aimazon

Many mistakes were made by Lovable that they could be berated for but on a more positive note, there is a lesson for us all: if you're doing something that you're worried about being problematic (e.g: creating a large volume of GitHub repositories) reaching out is a good thing but it is important to understand who you are reaching out to. GitHub is a huge organization, front-line support is not likely to have intimate knowledge of how exactly the acceptable usage policy is enforced nor the permission to make agreements. The key when reaching out is to find someone who has authority on the subject. Ideally, GitHub's front-line support would have escalated to the appropriate person/team but that isn't always possible (maybe they don't know who, maybe they're having a bad day and forgot). If the answer you get seems too convenient, it is probably not correct.

The .new TLD is very restrictive, it is intended to be used for launching a new something, e.g: docs.new creates a new Google Doc. Your domain does not launch a new "bi" (whatever that is). The .new TLD is managed by Google and they do enforce this requirement.

> .new is a domain extension exclusively for performing new actions online: any act that leads to creation can have a quick and memorable .new shortcut associated with it. Help your customers take action faster. Less time clicking means more time creating.

You will lose your domain.

> While anyone can register, domains that don’t comply with this usage policy may be suspended or deleted by Google Registry without refund.

https://www.registry.google/policies/registration/new/

We don’t. People are social. We care about what the people in our community think, whether it’s factually accurate or not is inconsequential. Those of us wasting our lives arguing on the internet in the pursuit of truth are a tiny minority of atypical people. People yearn for the warm embrace of affirmation, not the cold hard truth challenging them at every turn.

Fact checkers are the technocratic solution, they're a panel of experts to Community Note's jury of our peers. Fact checkers are a much better product feature than community notes if we want a feature that best serves people who care about facts. That's not our world, though. People don't care about facts, we are humans, our lives are lived based on vibes. The average person would rather listen to their idiot friend's uneducated thoughts about transgender women in sport than listen to a lecture from an expert. Community notes is probably a better feature for the real world, but it's still junk, "effective" is not a label the feature deserves, because the majority of misinformation on X goes un-noted.

Mark has looked at what has happened to Twitter since Musk took over, a notable decline in activity and value… and decided he wants a piece of that? Musk is begging people on Twitter to post more positive content, as it devolves into 4chan-lite.

If Musk’s ideological experiment with Twitter had proven the idea that you can have a pleasant to use website without any moderation then Mark’s philosophical 180 would at least make sense, but this doesn’t, at all. What’s to gain? Musk has done everyone a favor by demonstrating that moderation driven by a fear of government intervention was actually a good thing.

Cloudflare are open about their compliance with these type of requests: https://www.cloudflare.com/trust-hub/law-enforcement/

If you're unable to find a lawyer, contact the court directly to seek advice on responding: you should be able to file a response yourself.

That said, keep in mind, if the person chasing you is willing to hire a lawyer to file in California, they're probably not going to stop pursuing you. They'll file again and again for different reasons in different jurisdictions. Cloudflare have your identity and will give it up every time they are asked to by a court, it doesn't take much for an enterprising adversary to get access to it.

At a minimum, get off Cloudflare immediately.

There's no such thing as a subpoena in the UK, just equivalents. I guess you translated it for an international audience, but can you clarify exactly what Cloudflare received? From what court? What did it require them to disclose?

Cloudflare do not guarantee protection against your identity being discovered when the law is involved, they are not a service for anonymity against the law. You will need to make peace with your identity being revealed. Although too late now, there are other options for publishing online with anonymity.

You’re in a much stronger position than you may feel that you’re in. Sure, your cofounder can dilute you but doing so is bad vibes that will harm team morale (because the team will know that he will screw them when their time comes).

The key to negotiation is being able to walk away. Start signalling that you’re willing to leave the company while holding on to the 49% and voting shares. That’s bad for him.

You could stand firm on 5% + 60k by telling him that’s your final offer, or you could present an alternative, e.g: you want your 30k cash back and you want equity, start at 10% equity but you’ll “give up” each 1% for 15k. If he wants you to walk away with 1% equity then he pays you 15k * 9 for the other 9%. If he’s already expecting to give you 60k, he’ll probably work out 30k + 2% = 60k and start thinking my maybe it’s a good deal, then he can negotiate himself down to whatever percentage he wants you to have. Change 15k with whatever number works for you.

That said, if walking away with the 60k is crucial and he’s a good negotiator then you probably can’t “win” and should just take the 60k + 1%.

