LukaAl

Same way as the encryption key used to secure the communication with your bank. It doesn't.

The idea behind TLS is that the client and the server agree on a temporary key to exchange the information in a secure way (there's a ton of literature on it) without saving the key locally. The good news is that it is something already implemented in a safe way in all sufficiently recent browser (for sufficiently recent I mean, sufficiently recent to support plugins, because also IE 6 supports some old form of SSL) and make them available to plugins.

TL;DR: It's trivial to do it right, screwing it up in this way means they have no clue on what security means.

I explained in a previous comment the problem.

As for the solution, without thinking too much, using TLS to encrypt the channel would do it. If we think the browser is not safe, well, all your stack is basically compromised. But if it could handle TLS correctly (and I guess it does it pretty well since it use it to send the info to your bank) it could get the password in a sfae way...

Every app that runs on your systems with enough privilege could sniff your username and password and send it out.

That means also apps installed by a person who has access to your systems or malicious code that you, or someone who as access to your system, launched on your system. I'm not sure where it put 1Password in terms of safely storing password, but it is probably in the area of a post-it on your monitor.

I don't know what's your opinion, but if I use a password manager, I'm expecting something more

No, they get less, but they are all qualified leads!

There was a study (sorry I can't find the link) few months ago that discussed how spam looks bad intentionally. The idea is to weed out the smart or even average guy and just get the person that are a good target for this kind of con.

> On the other hand, Zenefits might not have bothered with certification since it wouldn't have been legally required, or the requirements might have been less silly if certified professionals had to compete with non-certified.

You have to prove this. Also, you have to consider a problem in the way the market works. Insurance brokers are paid by insurance companies through referral fees, not by the final user. If you know something about economy, this should ring a bell: "moral hazard." Or we change the way the market works, but there could be unintended consequences or external regulation is required to ensure the market is fair.

Sorry, but I've troubles following your argument in this case. What you are basically calling for is one or more certification authorities that certify that person A is capable of performing a certain task. Am I right? This would replace required license. The difference is basically that licenses are mandatory, certifications are optional, and that (but I infer this from your Friedman's quote) certification authorities could compete.

If this is your point, sorry but your argument doesn't follow. There's nothing against the certification authority requiring 52 hours of training. And there's nothing against Zenefits cheating if they believe a certified expert is better than an uncertified one (and this is the argument underlying Mr. Friedman discussion).

Certification vs. Licensing is a complex discussion topic, I tend to prefer certifications over licensing, but this is definitively not the point with Zenefits.

I don't get that. What kind of investment is? I buy an apartment that has for sure some expenses related (concierge of the building, taxes) and depreciate over time hoping that prices will go up? Why not renting that apartment? I mean seriously... Why I can't rent that apartment for few thousands dollars a month? A 1M$ apartment that rents for 4k$ a months returns 4.8% before taxes and expenses, probably 2.4% net. Not a great returns but relatively low risk. And then, if market price raises more than inflation, I could have a good return once I sell it in the future. The same apartment, empty, give me money just in the future if prices goes up. Do you have any statistics for this issue besides anecdotal one that is what I found?

I love this conversation, and I'd like to give my feedback. First, no, you are coming across as a person who thought deeply about this concepts.

I like the idea of closeness but, as you noted, it is not always possible. I think that empathy is the right word, but should be better characterized. Empathy is trying to establish a connection, is to bring the two people close when giving the honest feedback so that it is perceived correctly. How to do it, that's another story.

One technique that I found very powerful is called feedforward. The idea is, instead of saying what someone has done wrong, suggest a way he could make it right the next time. Example, you sent an email without the attachment. I could tell you: "you should be more careful!" or I could give you a constructive idea, maybe creating a connection: "I understand that sometimes it happens to forget an attachment. I developed the habit of putting the attachments in the email before writing it, so I don't forget them". It is not a perfect example. But even if we aren't close, it gives you a sense of closeness, a feeling that I understand you, and I care about you.

The problem with this approach is that the receiving party should be receptive. I used this method and I received answers like "But I believe I was right because...". And this is the end. You could ignore the answer, knowing that your feedback was useless, or you could try to explain, but you have lost. Nevertheless, if the feedforward is ingrained in the company culture, it is something known and actively practiced (that means the example starts from the CEO), it helps to create a positive environment.

