mcmc

I really feel for you situation, and I would love to help by chatting. I've been involved in many different startups, from working with friends on no salary, to our current $12 mm series-A endeavor. I've seen tons of startups rise and fall, all sorts, and I think I may be able to lend some advice or just be a sounding board.

Please send me an email if you're interested: carter@gameclosure.com.

Microsoft owns the .NET ecosystem; they probably are looking to expand/protect their rights on C# et al. more than they want to make a direct attack on Android... (though it is a nice bonus for them.)

This is awesome! I released something exactly like it a few years ago, hookbox (MIT licensed): https://github.com/hookbox/hookbox/blob/master/docs/source/i...

Basic idea is this: You put all your real-time stuff in a message queue (MQ) which communicates directly with the browser. For authentication / authorization and various other forms of permission / logging, you have the MQ communicate with the web framework via http callbacks (Webhooks) and a standard REST API. So the architecture is:

User <--Websocket--> MQ :: publish/subscribe

MQ --Webhooks--> PHP/Django/Servlets/etc. :: user signed on, user joined a channel, etc.

PHP --REST--> MQ :: publish(msg), remove(user, channel), etc.

The key is to include cookie information in the callbacks from MQ -> PHP so the callback happens in the context of the user session. Suddenly you can do things like write a chat app in 30 lines of php + js, or a persistent time series in 20, and it really feels magical.

I actually started Hookbox almost as a statement of irony, because I was really frustrated about the major pushback I was getting to sockets in web browsers at the time. I'd just finished writing/submitting the initial proposal for Websocket, and I wrote this tongue-incheeck piece about the mismatch between typical web development and network server programming: http://svwebbuilder.wordpress.com/2008/10/20/html5-websocket...

So Hookbox started as a 2-3 day project that took on a life of its own for a while and ended up being really useful. This project was one of my smaller open source codebases and to this day I receive tons of interest and requests for maintenance, though I've abandoned it for years due to time.

I'm sure there's a huge market for this sort of thing. It's great to see Pushpin, I'll definitely check it out!

I would never publicly post opinions that could put me or my current or future employer/company into legal jeopardy with respect to discrimination against protected classes.

Yet, there seems to be quite a bit of this on here.

Entrepreneurship isn't about having a magical nose for value, and unerringly finding chests of gold at every turn.

Rather, it's about the optimistic spirit, the emotional strength, and ultimately the endurance to keep going even when it's so hard you don't want to get up out of bed.

If you figure this part of entrepreneurship out, as Eric has, you can probably build something amazing.

> I cannot believe that Megaupload is being > touted as an anti-SOPA posterchild.

That's the point! According to you, they were a piracy haven, and they were shut down. Without SOPA. So why do we need SOPA again?

This is pretty clearly an anti-SOPA talking point.

There is so much noise out there that mediocre companies manage to position themselves as the best of the best, or at least manage to make the best companies look foolish at this point.

The problem is that it's a lot easier to imitate the talking points of successful startup than it is to actually imitate the success.

So, how do the current thermostats get installed?

Your skills don't just scale down to asking out a date or going to city hall. They can scale up to $ billion mergers

Maybe the world would be a better place if you had influence over that kind of semi-arbitrary wealth transfer as opposed to whoever has it now.

I feel like there's a lot of room for another kritik at the point when the 'quals' of this card are called suspect: Opp questions 'quals' of famous blogger, thus marginalizing independent authors in favor of institutionalized analysis... which limits free speech... leading to tyranny and nuclear war.

Game of Thrones

Look me up, maybe we can watch GOT together in PA each sunday or something.

No one tell those "punch the monkey" ad authors... at least not before html5block is out.

Be sure to check out the video to see our technology in action.

The Stanford Accelerator program is particularly interesting in that they 1) Have great connections, but 2) take no equity. The only catch is that you have to be affiliated with Stanford.

I was curious about the potential for returns so I considered a scenario: the successful YC companies take series A investment at an average $10 mm pre-money valuation (which is reasonable for a YC company starting off with $150k), and no series B is ever needed before exit. This gives the original investors a 1.5% stake at the time of exit.

In order to return the $6 mm there needs to be $400 mm of exits.

But I don't think it's reasonable to assume that the successful companies wouldn't take additional funding past series A. More likely, any successful company would also take series B funding. Then we'd need to see ~$500 mm - $800 mm to break even.

My guess is that these investments aren't really intended to be profitable. I would guess that they're instead a gateway into future deals that will be profitable.

What's the point? How many people actually keep fewer than 10k unread messages in their inbox?

I prefer Costco to Best buy any day. What matters far more is reputation and the quality of the product than the barrier to entry to join/utilize the product.

Facebook could add a ten page signup form and I doubt it'd substantially impact their legitimate signup rate.

I think you may have missed the point of the Web Store, which, like Apple & the iPhone, is predicated on the idea of selling applications that are compatible with the platform -- in this case Chrome. There will obviously be some applications that are easy to port to other platforms, depending on the specific APIs used, and some that will be more difficult. (For instance, you can't actually use an application that depends on the WebSocket rev76 API in Firefox 3.5/4, Opera, or Safari 6.0 or less.)

If a developer has an application that works in other browsers, then hey, they should go distribute those apps in more places than just the Web Store. But it only really makes sense to position the Web Store as a Chrome-specific application repository b/c Google is only really guaranteeing that these apps work in Chrome.

