If you're interested in a non-Cloudflare solution, we have developed a service called Gatekeeper, and we'd really like to get your thoughts on whether it might suit your needs: https://www.nettoolkit.com/gatekeeper/about
Essentially, Gatekeeper is a rules-engine with a fancy UI that allows you to craft policies specific to your site and the traffic that is visiting your site. For example, you can say "Allow Googlebot" and "Show CAPTCHA to visitors from AWS on every fifth visit". If you'd like to communicate offline, you can find our email address in my profile.
In terms of implementation, one key difference is that Cloudflare sits between your servers and your users, whereas with Gatekeeper, your servers query Gatekeeper before deciding what response to send to users. One of the ramifications is that with Gatekeeper, your users never see a third-party page about verifying that they are not bots. It also means that when using Gatekeeper, you can actually debug if/when something unexpected happens.
Gatekeeper also allows you to look over previous traffic patterns and adjust your custom rules. Philosophically, our assumption is that website operators know their sites the best, and know what content they are sensitive about and Gatekeeper is a tool to help review traffic and express custom rules. I think Cloudflare is a better fit for operators who don't want to spend time fiddling with various very granular knobs to optimize for their specific site and their specific concerns.
Gatekeeper can also be used for other purposes. For example, the idea behind Gatekeeper originated because we have a site where we want to make information freely available to humans, but not to scrapers. However, Gatekeeper could also be used to upsell users who frequent your site (e.g. "We noticed you've viewed 10 articles in the past week, please subscribe!").
If you're considering custom logic like https://news.ycombinator.com/item?id=33160679 , Gatekeeper already has a rules engine so that you specify such policies without having to write your own infrastructure.
I'd be happy to chat further to learn more about what you're looking for and to see if Gatekeeper might be able to help. Feel free to reach out via email (in profile) if you'd like to talk more.
Not the personal advice that you're looking for, but would you, your partners, and your investors be interested in selling the zombie startup? We serve enterprise customers, and think that a "couple hundred k in revenue" is quite impressive, especially for just two years with very little professional experience.
If you have current customers, they might appreciate knowing that there is continuity, and might be more open to you if you were to ever reach out to them again.
> Try applying to smaller companies. Smaller companies aren't going to land the candidate from a top 10 school who already interned at multiple Fortune 500 companies. But small shops need to hire talent too. They're digging deeper and they have to read the resumes more closely. There isn't much of an HR department, and the hiring manager might be sifting through the raw resumes themselves.
This describes my situation when I'm hiring entry-level developers: I, the hiring manager, am reading each application that comes in. However, I think this is probably more true for smaller companies that are not venture-backed; venture-backed companies probably have enough funding to hire senior developers (and are probably more rushed to do so).
For the OP: I'm not hiring developers at the moment, but if you'd like to send me your resume (you can reach me through my profile), I can offer some feedback.
As a note: With recent spike in salaries, many venture backed companies don't have the cash to pay the salaries of good seniors. Spoken with a dozen founders in SF facing this problem over the past two months.
This doesn’t seem possible. Startups are raising Series A rounds of 15-20 million routinely. A quarter of that would cover a reasonable number of senior engineers for a year or two.
But just in case it is possible…
Maybe they should try offering meaningful stock packages, rather than 0.1% and less?
Meaningful as in 0.5 to 1% for a senior engineer, 4-6% for a manager, until salary improves.
Also, try offering stock with no vesting cliff. It’s not smart to trade salary for stock when you might leave before the cliff through no fault of your own. So smart candidates often round the value of stock to $0, especially before the cliff.
You shouldn’t be giving managers 6-8x what you offer senior engineers at a startup, at least not in a startup where engineering matters.
If smart candidates are rounding the grant value down to zero, smart companies will not seek to give grants that are multiples of the current size. (That’s giving away $100 bills to someone who values them at less than your cost.)
When you’ve raised a $20M round and have an employee pool that is 10-20% in total, you don’t have many 1% grants to give…and you have exactly zero 6% grants to give.
> When you’ve raised a $20M round and have an employee pool that is 10-20% in total, you don’t have many 1% grants to give…and you have exactly zero 6% grants to give.
This is true, but the percentages illustrate how silly many investors are being about the resources necessary to put together a good engineering team.
I've had offers from startups with well known VC backers who wanted me specifically. They'd tell me their upper bound on cash, and then assuming I thought they had a decent chance, I'd calculate how much stock I'd need to make for the expected value for working for them to be at least as good as at a big tech company. Generally the calculation came out to 4-6% of the company per year.
