maintenance of the company we spend like 300-400 bucks.

Do you need a CPA or do you use tax software?

We use Vcorp Services

You also need to maintain out-of-state business registration in the state you reside. I would not get fancy until you can afford a CPA to ensure this is all up to date

Unless you’ve studied it, you might be surprised to learn that as a principal an LLC is not offering you the kind of protection you imagine. It basically protects investors. IANAL but was surprised myself when one explained it to me.

Maybe you misunderstood? The LL in LLC stands for limited liability after all. Other than your capital contribution, and assuming no fraud or incompetence, there will be personal liability protection.

Piercing the corporate veil is a thing, though. I don’t know the details as I’m neither a lawyer nor a company owner, but my understanding is that you have to keep your and your company’s assets and activities completely separate, which requires a level of discipline that many people don’t have.

Similarly, as a single-person company, any action that could cause liability was presumably performed by you, personally. That makes it much easier for a litigant to sue you personally instead of/in addition to your company.

Absolutely true, and it is true regardless of whether you use an LLC, S, or C Corp.

If none of the more complicated strucures will provide the liability protection that you're going to need, there's also the possibility of doing business as a sole proprietor/DBA. You get no protections at all, but the reporting requirements are much reduced (in some cases, just filing a 1040).

The second can only occur because of the first. It’s also why I said keep a bank ledger :)

I don't know about LLC but in Germany there is something very similar called GmbH. Which does provide you with limited liability for many _but not all aspects_. So always consult a lawyer with specialization in that area about liabilities not covered. I have heard about startups which founders did run into some of the non covered liabilities leaving them with a large amount of dept which they could have partially avoided as far as I heard.

„So always consult a lawyer with specialization in that area...“ as german as it gets...

The core of this is financial liability. Whether that is extremely helpful, or just somewhat helpful depends on the context. I can't think of many cases where you wouldn't want to have an LLC, or Limited Company (UK), or whatever the equivalent is.

Creating one can help enforce some separation too: different bank accounts, different AWS accounts, etc. This feels pretty good, unless the company is some tax dodge which also places increased transparency on some things.

Whatever someone does, they can make a fair attempt at running their business professionally and it will limit significant risk and liability. This means taking boring paperwork and bureaucracy seriously. It means recognizing mistakes and fixing them before they get serious. Good companies don't generally get sued and lose. You can also seek outside advice so that you make better decisions. When you take reasonable measures these will get recognized when you are in a situation.

Ok, I’ll google it for you. But I do encourage you to talk to your attorney so you can pay for her bad news like I did.

“ Personal Liability for Your Own Actions

There is one extremely significant exception to the limited liability provided by LLCs. This exception exists in all states. If you form an LLC, you will remain personally liable for any wrongdoing you commit during the course of your LLC business. For example, LLC owners can be held personally liable if they:

personally and directly injure someone during the course of business due to their negligence fail to deposit taxes withheld from employees' wages intentionally do something fraudulent, illegal, or reckless during the course of business that causes harm to the company or to someone else, or treat the LLC as an extension of their personal affairs, rather than as a separate legal entity. Thus, forming an LLC will not protect you against personal liability for your own negligence, malpractice, or other personal wrongdoing that you commit related to your business. If both you and your LLC are found liable for an act you commit, then the LLC’s assets and your personal assets could be taken by creditors to satisfy the judgment. This is why LLCs and their owners should always have liability insurance.”

That makes sense though, and is what I always thought. Proctects you as an honest and competent employee of the company from liability, assuming you're acting in good faith, from the actions of the company. Why on Earth would anyone think it's a blank check for any behavior?

And the same is true of S and C corporations. There is no legal structure that is going to protect you individually from wrongdoing.

This is not just about breaking the law. Being negligent can cause personal liability. This is the kind of liability people often think the “LL” protects them from.

It costs $500/yr to run an LLC

Your advice to register an LLC is very good. I’ll add:

1) Costs are very state specific. And if you register in the state you live in you can act as your own registered agent and eliminate a lot of the yearly fees. In my state I can register directly for $90 with the Department of State (of my state, not federal) and there are no recurring fees.

2) Follow the rules by keeping all finances separate or you might as well not have registered the LLC.

Do not skimp on your llc. I said $500 to protect yourself. You can go the cheap route but then your name is associated with your business and scams come out the woodworks. Plus it’s hella unprofessional and You may miss out on contracts because you don’t meet their vendor reqs

All good advice. I'm especially a fan of:

> If it was good, don't let the team relationship go to waste. Talk with whoever's left / worked-with previously about doing something else.

Some of my best times at work have come from the relationships left after the company crashed and burned. Companies disappear, people don't have to.

> First employees should get ~1% equity, more if it's an employee-owned co-op.

I would be interested if anyone knows more about how the co-op idea would work, also assuming you took investment. Would a corporation be formed as well as a co-op, and the co-op would be a shareholder in the corporation?

There are many ways to slice the pie, and I would offer that a better way would be to give profit percentage instead of equity.

When it comes to making decisions many employees won't care too much about the direction, and will slow down the process.

Give your employees a fair share, but keep ownership amongst the founders.

Most sensible people are going to want shares, also not having shares is counter to the whole HN SV ethos

1 By definition equity and dividends must be shared equally between all members of a coop 100 members = 1%

2 Structure the way I have seen this work the coop owns the company (or a controlling interest) which employs the members of the coop

Coop structures can get complex normally most countries have special laws for this and it can be tax advantageous.

Coops can take outside investment but they have to maintain 50% +1 shares to remain a coop

As far as I know, if your company has 10 employees, everyone owns 1/10 of the company. If you hire someone else, everyone, even the new person, owns 1/11 of the company.

The idea is: shares aren't devided by capital, but by heads.

But you can usually add some clauses to the contracts, that people have to work for some kind of period, before they are considered "comrades".

This list will help me with all the steps I need to consider now, later and in the future.

Thank you duelingjello. I have a lot to learn and it's becoming obvious I need some time to grow and this will definitely help me.

The second half of this is just great advice for all startups.

Great advice. I think you just wrote the howto for doing a pivot.