I'm not sure if that's what he means by empathy, or maybe his company uses a different technique. You are right: closeness, privacy, and maturity are essential for a positive culture were front-stabbing (or worse, backstabbing) is impossible. And empathy is the ability to bring someone close, especially when it is relevant to provide important feedbacks.

The article is interesting, but it fails to consider one aspect. AWS is a line of products, very broadly defined, instead of a single product, with different level of maturity. You go from services like EC2 that are IAAS to RDS and co. that are PAAS to some foray into SAAS.

I don't have first-hand insights, but my guess is that Amazon is working on many more products and offerings. And if it's not Amazon, are company running on AWS.

So, I'm pretty sure that having a break-down of the internal numbers between service we could see many different growth curves superimposed. Some that still experience exponential growth, other still grow but with a slow-down. The sum is still an exponential curve.

tl;dr: The growth will profile will depend a lot on the pace of product innovation AWS is able to provide. And that's different from, for instance, the Amazon Marketplace where the only innovation is going after a new category.

When I was learning violin, I used to mess around with my violin to understand how it worked (it was a very cheap one). One of the things I noticed was the covering the holes with paper changed a lot the tone of the instrument but very little the power of it.

Also, my violin teacher had a couple of superb (and very expensive) old violin. And there was a lot of variation in the shape of the f from instrument to instrument. Different f-holes give different "character" to the sound but the impact on the power was really limited.

I don't really get what all this rebuttal targets. The original essay is poorly thought and full fallacies. Despite that none points them out. So, let see some of them.

Ok, we shouldn't look at indicators of inequalities (the Gini Index for example), but we should look at inequality effects. Well, there's a lot of literature looking at it and finding that the Gini index is an acceptable proxy for the other measures (acceptable is kind of fuzzy here, bear with me). We also know that a Gini index of 1 doesn't mean perfect equality. This because it depends on the definition of equality and on what you measure. Also, we know that a little bit of inequality is not only acceptable but required to foster social mobility (and it is probably part of PG's argument). How much is the problem! But saying we shouldn't look at inequality index but at the underlying issues and the individual cases is as much a misguided suggestion as suggesting a startup to stop looking at DAU/MAU.

But even if we discount this critique as futile. Do we really think that reducing a little bit the inequality will stop startups? If we setup the system in a way that Page make just 10 billion dollars instead of 15 billion out of Google (I'm making numbers up) he would have decided for a clerk work instead? Is he seriously saying that? And then, wasn't him (to be honest, could have been Sam Altman) that said that you shouldn't start a company to become reach but because you think you are the only one able to solve this issue? I know it sounds like a straw man argument. It is a sort of. But I believe in the law of diminishing return. I believe that I started a startup because I was determined to solve a hard problem, not for the upside (although it was important, but I was smart enough to know that the probability of making big money were really small and other investment had better returns).

Then there's the point of variation in productivity that is so fuzzy my head exploded. What does he mean by that? Which his the definition of productivity he is using? Seriously, that's a problem. Because if he defines productivity by the ratio value individually produced/hours, I wonder how he estimates the value produced in the last week by Larry Page. By Google's value? And how he approportionate the value produced between Page and the thousands of people working for Google. Even for a simple example, how do you compare a productivity of a woodworker making chairs and a steelworker making swords? You could count the unit produced per day, but they are different products. You could assess the market values of their output, but I'm pretty sure the value of their output changes between peace time and war time without their productivity actually changing.

Finally, it comes the last issue. He acknowledges that there's a small number of startup founders coming from poor backgrounds. I don't have data about that, so I believe him. Yet, I don't think determination is something lacking from poor people; it is the opposite! So, which is the problem here? Well, my little anecdotal experience tells me that when your parents could help you, you could go for the long shot, but if you need to eat, it is better to find something that give you the food quickly. It doesn't go against his argument, actually, kind of make it. But I wonder why it didn't make it explicit.

It is interesting to see the math behind why it did not works and probably it is a good approach to never discard an idea just because it sounds stupid. But I see really a little value in this line of thinking.

