jmstfv

Background workers are geographically spread out across multiple AWS regions: https://tryhexadecimal.com/docs/workers#locations

It is highly unlikely that all of them will be knocked down at the same time.

If workers suspect that there is something wrong with your website, they will check it from all locations at once. Website is only marked as down if more than half of them can agree on that. That alone knocks down most of the false positives: https://tryhexadecimal.com/docs/uptime#sequence-and-frequenc...

Jobs (e.g. uptime checks, payment processing, sending emails) are added to the job queue (Redis) and background workers pick it up from there, and churn through them asynchronously. Most of the work happens in the background, so in my case, Redis is a critical piece of infrastructure.

https://devcenter.heroku.com/articles/background-jobs-queuei...

It is just static HTML and CSS files, with sprinkles of JS when necessary. I don't like using third-party frameworks or themes because they tend to get in my way. I designed it all from scratch.

I've been experimenting with functional (atomic) CSS lately and built a small framework that ended up using in Hexadecimal (if you peek at the source code, you can see weird classes like m-0, p-0, etc..). I liked it, but one should be careful in not overusing it, otherwise, it is an unmaintainable mess, yet again.

Below, I linked my Netlify config [0]. My static files live in the src/ folder, so you should probably change that if you have them in a different folder. If you don't know what Content-Security-Policy (CSP) or Strict-Transport-Security (HSTS) headers do, leave them out. It is easy to shoot yourself in the foot if you don't know what you're doing.

[0] https://privatebin.net/?c794ba90771f6e10#GSnJJ3dnd5r3ZDGgi9R...

I do consider that but I'm still early in this game. My AWS spending is $1.38/day on EC2 and $1.05/day on RDS, all covered by AWS credit: https://tryhexadecimal.com/costs

I send my logs to Papertrail and they have a feature that will notify you if your logs match a predefined pattern. Some of the patterns that I use:

* Account deletion (DELETE FROM \"accounts\")

* New successful sign up (INSERT INTO "accounts")

* New signup attempt (Started POST "/signup") [0]

* Fatal Exception Error ("fatal" OR "exception" OR "error")

* Warning ("warn")

I do share my costs and tools publicly, in case if you're interested: https://tryhexadecimal.com/costs

[0] I got hit by a botnet attack couple weeks ago, so I keep a tab on their activity (https://news.ycombinator.com/item?id=21327416)

From time to time I ponder about all the terrible things that could happen: what can go wrong will probably go wrong so it helps to be (kinda) prepared.

I am a solo founder of a website monitoring SaaS [0]. Theoretically, my uptime should be higher than that of my customers'. Here are a few things that I found helpful in the course of running my business:

* Redundancy. If you process background jobs, have multiple workers listening on the same queues (preferably in different regions or availability zones). Run multiple web servers and put them behind a load balancer. If you use AWS RDS or Heroku Postgres, use Multi-AZ deployment. Be mindful of your costs though, because they can skyrocket fast.

* Minimize moving parts (e.g. databases, servers, etc..). If possible, separate your marketing site from your web app. Prefer static sites over dynamic ones.

* Don't deploy at least 2 hours before you go to sleep (or leave your desk). 2 hours is usually enough to spot botched deploys.

* Try to use managed services as much as possible. As a solo founder, you probably have better things to focus on. As I mentioned before, keep an eye on your costs.

* Write unit/integration/system tests. Have a good coverage, but don't beat yourself up for not having 100%.

* Monitor your infrastructure and set up alerts. Whenever my logs match a predefined regex pattern (e.g "fatal" OR "exception" OR "error"), I get notified immediately. To be sure that alerts reach you, route them to multiple channels (e.g. email, SMS, Slack, etc..). Obviously, I'm biased here.

I'm not gonna lie, these things make me anxious, even to this day (it used to be worse). I take my laptop everywhere I go and make sure that my phone is always charged.

[0] https://tryhexadecimal.com

Start with a "boring technology" [0], something that has been around for a long time and is likely to remain around for a long time. You don't want to waste too much time fighting with the new and shiny tech because building and running SaaS is so much more than just writing code. The reason I'm bringing this up is because the technology choices that you will make, will inform a fair amount of tooling-related decisions down the road.

I started working on Hexadecimal [1] earlier this year, and chose Rails, Postgres, and Redis for the job. It allowed me to get up and running quickly without wasting my brain cycles on wrestling with the unproven tech. Another benefit of using a boring technology is that there are lots of written and spoken material (e.g., blog posts, Q/A, conference talks) accumulated over time, so there is a high probability that someone already had a problem that you might encounter.

> What are the common tools needed to start a SaaS company?

That will depend on many factors: how big is your team, how much money and time you are willing to spend on particular problems, etc.. I'd say if you are a solo developer (or a small team), try to use managed services as much as possible but keep a sharp eye on your monthly costs. If you are on a shoestring budget (think bootstrapping), those $19 / mo subscriptions here and there can add up very quickly.

I do share my costs (and tools) that I use to run Hexadecimal publicly [2]. That should give you a vague idea about what tools it takes to run a bootstrapped, one-person SaaS. There are similar pages on the Internets that delve into that topic [3][4]

[0] http://boringtechnology.club

[1] https://tryhexadecimal.com

[2] https://tryhexadecimal.com/costs

[3] https://cushionapp.com/running-costs

[4] https://www.candyjapan.com/behind-the-scenes/running-costs-f...