Google isn't lying, much in the same way that Apple isn't "basically, lying" when they fail to point out that you can play Angry Bird on Android just as easily as you can play it on an iPhone.

Its almost as if you don't realize that Twilio makes money on service usage -- that you don't understand that they're probably thrilled to see their half-formed example code encourage someone to create a real business on top of their for-pay developer APIs.

(Assuming Patrick is even using Twilio and that the code is in any way relevant.)

I read Ben Bova's "Mars" a long time ago, when I was much younger, and I recall liking it then. Bova tends to express an ultra-libertarian viewpoint in his scifi, but very much less so in this particular novel; he does a good job exploring the real-world science of a likely first manned expedition to Mars, with enough drama to keep it interesting.

No, between you and your opponent, practices are not actually zero-sum.

Absolutely apples to oranges.

Google crawls Facebook's data, by request (robots.txt.) You, me, Facebook, and the world do have access to Google's complete data set... its called the world wide web.

Facebook, on the other hand, does anything it can to get a hold of private data owned by individuals, and then hoard and monetize it.

Gmail Contacts is an example of private data, as is the Facebook social graph. These are directly comparable, unlike Facebook's social graph and the greater WWW that google uses for building search indexes.

It seems fine to just enable SSL everywhere. But indulge me for a second in thinking of alternate solutions.

Instead of sending a cookie, send a piece of javascript code (as part of the SSL-cloaked login handshake) that generates a new cookie for each request, and consider each new cookie in this sequence a "one time use" token. You can turn off SSL for subsequent requests and just use one of these new cookies each time to verify identity because an attacker won't have your cookie generator.

This javascript is really just an encryption key and algorithm, and if you implement it correctly, it should take quite some time for snoopers to reverse engineer the encryption key based on a sequence of one-time-use cookies.

Logistically, I suppose you would run into some trouble setting a new cookie for each request depending on how the page is loaded. For instance, if the user pastes a url into a new tab manually, then this system wouldn't have a chance to set the new cookie first.

However, I think you could architect a system that solves this. For instance, put the javascript token generator source in local storage. If a new page loads with an invalid key, that new page can just get the cookie generator code out of local storage and manually refresh the page's content by making a request with a valid token. This should be quick enough for most users not to notice, in the rare case that they circumvent the site's usual navigation.

A downside is obviously that the content itself is still not safe, but at least the account would be. Any thoughts?

I have been contracting for a company that has an in-house version of this tool. We are able to push about 10 million emails a day, including processing bounces, click, unsubs, etc, with a fairly straightforward set of python scripts. Its not about the custom logic, its about choosing the right basic building blocks.

Based on my experience, I doubt they need their "highly sophisticated" PHP to do this -- plain old normal PHP would probably be fine so long as they choose the right out-of-the-box software to pair it with. (nginx, postfix, certain non-sql databases, and the right mysql setup)

"You form a hypothesis, perform a study, and get negative results -- well, you're not going to try to publish it."

This seems fundamentally incorrect to me. Wouldn't research all around just fail if no one ever reported their negative results, thus dooming many other researches to performing the same fruitless experiments?

Couple of quick responses:

pquerna, gridspy, thanks for your responses! I didn't mean to sound quite so cynical. Mainly I am venting my frustration at the lack of a dedicated developer to maintain the project, especially after I've seen so many success stories.

wrt AGPL: In orbited's case -- b/c it is a socket proxy -- the AGPL would really have no impact whatsoever on users. No one would be linking any of their code in-process, and so there would really be no requirement for them to AGPL any of their custom back-end logic. Besides, I don't really believe in trying to force users down a particular path. My hope is always that freedom and choice helps build trust with your user base, which ultimately results in the healthiest community.

Yet, when I started Orbited 3-4 years ago, I never intended to be married to the project forever. My hope has always been that some people/projects/companies that are depending on the Orbited would be willing to commit substantial engineering resources to fix bugs and implement new features, and from those contributions some new core committers would emerge. Unfortunately, my work still accounts for about 95% of the 0.7.x branch which is the last stable release.

I feel like Orbited is far behind, considering I haven't been involved in a release in about 2 years, and no one else has really stepped up. I am always shocked, truthfully, when I hear success stories and see people building applications with it still. The code base has remained unchanged through about 10 browser releases.

In agreement with what Zed is saying, you would be shocked by the number of companies, YC companies especially, who use Orbited (www.orbited.org) but never ever mention it, contribute a patch, offer me a job, or really add anything of value to the project.

Great, that's their prerogative... its MIT licensed software. But I can tell you, after this sort of interaction for years, I no longer invest my time in Orbited, and instead I bill $250/hr to share my expertise with consumer facing internet startup companies.

One actual data point to add this discussion anyway.

[ edit for spelling ]

That isn't correct.

http://en.wikipedia.org/wiki/Mark_Spencer_(computer_engineer...

From the article: "And here's a detail that matters in any copyright infringement litigation: 17. Google does not receive any payment, fee, royalty, or other remuneration for its contributions to the Android Platform."

I don't why this "matters" in copyright infringement litigation except perhaps in calculating damages. However, even in the absence of proven profits by Google on account of the alleged infringement, or losses by Oracle, there can still be statutory damages[1] which, in many cases, could be pretty steep.

[1]: http://en.wikipedia.org/wiki/Statutory_damages_for_copyright...