skysight-inc/HackerNews huggingface dataset:
Clearly exploits are something that shouldn't happen and often happens. What I'd like to ask is how the process of a startup and the process of achieving security should be integrated?

I see a conflict between the entrepreneurial extreme concentration on what the users want and the need to follow good security practices consistently during all life stages of the product.

Of course, all entrepreneurs should already live in the relativity of risk, effort and reward. In that sense, I hope that startups understand to avoid some of the insane security risks that some enterprises seem to have. Likewise, Reddit has provided full HTML features with zero effort this far. Perhaps this exploit wasn't that bad to them or the users?

Reading some good books on security philosophy might help, especially if you don't have the time to follow and learn from Schneier's Crypto-Gram Newsletters and the various security announcement lists. More security with less effort is one more reason to run Linux or even OpenBSD. And, validate all inputs in your software. I wonder if there's a security checklist for startups.
Assumption-driven Entrepreneurship: Your Hidden Sustainable Competitive Advantage
How to host the startup server?
Now that I need hosting for an application, I don't even know whether to go with the cheapest virtual hosting or try to go directly for some better-grade setup.

Amazon S3 can be used for most of the storage needs, but I'd need a lot of RAM for good price. Server Axis virtual servers seem good this far.

What about service-level agreements and terms of service of various providers, all I've seen would seem to leave a lot to be desired?
Well.. it's not so hard to avoid this kind of bugs. In web applications the basic rules are the following:

- Use something able to auto-escape SQL queries, unlike things done at hand like with PHP mysql_escape_string()

- Check user input _a lot_ for sanity. Write utility functions to access get/post vars able to make sure data type and range are ok, like, getintparam("foo") or if you aspect a value between 1 and 10 getintparam("foo",1,10). Similar functions with strings where you can specify the valid set of chars are also helpful.

- Remember to output html entities not only when you are outputting text, but also in html tag attributes like foo="bar". "bar" requires to be converted in HTML entities of course.

- Create a solid authentication scheme, for example write in the user table a 256bit authentication random number got from /dev/urandom, and set it as user cookie.

- When there are load problems use HMACs to "sign" important data and store it in user's cookies. It's possible to check for integrity of the data without to access the DB at all. Fast & Safe.

- Remember that if a user is logged in, an external site can have code like img src="http://yoursite/op.cgi?delete=all"
To avoid this attack make sure to:

1) use HMAC-ed IDs for importante objects. "ff83729A2" instead of "41". Require that IDs of objects target of operations or other auth tokes the external site can't guess are required in order to perform operations.

2) for very important operations the system may require the user to type the password.

- Make sure you are not using algorithms with some worst case time complexity that can be triggered from outside. It will be very easy to turn this into a DOS.

And... of course: wirte simple code that's simple to check for corner cases. Computers aren't currently able to audit code, so you need to optimize for humans even for security.
I'm 8, I'm late for an online date with a cuddly penguin
DIALED IN / Let your voicemail do your dirty work
Online visits a boon for far-off patients / In growing trend, doctors consult through Internet
Will Facebook Platform Be The New Arbiter Of Web 2.0?
You provide a good list of features to remember to implement, I didn't know of HMACs for example. I was thinking more about the process though: Are startups able to review all their code for bugs before pushing it online? When you code long hours, do you still write down all your assumptions to allow for audits later? What if none of the founders have experience in network security? When you don't have formal and clear processes in place, how easy is social engineering among customers?
As I've mentioned on reddit, almost everything this fellow wrote is false.

news.YC isn't based on reddit

Any text that comes from users and gets redisplayed is checked.

The actual bug was that we allowed javascript: links to be generated by markdown, which we use in the comments to allow formatting. This allowed users to make links in the comment section that could run javascript when clicked.
This looks like a good idea poorly implemented. Done right, I really think something like this could take off.
For more information about making data tamper-proof using HMACs see the paper "Dos and Don'ts of Client Authentication on the Web" by Kevin Fu et al. [1]. I've implemented the "FuCookie" and I use it everywhere.