One of the big issues with experiments is how much value they really drive, which is the real effects. In many situations we do A/B testing for changes whose real impact is a fraction of a percent of the tracked metric. If anyone followed the discussion about p-hacking in science [1] should really start wondering if the way we run experiments, considering the little changes we see, is not nearing p-hacking, especially when I see this ideas floating, and if we don't need to find more significant way of running our experiments.

[1] One of the first article I found about the issue http://journals.plos.org/plosbiology/article?id=10.1371/jour...

Well, there were two different backdoors:

- This one could be the work of an intern, maybe a smart one but definitively it doesn't seems very sophisticated (we should look at the code).

- The second one, we are not sure it actually existed but just that someone changed the parameters for the PRNG. But if it existed, well, it was a very sophisticated attack.

But that's not the point of your question! A string compare with an if is pretty easy to hide in the code. Especially if the string looks like a logging string. I'm pretty sure in a big patch could pass through a quick code review. Calling an HMAC function or hiding it in the auth code that already call the HMAC function is much more complex. Plus it is much more difficult to generate a password, salt couple where both the salt and the HMAC seems legit code. Even for an intelligence agency or an attacker with huge resources, it is difficult to get such result!

Well, simply storing and hashed version of the pass would be ok. Even an MD5 or a SHA1 would be enough to guarantee at least a "Very Few plus Us" security.

Hiding that in the could would be much more difficult. And using PKs would make the attack even easier to spot.

And then you have to consider that a "Nobody but Us" backdoor exist only on paper, not in reality. If a key exists and someone knows it, well sooner or later it will be discovered (disgruntled employees, hackers etc). The only safe backdoor is the none backdoor. Now, consider this problem from an attacker that doesn't give a st of your security. He knows that as soon as the backdoor is known (because someone find it in the code, because someone leak the password, because whatever...) the backdoor will be useless most systems. What you do, you design a safe backdoor or you design a backdoor with as little footprint as possible?

Obviously, legally sanctioned backdoor have a different set or constraint and making them safe is a requirement. The fact that it is impossible to prove them safe unless some assumptions (that always prove to be wrong, but...) are made, it's a totally different problem.

Not totally an expert but the explanation of what a PKRNG is overly simplified. The problem with Dual EC is not that it is a PKRNG, but that some design choice made allowed for allegedly planting a backdoor for agencies with enough computing power.

Basically one of the problem you are trying to solve with a CSPRNG is how you avoid to disclose the generator state with the random numbers. Obviously once the state is known it is easy to replay the sequence.

Since we don't like to reinvent the wheel overtime, a solution is leveraging known properties of hashing and encryption algorithms. The idea behind a PKRNG is to use a fairly simple state evolution function but then to encrypt the output with a known public key. Since a property of public key encryption is that you can't know the message if you don't know the private key, the state is safe for everybody except the owner of the key. If you then truncate the encrypted message and you choose the public key without computing the private key you get a very strong CSPRNG. To be more clear:

- There are procedure to generate a public key without generating the private key (but you should trust the person who generated the numbers).

- The encrypted message is truncated, so even if you still have the private key, you should guess the missing bit of the message to decode the state.

The problem with Dual EC is that the resulting encrypted message is not truncated enough (it is enough to protect against a casual attacker, not an organization with massive computing power like an intelligence agency). Plus doubt were casted on the procedure used to generate the public key, given that you were forced to use the one in the standard and not your own if you want to get certified.

The article is really cool even though it is a little bit simplistic in my view (and experience). I've also made this comment on the article by the way. The first problem is that rarely steps are independent from each other. I haven't seen hard data on this (and if they have hard data, they should look at it) but my guess is that if one step fell behind schedule, there's an higher probability for the next step to fall behind schedule. That's because the reason a step is behind schedule is not purely random but depends on the internal element of the project (it is harder than usual, using new tech, a person is overloaded and always late...) and all this problem will not magically disappear in the next steps. The second issue is that project are not so simple as a sequence of task. They usually have tasks in parallel,with different dependencies and sync point. Accounting for time variations on each step quickly become a total mess.

And so what? Last time I walked in a Starbucks, none made me buy a gift card using a gun. Actually none ever asked me to buy a gift card. The only time I bought one I was willing to buy it.

Since when selling to customers something they want is something morally wrong? Because it is an interest free loan? If you think about it the world is full of interest free loans.