That number could be lowered if I had access to the cap table or were being issued some kind of preferred stock, but no one's willing to do those things either.
Cash is cheap and labor is expensive but investors still want a way better deal than any engineer could dream of.
This is why I left Silicon Valley and founded my last company FAR, FAR from it. Silicon Valley is 100% OVER. It's jumped the shark. It's overdone and needs a fork stuck into it.
I sold the company 3 years ago. My latest company is doing so much better than it could ever be possible if in Silicon Valley in terms of "R&D budget/Investor capital".
It means we'll attain things that Silicon Valley startups with exactly that kind of personnel compensation requirements NEVER WILL.
SF a good senior can run you 350k/year not including overhead, add on overhead and you can quickly be looking at costs of ~500k per senior per year.
Vesting cliff isn't the only problem with stocks either. Common stock holders can easily get screwed over when raising or during any liquidation event that isn't an IPO or direct listing. The disparity in treatment means as an engineer you need to value stock at 1/10th face value as a rule of thumb.
The offer you handed out was not for me but is it okay if I send you my resumé as well? I am in the same boat as OP except it’s been a month since I graduated.
The more I read comments on subjects I am intimately familiar with, the more I realize most people who comment on HN don't really know what they're talking about and mostly make things up.
To answer your question, you can't find these servers because they don't exist. A server with 4T of RAM will cost you at a minimum $20,000 and that will be for some really crappy low-grade RAM. Realistically for an actual server that one would use in an actual semi-production setting, you're looking at a minimum of $35,000 for 4TB of RAM and that's just for the RAM alone, although to be fair that 35k ends up dominating the cost of the entire system.
> the more I realize most people who comment on HN don't really know what they're talking about and mostly make things up.
I don't think they're typically making things up. It's what I prefer to call Reddit knowledge. They saw someone else claim it somewhere, they believed it, and so they're repeating it so they can be part of the conversation (people like to belong, like to be part of, like to join). It's an extremely common process on Reddit and most forums, and HN isn't immune to it. Most people don't read much and don't acquire most of their knowledge from high quality sources, their (thought to be correct) wider knowledge - on diverse topics they have no specialization on - is frequently acquired from what other people say and that they believe. So they flip around on Reddit or Twitter for a bit, digest a few nuggets of questionable 'knowledge' and then regurgitate it at some later point, in a process of wanting to participate and belong socially. It's how political talking points function for example, passed down to mimic distributors that spread the gospel to other mimic followers (usually without questioning). It's how religion functions. And it's how most teachers / teaching functions, the teachers are distribution mimics (mimics with a bullhorn, granted authority by other mimics to keep the system going, to clone).
It's because some very high percentage of all of humans are mimics. It's not something Reddit caused of course, it's biology, it's a behavior that has always been part of humanity. It's an increased odds of success method of optimizing for survival of the species, successful outcomes, meets the Internet age. It's why most people are inherent followers, and can never be (nor desire to be) leaders. It's why few people create anything original or even attempt to across a lifetime. It's why such a small fraction of the population are very artistic, particularly drawn to that level of creative expression. If you're a mimic biologically it's very difficult to be the opposite. This seems to be viewed by most people as an insult (understandably, as mimics are the vast majority of the population and control the vote), however it's not, it's simply how most living things function, system wise, by mimicry (or even more direct forms of copying). Humans aren't that special, we're not entirely distinct from all the other systems of animal behavior.
That saying, safety in numbers? That's what that is all about. Mimicry. Don't stand out.
The reason most Wall Street money managers can't beat the S&P 500? It's because they're particularly aggressive mimics, they intentionally copy eachother toward safe, very prosperous, gentle mediocrity. They play a game of follow, with popular trends (each decade or era on Wall Street has popular trends/fads). Don't drift too far below the other mimics and it's a golden ticket.
Nobody got fired for buying IBM? Same thing. Mimic what has worked well for many others is biologically typically a high success outcome pattern (although amusingly not always, it can also in rare occasions lead off a cliff).
The Taliban? The Soviet Union? Nazism? Genocide? Multi generational patterns of mistake repetition passed down from parental units? That's how you get that. People mimic (perhaps especially parental units; biology very much in action), even in cases where it's an unsuccessful/negative pattern. All bad (and good) ideologies have mimic distributors and mimic followers, the followers do what they're told and implement as they're told. And usually there are only a very small number of originators, which is where the mimic distributors get their material.