[1] http://pdos.csail.mit.edu/papers/webauth:tr.pdf
"Remember that if a user is logged in, an external site can have code like img src="http://yoursite/op.cgi?delete=all""

You shouldn't be using GET for anything that has side effects.
I think what most people tend to overlook is how great the name of the site is. It's funny, it's cynical, it's patronizing, but it sticks in the head. I just heared that name once maybe a year ago, and I might have heared of thousands of other sites, but I'm sure if I had to name one dating site, I would have remembered only this one.
Myspace - the next Prodigy?
Good point, but with ajax this is very common. There are also frameworks that abstract "params" into GET+POST+COOKIES, since they are all under user control in theory the security level is the same, but actually the img trick changes this.
Actually to handle security is very hard. I think startups usually can't handle security as a process because time is little, stress in implementing features high and so on, so the best founders can do is probably to have security-aware programmers and try to don't introduce too much bugs.

Then if/when you become a mainstream site start doing planned security auditing from time to time.
"almost everything" is a bit of an overstatement, I think.

I did incorrectly assume that news.YC was based on reddit- I've since corrected that.

"This allowed users to make links in the comment section that could run javascript that could steal your cookie and your login details" would be more accurate. The issue has(very speedily) been resolved since, but there is no need to make light of a textbook XSS exploit.
This is a good example of "too often".
Do good by doing good
Crunch time at a web startup
Think like an Inventor
Startups across America
Best metro areas for entrepreneurs
The beauty of Friendster was its exhaustively complete network. Every time a homepage loaded, Friendster's servers calculated a single user's connection to other users within four degrees of separation, which could mean hundreds of thousands of individuals.

And nobody had a clue this would not scale in 2003?

When there are 6 billion people in the world who are 7 degrees of separation from each other, they thought it would scale to calculate 4 degrees of separation, forever, each and every time somebody loaded any profile? You mean the creator worked for Netscape, and knew a company could have millions of users in a short period of time? You mean to tell me they didn't even implement alternate ways to display friends just in case they had to, due to sudden growth or multiple server failures, etc?
EarlyExciteHistory.pdf (application/pdf Object)
'... Hum. This article turned out to be targeted at big company types, not entrepreneurs ...'

I think the below extract could / should be applied to any startup. The point being made here is to create cheap in-expensive (money and time) rapid prototypes. In the process discovering new insights.

'... Sketches, he argues, are quick, inexpensive, disposable, plentiful, offer minimal detail, and suggest and explore rather than confirm ... The value of sketching is less in the artifacts themselves than in the cognitive process of working through dozens of ideas, of considering as many options as possible, and allowing each option to raise new questions ...'

This particular technique is extremely useful when the next step, "translate design to code as quickly as possible into a working prototype". Speed from idea to code allows crappy ideas to be exposed faster and is a technique (rapid development of ideas into code) was used by Joshua Schachter for various projects leading up to delicious.

I think the article and the book are slanted towards big business because they have less constraints (more money, resources) and hence have problems tackling the design process. It might also be written for companies that do not create product and either make money by the hour or contract, not product ~ http://www.joelonsoftware.com/articles/FiveWorlds.html
Looks like this site has an edge over meetup.com, considering that meetup charges $19 per month and this one is free.
IMHO the best thing to do is to take a cheap housing. Here in Italy where prices are much higher than in the USA you can get a decent host with a big disk, few GB of ram, 1Mbit of guaranteed bandwidth for 100 EUR / month, including the price to hire the server.

It's very important to have a good Linux distribution like Debian or Ubuntu where you can install/upgrade things in few seconds with apt-get.

Also it's important to have root to be able to install different apache modules, install cron jobs, be able to manage the firewalling in case of attacks (I saved myself from a DOS thanks to a Tcl script + iptables one week ago).

