skysight-inc/HackerNews huggingface dataset:
There are definitely many startups in SF whose teams all live in the same house together, and work there, who seem to be doing just fine. Some (like http://thumbtack.com) even have an in-house chef and other perks.

In my opinion, early-stage startups should live together. Yeah, sure, it'd be nice to have more of a distinction between home and work, but honestly 90% of your day in an early-stage startup is work. However, an office is definitely preferred during the later stages, which is not to say that a house is inappropriate.

Key milestones which might be a good sign for getting an office space:

- Not even two houses could hold all team members

- You're on your third hiring wave (i.e. none of the new hires are considered part of the core, or even secondary, team)

- Your advisors tell you to get a house

- Increasing tension among workers
> Not only is it based on a different rendering engine

Actually, Flock switched from Firefox / Gecko to Chromium / WebKit earlier this year.

That said, my comment is a bit flippant, and for exactly the reason you mention.

Edit: I'd really like to see the RockMelt team discuss why they think Flock has failed to gain traction, and how they plan to address those issues.
The warning isn't spurious, by the way. A man in the middle could inject evil JS into urchin.js (or whatever the equivalent is now) just as easily as he could inject it into your site's JS; the page is not secure.
Wikileaks Mutineers Create Rival Organization
Laggy here too. Same FF build, on ubuntu. Fast in chromium. Sidenote, does anyone know of a good JS profiler?

Edge detection is easy, especially on images with small numbers of colors in large swaths.
LaTeX would not honour it. But you can ask it to treat the end of sentences different than regular spaces.
it's one of the reasons. probably not the only one.
The specs are not just different, they're pretty much unresolvable.

The TI-8x series - even the 68k-based TI-89 - uses a 1-bit raster display(grayscale is achieved with CPU-heavy high-frequency toggling) with different resolutions and wider aspect ratios than the Game Boy, and it has no built-in audio. The Game Boy has character-mapped sprite, background, and foreground layers and audio functions with pulse, DPCM, and noise channels(it should also be noted that like the NES before it, sound functions are integrated onto a custom CPU; it has a substantially different instruction set that is a cross of 8080 and Z80 capabilities). They both have plenty of buttons, so there is at least a common functionality subset there.

The main advantage of the TI is that there's a large amount of memory/storage for an 8-bit processor(128kb, 48kb user data within the OS, 1.5MB flash). The Game Boy, like most cartridge consoles, is memory-starved and relies on ROM for everything. So there's little hope for porting TI games to Game Boy, as well.

Edit: Despite this, someone did a GB emulator: http://www.youtube.com/watch?v=-a9ZhxMREj0

It has quite a few quality issues.
Would you be "skeptical" if a meta-analysis of physics paper showed a statistically significant outcome of a particular unexpected particle being created in different high-energy atomic collisions? Or would you look for where the theories are wrong that didn't predict the outcome?
I know this isn't exactly what you asked for, but hopefully, it helps!

To properly articulate your unique value prop, you need to truly understand the value you are providing to users of your product. I know how difficult that can be when you're too close to your product. About a month and a half ago, I was in the same position.

Luckily, around that time, I heard the CEO of FreshBooks speak on the subject. Here's the gist of what he said:

Be able to tell users what life was like BEFORE your product and what it's like AFTER your product. Quantify it to make it real!

For example, if I've invented a teleporter...

BEFORE: On average 45 minute commute to work

AFTER: 0.015 second commute

Obviously, the big benefit of my invention is saving time. For yours, it could be cost, time, etc. Just make sure it's quantifiable!

And from there, writing your one sentence UVP will (hopefully) be much easier.
The only way this kind of experiment can have meaning is if 1) somebody can hit a very high percentage correct a high percentage of the time or 2) over all, there is a trend that is unexpected.

I would be very surprised if said grad student actually believed you were psychic. A result in the significant region is NOT significant. A set of results in the significant region is.
There has got to be a sensible way around this. It seems overkill to require every pageview to be over HTTPS, even for otherwise public sites. For example, should these public discussion pages be over HTTPS on hacker news?