Tickets for concert? Check

Service retainer (e.g: lawyers, accountants)? Check

Insurances? Check

Online retailers? Check (until they ship the good)

Again, what is morally egregious that makes fraud against them sort of a lesser crime?

In Europe a weekend, or even a daily trip if you happen to live close enough, to the mountain in winter for skiing is considered common and acceptable.

The distance is well inside the range of Tesla's battery if it wasn't for the altitude and the cold weather. If you don't have a charging station at your destination, better start walking...

This article is interesting but very naïve in is approach. First of all what he describes it is not a business model but part of the value proposition, and more specifically the value discipline. Yes, I'm using the Treacy Wiersema model[1].

So for instance saying that the low cost competitor couldn't afford to spend a little more on quality is dead wrong. If the customer you select values cost over quality (I'm not even looking into customer intimacy, the third discipline he misses) the are willing to pay a premium upfront for a product that is affordable over the lifetime (Total Cost of Ownership). That's why even in the volume market it is not always the one with the lower price to win. And different company could compete carving out a little different market.

Apple is for sure in the quality area. Tesla? My guess is that Tesla is in the Total Cost of Ownership, so totally different business model. Look how much they stress on the lower maintenance cost. Look at the direct distribution model that cut the costs down. Look at the free recharge at their supercharger network. Look at the calculator on how much you save buying a Tesla. Want more details? Their new battery factory will produce battery also for competitors to get to a scale big enough to reduce price. They open sourced their patents so other company will use their technology de facto increasing the consumption of component they need (lowering the price) and doing R&D with them.

Another aspect, Tesla is pretty much a vertically integrated company, even in a market where sourcing component and sharing platform is common, they produce a lot in house (e.g: the batteries). This is common when you look for the lower Total Cost of Ownership (it's in contrast with management mantra, all people that read just the first chapter of Traecy Wiersema book and not the next 19). On the opposite Apple outsource a lot even in a market where outsourcing is common. They do this to get the best component from the producer that happens to be able to provide it.

I know my analysis seems to be counter-intuitive, but if understanding and replicating Apple's business model (or Amazon, Tesla, Southwest, Nordstrom) was easy and intuitive I guess there will be no more Apple. I'm not even saying that I'm 100% right, to be fair...

[1]https://hbr.org/1993/01/customer-intimacy-and-other-value-di...

That's an interesting news but I don't think it will be Apple. Car manufacturing requires volume to be efficient (like any mass produced product, ça va sans dire). But it is also extremely expensive to ship compare to their retail price (you could put approximately two car in a full size container but 44k iPhones, do the math). Let's try to do the Apple's strategy. Apple could go for the Luxury market (BMW series 7, Maseratis and upper). The price, and more important, the margin you have, is high enough to make the transportation cost low enough. At the same time you don't have enough volume to have multiple factory. In this situation you build just one factory. Atlanta is an interesting spot due to it's good connections with the rest of the US and it's comparatively low labor cost (to the Bay Area). But it is on the east coast while it is probable an Apple Car in this price range will have more buyer on the West Coast. Plus in car manufacturing labor cost is a small factor (especially in the luxury segment). But staying close to the hq is a very important factor, especially for your first model. Plus, if you are planning to source component from Asia (electric motors, chips, batteries) being close to a port like LA or San Francisco could be a benefit.

Let's make the hypothesis that Apple is going for a relatively mass market instead (affordable premium, a BMW series 3, but the reasoning holds also for cheap subcompact). Apple probably needs more than one production plant if it plans to launch internationally, but a single plant is enough for the US market and the reasoning before still holds. Actually, in this scenario Apple needs to work out faster the productions issue so being closer to home is beneficial.

This obviously is true if you think Apple will produce the car. But it doesn't make sense based on their production philosophy, and it will be a massive investment when there are "white label" car manufacture ready to be the Foxconn of Apple Car. The first name I could came up is Magna Steyr but if they go for low volume super luxury there are a bunch of small manufacturer in Italy with a good pedigree (Touring, Bertone) with the know how, the production capacity, and the brand that fits Apple needs.

I'm not saying you are wrong, even if my bet for the plant in Atlanta is for a European Automaker, I'm just saying that looking at the logistics, building a plant in Atlanta is not really effective for Apple. Probably tax breaks could change this balance, but I doubt you could have secrecy and tax breaks for a business of this size.