Virtual servers are cheap but the performance may not be bright.

p.s. I suggest to use a very low TTL for your DNS records so you can switch ASAP if there are problems. Also to try to "packetize" your application is important in order to make sure you can install without too much problems your code in a different host in little time.
Web 2.0: Media Search Engine
'... Startups prosper in some places and not others. Silicon Valley dominates, then Boston, then Seattle, Austin, Denver, and New York ...'

- #1 Miami - Fort Lauderdale - Miami Beach, Fla?

- #2 Atlanta - Sandy Springs - Marietta, Ga.

- #3 San Francisco - Oakland - Fremont, Calif.

Interesting to see what bizweek thinks is best place for entrepreneurs. What type of 'entrepreneurs'? Especially when location is the number 2 reason for failure ~ http://www.paulgraham.com/startupmistakes.html
Depends on your budget, right? But if it's not non-existent, then I'd recommend SoftLayer (just Google for 'softlayer'). They're formed out of the ashes of the old, and great, management team from The Planet (before it kinda went 'eh') and are good value and really progressive (extremely customizable machines, cheap upgrades, virtual private LAN for all users, KVM for most servers, IPMI logins, open API to control your servers, etc). I moved to them from EV1 several months ago and am totally in love. It's amazing for startups because they offer datacenter level options for dedicated hosting money (it's worth it for private LAN alone, I save tons of bandwidth).

If you want more general comments, rather than specific vendors, then... unless your site is entirely local/regional, then always host in the US. Always go for something that's not the cheapest, but not the most expensive. Always search WebHostingTalk.com for reviews of the company you consider.
Craigslist's ongoing success story
Anyone interested at working on a visual search technology startup ? See http://server.imgseek.net/ for details.
Actually, I've found the performance of my Xen VPS much better than a dedicated server at The Planet. Most likely that's because the dedicated server had just one IDE disk and the Xen host has a fast SCSI RAID array. Dedicated hosting gets pretty expensive when you get into SCSI drives and RAID but it's really important to consider your performance and reliability needs.
http://news.ycombinator.com/comments?id=11687
How a lone developer is making 6 figures in revenue from a viral game.
Too old for networking?
Probably. I doubt that they'll be very relevant in a few years. They are too greedy and will over-milk their cow.
'... Some say that the bubble is fully inflated once journalists start launching startups. ...'

I wish journo's would do some basic fact checking (still requires verification though). Clearly from his about page '... background is in science, starting with studying physics and doing research at Los Alamos and culminating in six years at the two leading scientific journals, Nature & Science...' ~http://www.longtail.com/about.html
Thanks, there we've got several suggestions wrt. vendors.

Now, I still hope to get more comments on what to keep in mind when choosing the hosting.
I want both kinds of comments :-) SoftLayer give a good impression indeed. Dare I say I didn't know about WebHostingTalk.com before...

Regarding my fear for the legalese, I suppose I need to see what kind of terms of service other startups are willing to bear and go with those until I can hire a lawyer to get proper interpretations. In any case, SoftLayer terms of service seem to give a healthy amount of rights to the customer too.
If you'd followed my Twitter account, you'd know I'm not kidding.
Scritti inglese molto bene! Complimenti.
Anyone know anything about the forthcoming Amazon EC2 public beta? Coming anytime soon? Private beta testers are happy enough? Seem worth pursuing?
Good theory, and a solid basis in the different approaches Facebook and MySpace take to outside development. Facebook is now an OS for social activity, whereas MySpace is a scary gamble and a world that really doesn't want you there.

As an amateur web historian, I wish the author wrote more about why Prodigy is a particularly good comparison.

By the way, "the power...is powerful"?
You probably know this, but the same is applicable to "cross-site request forgeries" in general, they just aren't as trivial to exploit as img src. If they can perform a GET they can perhaps use javascript to import confidential information into a loaded page and scrape that.