On my site I am planning the following: operate the login page over HTTPS and issue two cookies. One is HTTPS only and other other is for all pages. The public (non HTTPS) cookie is only used for identification (e.g. welcome messages and personalisation). However, all requests that change the database in any way are handled over HTTPS and we check to make sure the user has the secret HTTPS cookie as well. Often forms submit to a HTTPS backend and then redirects back to the public page over HTTP. Also, all account information pages (sensitive pages) will be over HTTPS.

This way, the worst that can happen via cookie sniffing is that someone can see pages as though they were someone else. In your case, this is not much of a risk.
"There are some people who are just bad for your soul, who drain the life from you with constant drama, who you really could just do without."

I second that! Same situation here.
can you name some really big winners eith online games that fit what you're saying? I'm assuming the obvious one is Zygna, but that's all I know.
Hmm, this is an interesting experiment, though clearly positioned as more of a "free trial sample" than "open access" kind of thing. They're making a bunch of stuff free (w/ login), but they rotate which stuff it is every three months, presumably in hopes that by then you'll have gotten hooked on something and demand that your library subscribe to it.
I am not sure when open source became this magical unicorn but I suppose it is good that someone tries to guide would-be contributors - even if I wish they rather had an itch to scrath than viewing it as merely a box to check for the resume.

I recommend starting with something you use or would like to use.
Facebook has an HTTPS version, but Facebook Chat doesn't work over HTTPS.
Ask HN: How does deforestation affect climate change?
I know the impact must be frightening because trees are such a vital part of healthy ecosystems and most people have never planted a tree in their lives.

I Googled it. This is what I found...

"One day of deforestation = carbon footprint of 8 million people flying to New York."

How accurate is that? Does anyone know?
isn't the "let's put the web inside the browser chrome instead of the main window" quite similar to what flock[1] was already trying?

The world is probably different from a few years ago, so there is probably a higher chance that this might succeed.

[1]http://flock.com/
Heroku is killing it in RoR today, but I also noticed their rates jump up real fast.

The reason is, they're on the forefront in this area, and really don't have any legit competition yet. They make it so, so easy to get going, and people rave about this constantly.

I'm a WebFaction guy, they hit just the right point for me, with regard to price vs. features vs. a technically competitive/modern configuration.

I haven't started moving into cloud services yet, because I just have a natural aversion to "leasing" as opposed to owning, though I realize a hired host isn't much different.

I just see all the cloud services nickle-and-diming you to death - the meter is always running, all the time, in small ways and large. A flat monthly fee is plenty enough for me to worry about.

With Heroku, they've obscured so many of the sub-components behind cute, fabricated names... I don't want to have to worry about contracting enough cycles, or workers, or R2D2's, or time, or speed.

Though I realize this does work well for some users, I'm not that kind of user.
No I don't and it depends whether I work on-site or from my own home office. To work as a contractor has both benefits and downsides, which are typically the reverse of being full-time employed. My hourly (daily) rates are based on the fact that I might not be able to fill 40 hours of work week after week. So, in a sense, my clients also sort of pay me for the time I'm not working. That's why my rates are set to a certain level, and it's also the reason contractors are more expensive than full-time employees. If I happen to be working from home and I do work for 2 clients and both jobs take me 4 hours, than in that single day I earn twice as much. However, the next two days I might not be able to bill anything. Pros and cons of contracting I guess.
Indeed, the warning has it's merits.

That being said the second part of your argument is completely wrong. You can just as easily inject evil JS using an https server and never get the mixed content warnings.

The warning serves to indicate to users that some assets (think important-financial-graph.jpg) aren't being served over the same encryption as the rest of the page. But then again, browsers like Safari have no problem with this. Other browsers like Firefox (correctly) cache these assets on disk if Cache-Control:public is set, thereby un-encrypting the asset.