> Lawyers I talked to told me different things, one that worked a lot with startups told me that it's a good deal, another one specialised in shareholder litigation told me I could squeeze the company dry.

They're not contradictory. The deal you've been offered is good and fair. However, you could take an adversarial position and squeeze your co-founder for a lot more if you're willing to sacrifice the company's wellbeing for your exit, e.g: you brought on the team and manage them, you could leverage that influence to poison them against your co-founder, the threat of you doing that would likely push up the buyout offer.

Take the 60k, push up the 1% to 5% (as that isn't going to adversely impact the company) and move on.

No, that wouldn't be considered standard practice. Fundamentally, if you are able to control the code that executes then you can exfiltrate the data regardless of how it is stored. The reason self-hosting is a secure way to execute code against data is because it removes the code from your control: with self-hosting, you would give your code over to the client and then they would run it in their environment.

Providing your customers with their own database in your environment is a method for segregating their data and ensuring that there's no unintentional co-mingling of their data with other customers (which is a common problem in a multi-tenant environment) but it does not protect the customer data from being accessed by you: if code you are executing can access the data, then you can access the data.

Reading between the lines ("a large portion of my possible clients seemed to be happy with the idea of the solution I provided") it sounds like my initial understanding of the situation was incorrect: I thought that you had been asked to build this specific architecture by your clients but it sounds like it's the opposite: you've had an idea, come up with an architecture and then validated that idea with potential clients by describing the architecture? Is that correct?

If that's the actual situation, I think this is a much simpler problem to solve. Architecture is architecture, it isn't a part of the solution, it's a means to an end. There are a very small number of clients who may have strict security/compliance requirements that do necessitate this sort of complexity (which is where self-hosting comes in) but for the majority of clients, how the product works is immaterial, they care only about the results.

Realising that you've made a terrible mistake when building a system using the architecture you designed 6 months ago is a rite of passage, it is the process: every vision you have today for how your system will work is probably going to be wrong 6 months from now. That's completely normal, you will learn more about how your system should work in 1 month of building than you would in 6 months of planning.

Try to take a step back from thinking about architecture. One of the biggest dangers when working on an early stage technology product is committing yourself to a technical direction that then dictates the product direction. If, for example, you decide today to build a system that in which clients self-host the database that your code accesses, and then you decide you want to build a feature that requires 10x as many queries to the database, oops, you can't build that, because it would require your clients upgrade their self-hosted database resources, and getting them to do that will be all but impossible.

If you want to share more about your idea, I can outline some ideas about how I might approach building it in a cheap way that allows for validating the idea. There are exceptions but nowadays, given the maturity of the software development space, most ideas can be built and launched to validate with real customers in 1 month. If your vision for how you'll build something requires, 3, 6 or 12 months to get customers using it, it's probably over complicated.

After years of working with Flexbox, I have realized Flexbox is like plugging in a USB-A: justify and align are always the wrong way around on first try.

How could they have been any clearer? Just because some creators didn’t realise they were being paid by Honey to cannibalise their own affiliate commissions does not mean Honey hid it. A number of creators have said this realisation about Honey has prompted them to take a closer look at how the companies they advertise work: that’s an admission of doing zero diligence when choosing to work with an advertiser.

The entire point of Honey is that it is activated at checkout: how else could it work?

Also ask yourself about the merchants involved: did NordVPN know about the relationship between Honey and affiliate commissions? Of course, they were paying Honey too. And yet NordVPN chose to use last-click attribution for deals with influencers.

You're getting caught up in the social media hysteria. Honey's partnership with merchants to create Honey-specific coupons is relatively new, Honey was sold to PayPal long before they had any partnerships with merchants, Honey's value (as a business) and revenue comes from the pure affiliate marketing: getting attribution for sales. Honey has never hidden this: https://web.archive.org/web/20191121204313/https://help.join...