POST requests aren't safe from tricks by third-party sites either, as is mentioned here for example: http://www.owasp.org/index.php/Cross-Site_Request_Forgery

(Open Web Application Security Project looks interesting otherwise too.)
Ha, every time someone writes about Craigslist, it's like checking in on the Big Lebowski: "Still abiding?" "Yep." "Anything new?" "Nope." "Should I ask the same six questions every other reporter does, which I'd realize if I bothered Googling your name before I interview you?" "Sure."
PayPerPost - I'm speechless
"The new product is a widget that bloggers can add to their blogs that announces their willingness to sell blog posts."

What's next, you walk into a financial advisor and you see a poster "will reccommend anything for a fee - enquire within"?
And it's really a great game too. I knew it hit the big time when Michael Arrington posted about it.

http://www.handdrawngames.com/DesktopTD/ if you want to play.
Get yourself a decent no-name 1U box ($900-$1500), stick it into a friendly colocation service near you. $120-200/mo your mileage may vary. This should be enough to test the waters.
This is really a bad idea - it corrupts what is so attractive about blogs - that they represent the genuine opinions of the bloggers. If there is a disclaimer in the blog about the sponsorship, however, no problem.
I would exclude Austin from the list. Sure here are lots of startups, but Austin's startup scene is dominated by either dumb&boring B2B Java-shops, or hardware/embedded startups dreaming of being "next Tivo". Neither of these two types of companies are especially exciting to work for if you are CS grad. Alot of ideas/people revolve around DELL/IBM/Motorola trio, not a very exciting group to say the least.
Another Update: I'm taking a serious look at CakePHP.
Ethically, the worst startup of 2006 :(
I think it's probably more right to say that Myspace let the widget market play out organically, and Facebook is copying the best parts to make a "real" model. Myspace has already shown they know there's power in widgets; they just bought into Photobucket and will probably pick up other, smaller companies too. I'm not sure acquisition is in the plans for Facebook at all (making it less attractive to develop for, all other things equal).

Also, while we decry Myspace and claim its downfall, a quick check on the traffic numbers makes it clear that Facebook is still a pretender to the social networking throne.
The one thing I'd add to this (excellent) piece is that the stuff he lists as important to social networks is necessary, but not at all sufficient. Copying all of the details of reddit is not going to get you a Conde Nast buyout in a year, even if you took the same route they did, copying every detail. The sociological variables are the hard part of making a site take off. You need to get an audience, you need to hold them, and you need to have them attract other people ad infinitum if you want to be judged successful.
Over-milk their cow?
The Next Web's 20 startups
I signed up to get a second beta account, but have heard nothing other than "We'll let you know."
Thanks for your reply. Before and after the edit, the post was a question meant for scribd developers to answer, who posted the link themselves. I edited my post to make it more clear that I was asking a question, not playing lawyer.
The ones that are unreadable are likely the words from the texts. Those words do not count against you. You only have to get the real captcha correctly, which happens to be the clearest word. Try experimenting by entering just one of the words.

I had no difficulty with these, while I usually have a LOT of difficulty searching vBulletin forums I am not a member of.

I would write "If you're having difficulty, enter one of these words" at the top. The user will likely enter the clearest.
'... every time someone writes about Craigslist, it's like checking in on the Big Lebowski: "Still abiding?" "Yep." ...'

good observation. It's worth posting because the dude (Craigslist) is A) the anti-pattern to those who say the only way after you get big is to advertise (missing the point you annoy your users beyond distraction) and B) nobody believes (and probably why its a story) that Craigslist has not sold out and pursued the megabucks that could cough be made with greater advertising.
How many of you are doing Facebook app only ala LendingClub?
How many of you are doing a startup for Facebook users only?
Facebook Platform - Developers Wiki
They're just counting the number of businesses started per person, which is pretty irrelevant to high tech.
You know it's not cool anymore when grandma is on it.
Writing to make sales on the web (same as in real life, apparently)
What's the difference between a "developer" and a "programmer"?
Hacker, programmer, developer, coder, and engineer are terms used by different groups to denote the same people. So the difference is mainly what they say about the speaker.
Skype Founders Invest in Frenzoo
MySpace v. Facebook: It's Not a Decision. It's an IQ Test
Messaging in multiple channels is mandatory
grazie ;) ma parlo molto male.
Old media is corrupt the same way, isn't it? Remember PG's submarine metaphor?
OpenHive: Facebook app for sharing physical media
In Africa, Money not necessary for mobile banking
Teen w a g beats justin tv traffic
Planning for hypergrowth
So, how does one plan for massive growth during first few days/weeks? Consider possible scenario of launching and within first 3 days millions of users are visting the site daily. Maybe this is an obvious (or nonsensical) guestion - thought I'd ask anyway.
Another one:
A successful person fails many times, but a failure only fails once. (I don't who said it.)
Allora, deve abitare in America, Britania, Canada, etc. se vuoi parlara bene. E' troppo difficile imparare da solo. Ma se pua scrivere bene, va bene cosi'.