The error may not be spurious, but it sure doesn't mean the page is secure or not.
Hmmm... I see what you are saying, but (for example) godaddy offer basic SSL certs for $10. Not a huge price for anyone.
The drive in question sounds like the 2TB bargain that New Egg regularly offers deals on: (http://www.newegg.com/Product/Product.aspx?Item=N82E16822136...)

I've got three of these in a JBOD server, running a couple of months without incident. They're cheap, quiet, and low-power. They're not high-performance, however, and not ideally suited to RAID applications. Also, given the new sector size you can get dreadful performance from them if you aren't careful in setting your partition boundaries.

Having suffered the consequences of ignoring data safety rules in the past, I now make a practice of having three copies of important data in at least two separate locations. I'm frankly astonished that there apparently wasn't a differential backup process at the company. I mean, a month's down time, WTF? These hard disks are pretty darn cheap backup media if you've got lots of data (e.g. video files), but after this item I'm wondering if biodiversity should be among my archive criteria.

That the drives in question had "chemical degredation on the surface making the data recovery much slower and harder" is a puzzler to me. Perhaps there's something about today's drive materials I'm unaware of, but my CYA radar went off on that choice of words: someone screwed up during the recovery process would be my first suspicion.
Sporicide Approved by EPA to Kill Anthrax
An anonymous reader writes "Biological weapons are a substantial threat as infectious microbes can be delivered quietly and secretively to the population with deadly results. STERIPLEX® Ultra is a powerful sporicide designed for military and homeland security use as an effective countermeasure against anthrax and other biowarfare and bioterrorism pathogens. STERIPLEX® Ultra was officially registered by the EPA on April 2, 2010 as a first line of defense against anthrax."
sounds like you've already made up your mind, then
Are You Splitting Hairs?
This article is full of nonsensical garbage (or, I've just had too much red wine tonight).

It mentions their VC funding, and specifically says "That’s $28.7 million that they will have to pay back." Venture Capital doesn't work that way. It's an investment not a loan. They don't have to pay anything back if the company does not succeed.

There is also the mention of businesses "only" needing a $5/month website. WTF is this guy talking about? You're not going to build a social news aggregation app like Digg on a $5/mo hosting plan.

The 'Wandering Aimlessly' paragraph also has some things that don't make sense. Many of the features Digg was adding were targeted towards commercial clients that wanted to get info on the stories they posted, or the stories other users submitted that linked to those corporate properties. IMO, this made sense as a strategy, as if successful Digg could have charged for access to this information because the users weren't going to pay for the service.

This guy has some interesting thoughts, but I'm not sure any of it is rooted in anything other than wild-ass speculation.
While your frustration is understandable, I think you're speaking from the perspective of a tech-savvy person and not the average user. If browsers began accepting all free / self-signed certificates, it would be only a matter of time before something like "Firesheep FX" came along and permitted random strangers to MITM anybody's SSL session. Some of us can notice when that happens, but most people won't have a clue unless the browser presented them with a big scary red warning.

However, I agree with you that we need some good free CAs. The difference between free and $10/year is bigger than most of us think it is. Fortunately, there are registrars such as Gandi which will give you free certificates with every domain.
> You can just as easily inject evil JS using an https server and never get the mixed content warnings.

Only if the user ignores the "invalid certificate" warning.
I thought about this too, but is there a site offering this option? Besides that, I doubt that an US based company would be able to sell them in Europe or in Asia.
You want to be early, but not too early. Ideally, you want to be the guys who've spent enough time thinking about the space to appreciate the opportunity when it strikes.
"They come up with 5 versions. How do you compare them?" -> I just look at them all and then give feedback. For me, this has never really been a problem.

I think it would help if you would target it to an even narrower niche than just "designers" at first. Perhaps a certain type of designer.
Yoseph,

Thanks for taking the time to share that story. It really helps.

You are absolutely right.

One of the earlier commenters, kingsidharth (I hope I got his name correct) to be exact, suggested exactly that and he gave me some solid suggestions.

"Faster decision making."

