How I Made $350 In Two Days With Three Pages and Some Payment Code | Hacker News Reader

How I Made $350 In Two Days With Three Pages and Some Payment Code

dshipper.posterous.com

224 pointsdshipper84 comments

I've noticed a recent trend of self-promotion that I don't understand. I'm not writing to criticize, I just want to know why you say some of the things you do.

For instance, you call yourself a "rising sophomore". What does this mean? How is it different from any other sophomore? Can you explain why you chose that word and what the impression you intended to convey is?

Also, I love that you made a product like this quickly. In reading your story I noticed something you did right that I totally would have done wrong, and I appreciate being reminded of it. I applaud your gumption.

But then I clicked thru to the website and saw: "Our team of web usability experts has put together a comprehensive survey". So, do you have a team of web usability experts behind domain polish? I'm assuming it is your solo project. Why not say "Our carefully crafted, comprehensive survey" instead? Do you think that would really kill your sales that much? Do you have any qualms about saying you have a "team" of "experts"?

Notice, I'm not passing judgement... I'm asking questions because I want to understand your thinking, and also I find this alien culture of the "kids today" baffling and mystifying. :-)

"Rising" sophomore (or junior or senior) is a common U.S. expression. It just means he'll be a sophomore when school resumes this fall. There's no self-promotion, it is just used by students during the summer break.

It's common? Where? I'm from the US and I was put off by the statement as well.

Google rising sophomore, "rising senior" etc. Millions of results, common usage, neutral meaning.

I googled "rising senior" and got under a million results. Even more telling, the very first result was title "What is a rising senior?"

It's also worth pointing out that I'm US born and bred, spent 7 years at universities and was unfamiliar with the term. It sounded pretentious to me.

I've certainly heard it and used it many times. When asking "what year are you?" over the summer it's vague to just say "sophomore" or "junior" and long-winded to say "I will be a sophomore in the fall".

I live in DC and that's what every summer intern says, it avoids the "Oh did you just finish sophomore to become a junior in 3 months, or just finish freshman to become a sophomore?" follow-up question.

It's a useful expression when you deal with college students over the summer.

I've heard that and used it hundreds of times. It is a completely normal expression on college campuses.

That was a great read, very interesting.

I have to take issue with one point. It says:

    I've made $350 to date. All from three pages
    and some payment code.

Sounds brilliant, and it's the title here. Earlier, however, it says:

    I was scrambling to fill orders. I had a huge TextEdit
    file open with customer names, site URLs, and email
    addresses. I sent every email, and set up every survey
    by hand.

So, the three pages and the payment code were the structure, and in truth, you were doing the work.

    By 6 am I had completed processing every order and went
    to bed. I got up an hour later for work at 7 am. 

    ... 

    So now I’m sitting here writing this blog post with a
    bunch of orders to fill, features to build, and
    customers to help.

So this is a continuing requirement, that you service the requests from your customers via your web site.

It's a service, and it's making you money, and it's successful. For those things alone you deserve to feel happy and a little smug. But I felt misled by the title.

But having said that - all power to your elbow, and well done.

Give the guy a break, come on! He's so happy to have made this money, he doesn't count the work he has to do in order to provide that service.

It's a good story :)

If you are bragging on your efficiency, then it is relevant when more time and effort is required than was represented. Good for him and all, but reality is reality

Thanks for the feedback! Although my hourly rate might be coming to below minimum wage right now - the idea is that once I've put the work in at the beginning to develop customer relationships, develop a brand, and add more features like automation, the amount of effort I will have output after that will be very minimal. It's like working for minimum wage for a few weeks with the expectation of making way more for the next year after that.

It beats flipping burgers anytime :)

Feedback Army (which was actually built by HN user raffi when he was inspired by a comment on HN) has been doing this for a while.

The comment that inspired it:

http://news.ycombinator.com/item?id=362459

Various other HN discussions about it:

http://www.google.co.uk/search?q=feedback%2Barmy%2Bsite%3Ane...

CrowdPicker has been doing this for awhile: http://www.crowdpicker.com/

Thanks I hadn't seen that I'll definitely check them out. Do you know if they use MTurk or some other service?

Feedback Army uses Mechanical Turk. Indeed, they say on their pages that the questions a user submits must comply with MechTurk guidelines.

Question for anyone: would you bother checking every question manually to make sure not to cause any trouble with Amazon? Or would you automate it, hope that the users comply and if they don't, deal with the problem then?

Or you could simply post the questions the user entered as a HIT and ask turkers "Does this text comply with mechanical turk?".

other sites doing very similar things

pickfu.com

usertesting.com

feedbackarmy.com

I've used pickfu a few times - usually get results in 24 hours. I'm bad with colors so it's nice to be able to ask 50 people for $5 which look they like better of a site. It's great because I want real feedback - great when people really tell you if they hate something instead of getting the real world "Oh, nice" responses.

Also used it to ask about domain names.

Edit: I like the site - good layout & like the KISS approach. Good luck.