From one point of view I don't buy in the skepticism surrounding an Apple Car. As many issue could exist, and this article present a long list, Apple has the resources and the capabilities to overcome them.

The problem for Apple right now is that is so huge that any business idea is so small in scale that doesn't move the needle. I mean a 1 billion dollar idea is a great pitch, but for Apple is less the 0.5% in revenue, doesn't make the board level.

From this point of view there are very few industry where you could venture with such a huge scale. The automotive industry is one of them and appears to be ready for disruption. The problem as mentioned in the article is the incredibly low margin. I don't believe you could cut a lot on the cost of production, years of experience have optimized the process an the material that get into a car is that much, you could reduce them by a lot without impacting safety. Apple could try to put a premium on their car, and the margin on ultra-high premium car (Ferrari, Lamborghini...) are higher than Apple's margin. But the price is so high that the revenue is razor thin. The point is, a 30% premium on a device that costs on average 400$ is 120$, doesn't reduce the buyers pool by a lot. A 30% premium on a 20K car is 6K, it change a lot. And if you go in the premium segment is even more.

Final consideration, maybe the price Apple is aiming are not electric car but direct competition with Google's self-driving car. Or if you want car as-a-service. It is something not totally in Apple's DNA but it could provide hefty profit margins. Could be that the release date is 2029 and not 2019?

That's not quite right what I have in mind. It solve part of the issue, the maintainability of 10+ integrations, but it is not really the biggest pain point.

The biggest pinpoint is having 10 different service that gives you quite the same answer but:

1) they cover different needs and you need a patchwork to customize to what you need (and when you are small it is not even sure you know what you need so the patchwork is biggest than needed).

2) they measure things in slightly different way making comparison difficult.

3) they have vastly different interfaces, thus requiring a lot of time to learn them (I like to learn new things, but my time is valuable and better spent on product features)

4) they create a mess in your code. This is the problem segment try to solve. It is relevant but not top priority. Actually, I'm not totally sure of the effect of inserting a level of abstraction doesn't actually make more complex to solve point 1 and 2 (it is not a critic, just a real problem I faced when I tried to abstract the analytics call in the app with few functions).

Probably the biggest challenge I had in my last startup was setting up the analytics platform. Obviously building an analytics platform wasn't the top priority (probably the last).

So you put Google Analytics on your website, then you need the tracking code from Facebook for the ads. And you add Flurry because it provides different analytics (e.g: Funnels and Cohort Analysis). We also logged on the DB some actions difficult to capture on analytics. Then you need mobile ads, so you add in your app the framework to track the install. And, I forgot, you have another platform to track your mailing lists.

The final result: for every business question you have data in at least 3 different platform that gives you three different answers. Even worst, when you are still struggling with the product your "hard tech" co-founder could not understand why you push to re-implement the analytics framework (not necessarily building it in house) while your business co-founder decide to don't ask questions and doesn't understand why you want better data. If it looks like a recipe for disaster is because it is.

We really need better analytics platform, easy to use like Google Analytics and MixPanel for the beginning but with the ability to build custom analysis for the growing biz.

This article is very interesting but fails to address one point. Why companies go for "Flat" or "Holocracy" organizations? I know three reasons:

- People tend to hate managers, they don't trust them.

- Flat team are faster removing the management complexity.

- There's more flexibility and more creativity around the problem tackled by the team.

The last reason is reasonable but is true applied for small unit inside the bigger organization, not the whole organization, as this article explains well. Nothing prevent to create a small unit with a specific task inside a bigger organization and to organize this unit (usually made by "star" employee) in a flat structure.

The second reason is disputable, it doesn't scale has the article suggest.

But the first reason is not addressed. And it is the real issue. I think everyone had terrible bosses and great bosses. We usually remember terrible managers as an example of the average managers (Mental association: Dilbert's Pointy Hair Boss) while we consider the great bosses we had as mentors, role models, guide. And we forget that they were also our manager. It is a form of selection bias.