Then it clicked to me, that's what I am selling. A decision-making engine. Something that helps their clients make decisions quicker.

I wish there was a way for me to quantify this and articulate that, without it looking cheesy.

Any ideas?

Thanks again for that story.

Love it.

P.S. By any chance do you happen to have a link to the talk that the CEO of FreshBooks gave?
When Google came out, I'm sure you'd say "Oh hey, it's Alta Vista!". I literally can't count the number of products and companies who attacked markets where others had largely failed (or at least not blown the doors off) and won big. YouTube, Google, Facebook, iPad, etc.
A good point from the article is that estimating a single task at more than 4 hours is more or less saying "I have no idea how long this will take, actually." Do you find that when you estimate something to take "one day" your estimates are generally accurate?
If you let it come to that than you're doing something wrong. It either means you didn't estimate well enough or you didn't inquire about the project time-line. E.g. If you estimate a job to take 40 hours but the deadline is in 2 days then you have a problem. Getting paid for the 40 hours is not going to make you happy if you have to work 2 days around the clock. In other words: Estimating is one thing, but it also has to fit into an achievable time-line.
WebMonkey First Look at RockMelt, a Browser Built For Facebook Freaks
Is there an alternative to HTTPS?
I've done things similar to this with mixed results. Instead of a thong, I stripped to T-shirt and boxer shorts (plus underwear) or to top and bottom long underwear (pajamas, essentially). Boston and Albany didn't blink an eye, whereas El Paso involved an unpleasant exchange with a police officer.

This was a while ago, though, after the initial shoe bomber I incident. Responses may be different now. Try to decide in advance what your goals are: are you hoping to make a scene or not? Likely you should not do not do things like this if it is not acceptable to miss your plane. I'd recommend choosing a final outfit that you would feel comfortable defending to a judge as not indecent to wear in a public place.

(I suppose I should mention: I personally have no problem with backscan X-ray so long as it is fast, safe, and effective. It's the security theater that I am willing to protest against, not the perceived invasion of privacy.)
Simply put, funding rounds are often a stack. Each round of new money typically moves existing investors to a lower priority.

Founders are first in.
It seems to be overwhelmed. Google cache: http://webcache.googleusercontent.com/search?q=cache:16XHnrP...
Do you make this clear to your clients? If I was told I was being billed for "one day" of your time, I would expect that you were spending about 8 hours working on my task. To find out otherwise, I would feel that I had been lied to.
it's posts like this that make me want to take money from Fred Wilson.
I have a modest proposal that might also work.

Four canvases:

1. BW (inited from Color)
2. Color (color source image)
3. Paint (inited transparent)
4. Temp (inited transparent)

Each mouse move:

1. Draw an opaque white line on Paint to the new position
2. Copy Paint to Temp
3. Set the globalCompositeOperation to "source-in"
4. Draw Color to Temp
5. Set the globalCompositeOperation to "source-over"
6. Draw Temp to BW

I haven't tried it, but I think it should work (or something like it with the flaws corrected :) ). One advantage is that you can use the path line drawing primitives on the canvas instead of rolling your own.

You could also optimize a bit by only drawing the portions of the canvases that have been changed, but it really should be plenty fast as-is.
Does anybody have any experience with sprint in SF / mission?
Right...but how do you compare them? As in, exactly what is the process? Do you resize your browser window ? Or download them to your machine and resize windows like that? Or do you print them out and put them side by side?

Perhaps I experienced this because I was dealing with multiple designers and multiple projects and multiple revisions. It just got unsustainable after a while.

But I don't quite know how to target those people. I was thinking just let price be the discriminator.

This won't work for those people that have 1 client every few months and a few revisions.

But those with multiple clients and multiple designs going to those clients and multiple revisions of those designs - can typically use something that simplifies that process.

Basecamp definitely doesn't simplify it.