My prediction for the response from Honey:

* Affiliate marketing attribution is understood to be imperfect, the best effort nature of it is priced in to the commissions

* Affiliate marketing uses multiple attribution strategies with varying trade-offs including coupon codes (e.g: "use code INFLUENCER at checkout for a 10% discount") vs. links ("click the link in my description") because of the imperfect nature

* Affiliate marketing is adversarial, all of these influencers have "stolen" attribution from each other

As Honey will have no problem proving:

* The advertisers (e.g: NordVPN) understand that affiliate marketing attribution is not an exact science, that n sales driven by an influencer does not translate to n affiliate commissions, and that the amount they offer to influencers per sale accounts for that

* The agencies that work on behalf of influencers to negotiate deals with advertisers understand the challenges of attribution and have negotiated based on this imperfect art of attribution

* The agencies/influencers/advertisers choose whether to engage in affiliate marketing by weighing up the benefits of being paid per sale vs. being paid per video or views

* There will be pages and pages and pages of emails within these influencer agencies where discussions have taken place on the choice to use affiliate marketing based on the audience of a video, e.g: link based affiliate marketing is less effective for an audience that watches videos on TV, vs. an audience primarily watching the video on a computer

* Honey was not receiving an equivalent rate to what the influencers were receiving, the influencers would not have earned their per sale commission x the number of sales if Honey had not captured the attribution (which demonstrates that this is all priced in)

Maybe PayPal will settle but given the harm this drama has caused to the Honey business, I doubt they have any intention of doing so.

I can't even begin to understand how they think this will succeed. The defence so many influencers employ when advertisers turn out to be doing shady things is "You can't hold me responsible! It's not my fault, how can I know what my advertisers are doing?" but as soon as an advertiser does something that harms the influencer, it's a problem?

Honey's business model has always been obvious to anyone with any understanding of affiliate marketing, their innovation was that they created a browser extension: that's it. Coupon code websites were doing exactly the same thing for decades before, retailmenot being the one we're probably all familiar with from the early 2000s.

The claim that these influencers have lost affiliate commissions because Honey's method is true but it's also true that these influencers are losing affiliate commissions to one another. Amazon is the preferred e-commerce platform for affiliate marketing because they are extremely generous with how they attribute: if you click an Amazon affiliate marketing link and then make any purchase in the next 30 days the affiliate will get paid regardless of whether they were advertising the product you bought or not. And guess how Amazon attributes? Last click!

If Influencer A includes an affiliate link for "Expensive Camera" and Influencer B includes an affiliate link for "Cheap Toy" and you click on "Expensive Camera" then click on "Cheap Toy" and then buy the expensive camera, Influencer B is getting paid for that purchase expensive camera purchase, despite Influencer A influencing you to buy it.

Affiliate marketing is adversarial, it's a fight for attribution at the expense of everyone else. Holding Honey to a different standard isn't going to work for them. Wilful ignorance of how a company operates isn't a defence against being harmed by them, it's embarrassing.

If they’re high margin businesses that can lock in customers it can work out for them. That’s why VPN sponsors do so well: very high margins and the deals they advertise are typically multi-year upfront payments so the signups immediately repay the advertising cost.

The worst examples are low-margin businesses that have high churn, e.g: food subscription boxes. Hello Fresh etc have extremely high churn so they’re paying advertisers orders of magnitude more than they make per sale. That’s why they’ve moved from “free trial” offers to things like “free desert for the lifetime of your subscription” to spread the cost of the offer over the lifetime of the subscription (but even that doesn’t make the model profitable).

Rule of thumb: when advertising via influencers (YouTube, podcasts etc.) assume you will receive a single payment from each customer before they churn. If the first (and only) payment the customer makes doesn’t cover the advertising cost (and operating costs) it’s a very bad idea. Free trials are the worst option because it’ll go from 1 payment to 0 payments.

You need access to their data to process it, any layer of indirection (like a database they control) is additional complexity without meaningful benefit. For clients with strict data control requirements, self-hosting of the whole system is the standard solution (with a very high licensing fee).

Something to keep in mind is that some clients are not operating in good faith, their goal isn't to work together to find a solution but to present roadblocks. The reasoning can be complicated, perhaps there's internal politics around which solution to use, perhaps your solution is receiving pushback because it's not the preferred solution of one stakeholder. You'll probably never know the true motivations, it's important not to get caught up in engineering a solution to a problem that doesn't really exist.

You've mentioned that the data you need access to is code: GitHub is a perfect comparable. GitHub's cloud service is used by the majority of companies with code, in fact, I'd guess even your clients are using GitHub's hosted services. If the problem is that your company doesn't have the reputation necessary to give these clients confidence that you can securely manage their code, that may just be a sign that right now, these clients aren't the right fit for you, and you should work with less antsy clients until you have built up the credibility.