For short-term items, I use pen and paper.

For long-term ones, I use TODO notes scattered around my Rails codebase. I have segmented those items into 3 categories: high, medium, and low. Whenever I create a new TODO note, I append one of those categories to it (e.g. TODO[low]).

Rails has a built-in command that displays all those items (`rails notes`). To filter items by the category, I pipe the output from that command to ripgrep:

    rails  notes | rg -S low

The easiest way to start would be introducing an invisible form field [0] and on submission, checking if it is not empty. Give this form field a random name so that it wouldn't be populated by password managers.

You can take it one step further and check how fast the form was submitted. If it is below the predefined threshold, it is probably a bot.

[0] To hide the form field, you can use one of these snippets, interchangeably:

    "display:none;"
    "position:absolute!important;top:-9999px;left:-9999px;"
    "position:absolute!important;height:1px;width:1px;overflow:hidden;"

They still try to sign up, but none of them can actually bypass the captcha. I implemented a custom callback that returns a HEAD response with 404 to fool them (because I noticed that attacks intensified when I returned 2xx or 3xx responses).

Two weeks ago my website [0] got hit by a botnet attack. These bots were submitting 2 POST requests to /login, followed by 2 POST requests to /signup, and since there were no checks in place, they were getting in quite easily. All their requests originated from residential IP addresses (probably hacked IoT devices) so IP blocking seemed impossible. I knew I needed to do something, but didn't want to send my users' data to Google.

I settled on implementing a honeypot technique using invisible_captcha gem [1]. It uses multiple techniques to detect bot activity, such as checking if the form was submitted too fast, hidden form attribute only visible by bots but not humans, etc...

Luckily for me, these bots weren't quite sophisticated so I managed to clamp down on their activity. I still get a couple of bogus signup attempts every day.

Disclosure: I am a contributor to the invisible_captcha gem

[0] https://tryhexadecimal.com

[1] https://github.com/markets/invisible_captcha

EDIT: grammar and wording

After many months of working on a product, I finally managed to (soft) launch it a few days ago. It definitely took way longer and turned out to be way harder than I expected it to be (it usually does).

Surprisingly, I really enjoyed working on the static site side of things even though it is dead simple: just good ol' HTML and CSS. No frameworks, no complicated builds, no third party trackers, and almost no JS. As a result, I managed to bring down the page load time to less than 500 ms (3kb when gzipped).

https://tryhexadecimal.com

If you are just building an MVP, you'd want to spend very little time on actually building the product. Here are some choices:

* Discourse forum: https://www.discourse.org/

* Slack channel

* Google Docs spreadsheet

Is there a hosted version of Gitea? Would it be possible to host it and offer unlimited repos for let's say $5/mo as a service?

Have you seen Metacademy? Here is a "tech-tree" for recurrent neural networks [0]. In the top-left corner you can switch between "graph" and "list" mode. Unfortunately, site hasn't been updated for some time. However, they have open sourced their code and I was thinking maybe we (volunteers) could pick up where they left off and continue this initiative. Previous discussion [2].

Edit: added previous discussion to the list.

[0] https://metacademy.org/graphs/concepts/recurrent_neural_netw...

[1] https://github.com/metacademy/metacademy-application

[2] https://news.ycombinator.com/item?id=7617683

Thanks for the reply! What is your take on foundmyfitness.com and Dr. Rhonda Patrick in general?

Thanks for the links! Reading from a source and weeding out "low-quality stuff" is a valuable skill to have. Not so long ago a study on telomere length was lambasted by HN community for having low sample size [0]

How do you choose which papers to follow? Any rules of thumb/red flags for assessing a paper?

[0] https://news.ycombinator.com/item?id=14575361

Would you mind sharing your opinion on index funds (VTSAX, VOO, etc) and corporate bonds?

Have you ever considered mining cryptocurrencies?

Out of curiosity, which books?

Dr. Rhonda Patrick explains how inflammation and depression are related. Might find these videos useful: https://www.youtube.com/results?search_query=rhonda+patrick+...

How do you fetch comment scores?

What about Ether? Does it makes sense to buy now and hold it, at $170+ ? Price is at all time high and most people on the web seem to be optimistic about its future (post-purchase rationalization?)

Out of curiosity, how viable is a search engine for hackers (in terms of a business model)? What are some "weaknesses" of Google that this search engine might take advantage of? One thing I noticed is the amount of "low-quality" pages that appear on the page#1 for popular keywords.

You might find these resources useful:

https://metacademy.org/

https://github.com/nikitavoloboev/knowledge-map

https://github.com/open-source-society

3Blue1Brown's videos are of a great quality. https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw

I found spacy's documentation lacking in details on how to train NER from scratch (at least I couldn't make sense of it). That's why I decided to stick with Stanford's NER.

Regarding disambiguation: People usually mention books with their respective authors, so it takes one query against the local database to check whether entity is indeed a particular book by a particular author. When no author is mentioned, I check parent comment (if any) to find if the given book is mentioned there. Well, and if comment turns out to be standalone then I query Goodreads / Google Books API. Given books with identical titles, these APIs return the most popular option.

I use Stanford NER to extract book titles and authors from HN comments. Previous thread: https://news.ycombinator.com/item?id=14202557

By the way, while researching about Metacademy I have stumbled upon their developer group[0] where they were discussing challenges they were facing, thought you may find it useful. Good luck! [0] https://groups.google.com/forum/#!forum/metacademy-dev