Btw, you can see that I write like a child. "Scritti"? Scrivi! :-(
I think they are mostly the same, but that "developer" means more than just programming. By developing something you take an active part and can make decisions about the software. If you're "just" a programmer, you just program something that matches the specs. (think outsourcing)
Golden Rules of Linkbaiting
The Difference Between Marketing, PR, Advertising, and Branding
in the case of my current employer, its how much you get paid and it stems from what you education you have. since i graduated with a computer engineering degree, i get the developer title.
Somehow I can't feel bothered by this. If anything it will raise awareness that everything on the internet should be taken with a grain of salt. And who is writing a "self-less" blog anyway? My guess is: nobody. So let's just discard the myth of the holy blogger.

Another thought: whose review of a product is likely to be more neutral, the one from a blogger who bought it with his own money, or the one from the blogger who got the product in the mail for free? My guess is the one who got it for free might actually be more "objective", because otherwise there is that psychological effect that people estimate things higher that they paid for, so that they don't feel stupid. See also http://en.wikipedia.org/wiki/Cognitive_dissonance (Cognitive Dissonance)
-- "almost everything" is a bit of an overstatement, I think.

Well the rest of the Internet disagrees with you.

--would be more accurate.

Yet you continue to claim reddit doesn't "validate input in any text boxes on the site."

--creator of reddit found the same exact exploit months ago

No. The exploit on YC news was an XSS exploit in link submissions that allowed me to run javascript on any YC user's client.

--textbook XSS exploit.

Hardly. There was no hidden JS, which is the defining characteristic of an XSS exploit. Certainly we shouldn't allow JS links, but making the claims you have are nothing more than a bogus stretch for attention.

Congrats on receiving it...
When did this site gets mods? If pg's not around to fix it, it stays broken, I think.
Actually, a related and perhaps more interesting question might be: considering a viral marketing scenario, how can one compute a practical upperbound on how quickly website traffic would grow?
There are about 15 editors.
I prefer the term developers. Programmers program computers. Developers develop software (which involves programming computers, but goes beyond that).
why is the thread marked dead?
I would say plan for some traffic you can afford, but know of someone that can help you out if you really get into trouble. It's along the lines of "worry about that problem when you have it, because that problem is a great one to have".
It's a great situation to be in, but it's not a great problem to have. Worry about this before you launch because turning away potential users isn't a goal.
That first person sounds like failure to me. A persistent one, however.
Mi ci vorrebbe una vacanza per girare un po' il mondo infatti ;)

Btw, your Italian is fine!
The term programmer makes me thinking "we need 100 programmers to meet our deadline!"... stupid concepts like working_code=num_programmers x time and in general that programmers are easily interchangeable.

Developer is much better and is able to evoke the idea that it's not just a matter of writing code but there is a design process involved.

p.s. how can I write a verbatim asterisk? backslash quoting does not work
Putting users in charge
In Fierce Competition, Google Finds Novel Ways to Feed Hiring Machine
I wouldn't necessarily opt to host in the US. I wouldn't host in Poland, but certainly Canada is an option. As a Canadian myself, I've been trying to avoid the US actually, since I'd rather not have my systems be subject to the PATRIOT act.
&#42; yields *