If my primary device is compromised and my master password is compromised and the device that I use for second factor authentication into my password manager is compromised then the secondary device that I could use for 2fa codes is compromised. For most normal people, storing second-factor codes in Bitwarden alongside passwords is marginally worse at worst, and inconsequential at best.

Yes, if you use a bad password manager that is fundamentally flawed (like LastPass) then all bets are off but that's not an argument against the principle of storing 2fa codes alongside passwords in a password manager.

I doubt there's a single Bitwarden user on earth who has ever suffered a security incident because they store their 2fa codes in Bitwarden, that's how inconsequential this risk is.

Employer.com is a new "brand" from long-established Recruiter.com. My guess is that Recruiter.com planned to launch Employer.com in the near-term, and they saw the Bench.co shutdown as the perfect opportunity so they've sped up their plans and "launched" employer.com.

edit: after reading Recruiter.com's investor filings (as they're a public company) the acquisition of Bench is going to kill them. The founder has gone hog wild on acquisitions despite having barely enough income to support them. It's a tale as old as time: a medium successful company goes public and starts issuing shares to fund acquisitions at a rate far outpacing the business growth and suddenly, one day, the music stops and everything comes crashing down.

Anything is possible and running out of money is the most probable explanation but it seems so hard for this type of business to get itself into this type of situation. Customers pay thousands of dollars per year, usually upfront. That’s the type of revenue predictability that most of us would love for our businesses because it makes forecasting so much easier. They must have known months ago that they were running out of money. Failing to become sustainable and going through layoffs is one thing, shutting down overnight with zero warning is another. But yes, you’re probably right, it’s just hard to imagine how they could have imploded like this.

I guess we now know that the price of a bookkeeping and tax preparation service that won’t shut down without warning is the 2x pilot are charging of what bench were charging.

The company is over a decade old and was not cheap to use, I don't think they could have suddenly run out of money as customers typically pay upfront and are in long term contracts. Could it be staffing issues? Corporate misbehavior? Data loss? Ransomware? Has a member of their team gone rogue? Misappropriation of funds?

We were bench customers until a few months ago, paying thousands of dollars per year for what could only be described as hundreds of dollars worth of service. The service was not very good so moving away was an easy choice but on a per-customer basis they must be making money hand over fist.

I expect we'll find out more eventually, hopefully employees will leak some insight. For now, this is inexplicable.

If AGI were in reach, why would something so human as money matter to these people? The choice to transition to a more pocket-lining structure is surely a vote of no-confidence in reaching AGI anytime soon.

The law is designed to target large companies that aren't seen as doing enough to prevent harm on the internet. Setting up a CIC doesn't dodge the law, the legal entity (the CIC) remains accountable for conduct on the website. Setting up a CIC removes the risk from the individual website operator because they're no longer operating the website, instead the website is operated by a separate legal entity. The website could still be held accountable for violating the law but the consequence would be the CIC is fined, not the individual behind it. The same principle as any limited liability company.

Any competent forum operator is already doing all of this (and more) just without the government-imposed framework. Would the OP allow CSAM to be posted on their website? No. Would the OP contact the authorities if they caught someone distributing CSAM on their website? Yes. Forum administrators are famous (to the point of being a meme) for their love of rules and policies and procedures.

Yes. A CIC is just a limited company with some additional community interest obligations. You can set up a limited company to shield yourself from liability (i.e: if your website is sued by a user, your personal assets aren't at risk) and only in exceptional cases (where serious lawbreaking is involved) could you be held personally liable.

Rightly or wrongly, limited companies in the UK provide a high degree of protection for wrongdoing. Defrauding HMRC out of hundreds of thousands of pounds and suffering no consequence is happening day in day out. An Ofcom fine is nothing by comparison.

I agree but that ship sailed a decade ago. There's no additional risk with the new bill, it's more of the same. If there are concerns about liability because of this new bill then there should be concerns about liability already.

I sympathise with the OP because at some point everyone becomes too old to deal with the headaches of running a community. I have no opposition to their choice to shut down the forum. I just don't believe liability as a result of the new bill is the reason.

I like and respect the OP and their work. I do not think this is consistent with his previous levelheadedness.

edit: removed unintentional deadnaming

Don't run a website personally, set up a separate legal entity. The UK is one of the easiest places in the world to do this and has well-understood legal entities that fit the model of a community-operated organisation (i.e: "community interest company"). The fact that the OP is running such a large community as an individual is bonkers in the first place, independent of this new act.