That's where my frustration/pain point came from and subsequently this solution.
I've found firebug's profiler to be quite useful:

http://michaelsync.net/2007/09/10/firebug-tutorial-logging-p...
1. Include https://hot-new-metrics-startup.com/tracker.js

2. hot-new-metrics-startup gets hacked. Sends over malicious js

3. Your page is no longer secure. https certificate remains.

We can argue semantics, but I guess I'm more concerned about the end result than semantics.
"Gimmick" was meant to be sarcastic.
Hm, that neighborhood is a few minutes from me. Some of the schools in that area are just foul.
Well, sometimes for strange values of "vulnerable".

Some of my sites use Apache::Session over non secured http connections, which makes them technically "vulnerable".

The only practical thing an attacker can do with those session ids though, is to mess with some custom visitor tracking in my management backend. So perhaps my information about whether a particular inquiry visited my terms and conditions page or my privacy policy page will be wrong. I can live with that.
Part of the problem is that people using said languages may not see that those problems have anything in common. When somebody comes along and says, "Dude, you can automatically handle all of those edge cases at once, with one general rule!" it sounds like a bunch of mathematical jibber-jabber.

(The fact that it often is mathematical jibber-jabber doesn't help their cause, though.)
Yes, pretty much. There were high expectations around Flock, but then execution sucked. They took months or years to slowly move to a release... It just never happened.

Also: their site is more boring than SAP. Where are the screenshots? Where are they actually trying to get me as a user?

I think this is definitely something that's worth another try (or two, or three).
Thats what I don't get, why Mozilla doesn't simply remove the root certificate for any organization which charges more than $10 for a wildcard certificate is beyond me.

The verification is the same, there is no good reason it shouldn't be the same price.
Any HTTP request that includes the session cookie needs to be secured, otherwise the firesheep user will be able to grab the session cookie and use it in their own requests.
For Google Charts, there is a workaround. Simply change the hostname to www.google.com, example:

http://chart.apis.google.com/chart?chs=200x200&cht=qr&chl=http://www.adperium.com/ (normal)
https://www.google.com/chart?chs=200x200&cht=qr&chl=http://www.adperium.com/ (HTTPS)

It's probably not what Google prefers, but this works for us.
> If browsers began accepting all free / self-signed certificates [...]

Right now, browsers are accepting any unencrypted old HTTP connection without any warning, while non-verified securely encrypted connections are actively prevented. Tech people can circumvent the block, but normal users cannot. Nor do they have any reason to because the warning they are being shown sounds like the end of the world, while any unsecured connection looks perfectly fine to them. This is something that could be done right now to make everybody more secure, at no cost, but it threatens the business model of companies like Verisign.

Nobody is suggesting that browser makers should display the much-sought-after "lock of absolute protection" icon on any random SSL connection, I'd be fine if they reserve that for paid-for-certs. I'm merely suggesting they show free (or even self-signed) certs the same courtesy as basic HTTP, the most permissive protocol of all time, instead of actively preventing users from using encryption.

I agree with you about the threat of "Firesheep FX" and believe Wifi connections should probably all use WPA2, even at coffee shops where internet access is free. The threat of MITM is real, but the attack can be made more difficult using a number of schemes, and it even includes free certs that offer way more protection than any unencrypted link ever could. Yet, we are currently encouraging unencrypted connections while actively blocking encrypted ones.

If HTTPS could have the same UI mechanisms as, say, an SSH connection I'm convinced the online world would be a much safer place.
Couldn't you just cache the charts locally, and then serve them directly to the user?
This is just dangerous. Example. If news.ycombinator.com implemented this dual cookie method. A man in the middle could intercept the page I'm looking at now, where I'm entering this comment in a textarea. They could modify the underlying form to post to the same page as the update form on the profile page, and set a hidden email field. Then when I hit the "reply" button, even though I'm posting to a HTTPS page, I'm not posting to the one I think I am, because the page containing the form it's self wasn't protected by HTTP.

I hope I explained that well enough. Mixed content is hard to do right. Forcing every page over SSL prevents anyone making any modifications to any page, and is just inherently safer.