There's also another issue at play, changing organizational structure, trying Flat or Holocracy is easy (I'm not saying that it's easy to do it right, it's easy to give it a try). Promoting the right person, with the right skills is difficult. And if you promote the wrong person (it happens) removing from a managerial position or moving him to a position that is a better fit is extremely difficult. So we all decide to do what is easy instead of what is difficult. Not sure I could blame someone, it is the people mindset, but doesn't mean that what is easy is also correct while what is difficult, when done right, proved to be correct.

No. Imagine tomorrow a new RFC suggest to use the reserved bit for something meaningful. Any implementation that check that bit and drop the packet if the bit is 1 is broken immediately, even if it is not impacted.

True story, some years ago I had to design a protocol for remote configuration using text messages. We used a char to send the status in a compact format but in the first version we used only the first 3 bit and we specified that all the other bit should be zero (we have done so in order to have a predictable default in the future and also to increase the readability of the logs). After few months in the field we noticed that using an additional bit would be useful. Don't want to go into many details, not a problem if the bit is ignored but nice to have to simplify the operations. We updated the protocol, issued the new specs, the vendors develop the new version, we test the new version and surprise: the IOT between the new server and the old client was broken. Why? Because the designer the implementer of the client was to strict on the must be zero clause and decided that a packet with a one was a corrupt packet and should be dropped.

The result was a slow campaign of firmware upgrade and a 1 year delay of introduction of the new protocol. And it was a closed system where we had full control of clients and servers. Imagine what happens with open systems.

By the way, it is an application of this principle: https://en.wikipedia.org/wiki/Robustness_principle

The article raises the issue for computer security but computer science is used in many other fields where it could have ethical implications. Self-driving cars is on top of my mind, but for sure other applications has issue too. So I agree with his point and should be extended.

I like your proposal in theory but I doubt it works in practice. I'll try to explain: in practice what First Round has done is measuring post investment performance. I'm pretty sure that if the sample is big enough you will have an "all male" startup and a "with female" startup that failed thus the min being zero in both case. This doesn't mean there's no bias.

The point is that when you decide which company you finance (the source of bias) you make an estimation of future potential. But your test (and PG's one) measure ex-post results. Since there's a lot of uncertainty between the ex-ante and the ex-post measure, your test doesn't work.

Let me put in another way. The measure you are able to perform is not H(x-C)f(x) but a * H(x-C)f(x) + (1-a) * random where random is a random number and a is the weight of f(x) on the final outcome. You are right if a is 1, you and pg are wrong if a is 0 (but it will be a problem for the VCs), for everything in between you have to make assumption on the distribution of random.

That assumes that the company reaches the IPO and its value holds. And still I don't get how lower they must be priced to be comparable to a growing startup, even risk adjusted. (And consider that the IRS could have something to say...)

If the company doesn't reach the IPO and get acquired, well check what liquidation preference means. Check this post to understand better how stocks in a startup works: http://heidiroizen.tumblr.com/post/118473647305/how-to-build... (it is focused on founders, but employee get the same treatment).

> Having gone through this process, the stage at which you can apply for an E2 visa is after you have raised your Angel/Seed round. (to clear the 100k~300k bar. We talked to several people about this and the most commonly cited number was 300k investment, already residing in a US bank account)

My experience on the process is that you have to demonstrate a commitment in the business through the money you spent. When we got the Visa we was in the process of raising our seed round and the money in the bank account were pretty low (but we've already invested).

I've no experience on your point of mixed founding teams but there's something to be considered, when the percentage of ownership from foreign citizen goes under the 50% the E-2 Visa is no more valid. If you are already near the limit and you plan to raise in the US better save money and check other solutions (e.g: H1B, J1, O1).

Anyway, better to have a Visa Lawyer assisting you, the only important information is that there are a lot of opportunity.

If they are from a "treaty country"[1] they could apply for an E-2[2] investor Visa given that at least 50% of the company is owned by entities from the treaty country (easy at that stage) and you could demonstrate a substantial investment in the company (if you are after the prototype stage shouldn't be a problem for a good visa lawyer).

On your specific question, from feedback of my lawyer, if they have invested (read: spent) more than 100K in the company they are good to go. No requirement on how much you have raised (but obviously at least 100K).

So should't be a problem for a typical YC company.

[1] http://travel.state.gov/content/visas/en/fees/treaty.html

[2] http://www.uscis.gov/working-united-states/temporary-workers...