Great post, Dan. It reminds me of the article the Buffer App guy wrote on his experience getting everything up and running. very smart and disciplined to root out the demand before committing dev. keep up the good work

Thanks a lot! It took me a while to learn that lesson. My instinct was always to code first and ask questions later. I would recommend 4 Steps to The Epiphany - it was a big eye-opener for me about the development process.

I'm curious how you got into the stripe beta? Had you used them before with other projects?

I just sent them an email...they're great guys. I just got some invites to it so send me an email (address is in my profile) and I'll give you one.

NOTE: Sorry guys - all out of invites :(

Nice job, Dan. Always rooting for fellow Penn guys :)

Do you expect to automate this any time soon?

This weekend haha I'm not that much of a masochist to do it by hand forever :)

https://github.com/mdp/rturk

happy birthday!

thanks Mark I saw that it's definitely going to make my life a lot easier

I just logged in to check out this site, and Dan was there, chatting live with folks. So cool. Go Dan Go! You got a customer in me... and I'll be back tomorrow with an order.

Thanks Oren!! I really, really appreciate your business.

This was the same thing that caught my eye as well. I said congrats on the launch, and Dan was right there with a quick friendly comment. This alone convinced me to try it as I was on the fence.

The signup/interview through checkout process took about 30 seconds. Curiously awaiting the results. Thanks again Dan.

That was a great read!

I hate to nitpick, but this part caught my eye: I needed to fix about the site – SSL (even though all of the payments are secured through Stripe). If the checkout page isn't loaded over SSL, my credit card number isn't secure since the page is still vulnerable to a MITM attack completely removing the Stripe code.

Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!

Fantastic!

Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)

I think that, assuming the proper content of the page is loaded, the communication with Stripe is done over SSL. The problem is that someone could do a MITM and give you different content that, say, sends your credit card to their server instead. And that would be a much easier MITM than if he were using SSL because they wouldn't even have to provide a fake certificate.

How that exactly works is a bit too long a topic for a comment here (try google - "public key encryption", "X.509" and "certificate authority" are some relevant search terms if you're interested).

However what I'd like to point out is that 'simple eavesdropping' effectively is a Man-In-The-Middle attack, be it a passive one (the man in the middle is just keeping his mouth shut and only listening).

And eavesdropping on someones internet connection is, contrary to popular believe, not that simple.

The eavesdropper needs at least one of:

a) effectively have a (virtual) presence on either one of the endpoints of the connection b) unfettered access to exactly the correct pieces of equipment that are part of the internet's infrastructure. c) some way of persuading your traffic to take a de-tour from a remote location

Option a) is the easiest I guess - just drop a piece of malware on someones PC (takes care of that whole pesky SSL issue as well). Although certainly doable - I would not describe it as trivial. Most 'cyberattacks' targeted at the masses are not exactly efficient - their success largely depends on the large numbers of targets - targeting a specific person is quite a bit of work.

Option b) is, depending on who you are either relatively easy or nearly impossible. If it's easy for you, you've probably signed a piece of paper promising you a large bank account withdrawal and/or all kinds of 'benefits' in a state-sponsored facility if you abuse your powers. That won't stop everybody and there are parties for who it is actually their job to do this kind of things, but for the most part you can forget about option b) unless you happened to have attracted the interest of aforementioned parties. In which case I wish you good luck.

The feasibility of option c) depends even more on local circumstances of the victim than option a) but is a real possibility, but certainly not trivial. Something like dns-cache poisoning comes to mind.

So - eavesdropping is certainly possible, but I would by no means call it simple.

Rgds, Jeroen

Unless the user is using public wifi. Then eavesdropping is pretty easy. I would imagine its very much a not hugely hard possibility on WEP secured wifi networks too.

SSL can't be MITMed because SSL certs need to be signed by a certificate authority, and those signatures can be checked against pre-loaded public keys in the browser (CA certs). However, if the serving page is non-SSL that then posts via SSL then it's possible for a MITM attack to hijack the connection and display a new page that posts to some other location (where the credit card numbers are collected, etc.) without the user's becoming aware of it easily.

In theory, yes. In practice, many CA authorities have probably leaked their keys. The recent publicly known cases are only the tip of the iceberg.

Interesting - can you link to some information about CA actually losing their private key? I've read about Comodo and others allowing people to improperly sign stuff, but nothing about a CA actually losing their key.

Sorry, I didn't mean to say that it was publicly known that CA's had lost their private keys. I meant that the publicly known security problems, about Comodo and others, is probably the tip of the iceberg. With all the hacks going on, I don't doubt for a second that private keys have been compromised, without the CA's knowing it themselves.

Don't most (all?) CA's use hardware based private keys that can't be compromised without loosing physical possession?

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

Which provider do you recommend for a such a cheap cert that is accepted by a large percentage of browsers?

http://www.comodo.com/e-commerce/ssl-certificates/free-ssl-c...

http://www.gandi.net/ssl/grid

Namecheap sells RapidSSL certs for $10, StartSSL sells 1-year certs for $0.

Thanks, guys.

How is the impact high?

You pay everywhere with your credit card. Everytime you buy something with your credit card number, the site you put it in can make a copy of it. Has the number any value at all?