The concept of positive role models? It's about mimicry toward successful outcomes.
Being a mimic and being a leader/creator are not exclusive; you can do both in various fields. One can even mimic and eventually start creating their own things on the back of that: “fake it until you make it” is a real thing.
> The more I read comments on subjects I am intimately familiar with, the more I realize most people who comment on HN don't really know what they're talking about and mostly make things up.
HN doesn't look exactly like SlashDot, but it's absolutely just like SlashDot.
I just Googled [servers with 4T of RAM], but apparently no, it does not include the RAM itself. Came up with this (about $4K base, another $44K to max it out with RAM):
Yeah, I've been eyeing the EPYC servers, but RAM pricing seems to very roughly be in the ballpark of $1,000 for 128GB, so $4k for 4T sounded very attractive and I wanted to make sure that I wasn't missing anything. As
cvwright pointed out, you can get old DDR3 RAM for less, but I haven't found servers that can fit that many DIMMs. Thanks for your response.
We also have a JavaScript library (MapWrapper) that makes working with maps easier (including allowing you to easily switch among a few of the different tile providers).
Self-plug: NetToolKit Geo (https://www.nettoolkit.com/geo/about) offers very affordable map tiles (both raster and vector) and geocoding (plus a simple autocomplete feature for within the US). You can also configure whether your account automatically replenishes credits if they fall below a certain threshold, so you can have better control of spend.
We at NetToolKit have been working on related problems for years and might have two products that directly address what you are looking for.
We launched Shibboleth (a CAPTCHA service) about a year ago, and you can select from a variety of different CAPTCHA types (including some non-traditional types; different types have different strengths and fun factors): https://www.nettoolkit.com/shibboleth/demo There are a variety of options that you can set, and you can also review user attempts to solve CAPTCHAs to see if you want to make the settings more or less difficult.
Recently, we launched Gatekeeper ( https://www.nettoolkit.com/gatekeeper/about ) which competes against Distil and others, but without fingerprinting. Instead, site operators can configure custom rules and draw on IP intelligence (e.g. this visit is coming from Amazon AWS or this IP address has ignored ten CAPTCHAs in two minutes), and Gatekeeper will indicate to your website how it should respond to a request based on your rules. There's also other functionality built in, such as server-side analytics. Some light technical integration is required, but we're happy to help with that if need be.
As with all NetToolKit services, we have priced both of these services very economically ($10 for 100,000 credits, each visit or CAPTCHA display using one credit).
We would very much appreciate a conversation, even if it is only for you to tell us why you think our solutions don't fit what you are looking for. I would be happy to talk to you over the phone if you send me your phone number via our contact form: https://www.nettoolkit.com/contact
Yep, unfortunately usage based billing is not possible for us. We can't use any usage based cloud services at all due to abuse and attacks - can't even host a simple avatar or button images on S3 without someone trying to infinite loop curl them to blow through budget abusively. On top of that, if you're going to reverse proxy the site, your service will probably be hit repeatedly with 300G+ attacks.
Do you have an email (ideally one that doesn't pipe into a ticket system)? Maybe I can share some possible/creative attacks we've seen that you can improve your service with, even if it's out of budget for us.
As a comparison note, Stackpath does 1mil requests for $10/m.
Our contact form does not pipe into a ticketing system (it goes into support@[our domain, available via our profile link], which is just a G Suite email account that you can use to contact us directly).
I'd very much appreciate hearing your thoughts about attacks and understanding what an effective solution would be. Thanks also for your note about Stackpath -- we aren't a CDN, but Gatekeeper could help reduce bandwidth usage by denying requests.
How can I self host this, and are you aware Shibboleth is a very old and actively used, well known software? I was quite confused seeing that in the dropdown.
We currently don't offer a self-hosting option, unless it were in the context of an enterprise agreement. If this functionality interests you and you have a large volume of visits, please contact us and we can talk about specifics.
We were not aware of Shibboleth single sign-on before we launched, and someone noted the name collision on our Show HN thread. If many people are confused about this, we would certainly consider a different name. The development team wanted a non-generic name (e.g. CAPTCHA), and naming has proved a challenge for us, so if you have any suggestions, please let us know.
Essentially, Gatekeeper is a rules-engine with a fancy UI that allows you to craft policies specific to your site and the traffic that is visiting your site. For example, you can say "Allow Googlebot" and "Show CAPTCHA to visitors from AWS on every fifth visit". If you'd like to communicate offline, you can find our email address in my profile.