Unfortunately, the vast majority of customers will not notice that at all.

sorry to be blunt but r u kidding me...he forgot to remove the test code..who knows what kind of data is being stored...is credit card data even encrypted ?...instead of writing these blogs and getting this kind of publicity on HN...please have responsibility to use SSL before providing credit card functionality..

Well, if I understood correctly he didn't really make $350 in the end. He had his upfront costs, his processing costs and his turk costs. I'd be curious how much return he's getting after all that and figuring in something for his time. If he can automate some of his tasks to eliminate some overhead then he may have something. But if in the end he's making minimum wage after factoring in costs then, well, it is what it is.

You have too much drop shadow on your buttons, it makes the text blurry. (Yes, I find reviewing your website ironic when your service is website reviews)

agreed - with both the recommendation and that it's ironic :)

It's very meta. I'll look into that thanks :)

send him an invoice for $5

How I Advertised All My Websites To YCombinator

I'm sorry you didn't like the post. I'm really trying to share what I thought was a worthwhile experience with the community. I appreciate the feedback though :)

Hah, don't mind my snarky comment. Just get these kids off my lawn.

Wow dude, here, have some more haterade... Who does this kid think he is, making websites and telling people about them and stuff... he must be running some kind of scam!

I for one thought his post was of value and that he turned it into a PR win deserves praise.

Great article. It's a good reminder that you don't need funding and a huge idea to get a side project going.

Thanks for writing this!

No problem, I'm glad you liked it!

I agree. I really liked the thought process and the history/experience that made you think of using MTurk for this project. It shows that we sometime stumble on ideas that aren't just useful for just ourselves.

You may want to check out the MTurk command line tools to help automate order processing: http://aws.amazon.com/developertools/694

Never used MTurk personally, there may be better things available.

Thanks! Believe there are MTurk API bindings for Ruby (the site is built in Rails.) Appreciate the comment!

The API is actually very nice to use, you create a template for your HIT (which I'm assuming you already have done for what you're making), and then you just make a single REST call with a list of questions!

So you worked presumably 35 hrs over the period of 3 days or so and what you did actually was created a job that paid you $10/hr. Correct?

Well the point is that now I'm set up to continue making money with minimal effort for a long period of time. So in the short run yes I was making very little money per hour, but eventually the work put in vs money taken out becomes much greater.

So, if I understand this is essentially reselling Mechanical Turk services with a little work in hiding the details from the customer? I'm not quite sure if this is a scam or not...

...but I can think of plenty of cases where people sell "expertise" which boils down to the same thing... normally its a bit more complicated than this though. I wonder if the customers would pay if they knew of Amazon's service? My guess is they just don't know about it, or at least didn't think it would be any good for them...

Hey jheriko thanks for the comment! Yes what I'm doing is essentially taking the MTurk service which is for doing a very wide range of tasks, and is also somewhat time consuming to set up, and reselling it as a targeted service for people who want to get their websites reviewed. It's definitely not a scam, just me building a service I thought people might find useful and charging for it. Feel free to email me at dan@danshipper.com, I would love to talk to you more about your thoughts on this.

Nothing wrong with reselling stuff. Also, Mechanical Turk is not available in all countries.

"reselling stuff" aka commerce. definitely nothing wrong with it.

It's service to non-US based users.

Figuring out how to use mTurk, figuring out how to ask questions to get useful results, and tabulating/summarizing answers are all things that the person who is asking for the tests probably has more important things to do, particularly the first two. It's a fair amount of work.

I don't get this attitude. All of business is using raw materials to create something that people are willing to pay for. Using Mechanical Turk is not always a pleasant experience. There is quite a bit of nuance on how to price things, how to qualify submissions and submitters, etc (not that a service will get all this correct right out of the gate). And don't forget, we're talking about a rather modest $10-40.

You're wrapping Turk in a human. That provides value. +

Have you ever dealt with Turkers? I did for a client once. Here's the task, simplified: "I give you job title, you give me degree title. For example, if I say 'elementary school teacher' you say she has a Bachelors degree in Education and so your answer is Education."

Input (to turker): Car technician Output (from turker): BACHELORS DEGREE IN CAR TECHNICIAN

I rejected that: sorry, I will not pay you two cents for that work. The Turker got into a running email argument with me: "WHY U NO PAY?" "Because the answer is in all capital letters, does not follow formatting instructions, and is wrong." "U NO SAY WRITE SMALL LETTERS!!"

Regardless, though: reselling labor is not skeezy.

+: You might think Amazon Turk pays for human intelligence. No, it pays for human intelligence that finds it economically viable to work on Amazon Turk. Y U NO GET DIFRENCE.

Many of Amazons services are meant to be resold in such a way. Heroku, Dropbox, AppHarbor etc. They all provide varying levels of extra value.

Making it easier to access these services is extra value.

So thrilled for you Dan. Congrats again. Swiperoo loves your service.

DomainPolish loves you right back. Keep in touch!

you are the definition of hustling badass. gumption was a good adjective used here. cheers to your work and may one day we meet at the top ;)

Reply on news.ycombinator.com