Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Got a startup idea? Validate it with the Startup Toolkit

thestartuptoolkit.com

Post reply on HN
Print view View original

11–20 of 35 posts

Re: Got a startup idea? Validate it with the Startup Toolkit

#11

Post by wwortiz »

robfitz wrote: post #2

Hey guys, I put this together as a easier way to visualize & update your business hypotheses. Writing down the beliefs your startup is based on is crucial... it keeps you focused on risks instead of features, makes communication w/ team & investors easier, and stops you from ignoring the evidence. Yet most people don't do it (and almost no one consistently updates them). I thought Steve Blank's customer development w…

Just as a future heads up that jpg you have on the front page would look much better as a png (nothing mission critical or anything), other than that I'm not a fan of pop up editing but I really can't think of a way you could do it better.

Nice work otherwise.

Re: Got a startup idea? Validate it with the Startup Toolkit

#12

Post by robfitz »

gizmo wrote: post #7
edw519 wrote: post #4

My first thought was that this would be silly. Until I went inside and saw for myself. Very thought provoking, an exercise definitely worth my while. Until I read this: We'll try our best to preserve your data, but no guarantees. Your canvas is secured by obscurity, which is to say it's not very secure at all. Anyone with your canvas' URL may view and edit it. If and when we add a paywall, we'll make sure you can exp…

> Honestly, how hard would it be to just fix this first? I thought it was a breath of fresh air. The unique ID is clearly very random and long enough to be unguessable. Even if the user and document hashes are not picked in a cryptographically secure way it's still going to be much more secure than the average alpha web 2.0 app that's hacked together with some generic login&auth component. I think you should be upset…

Thanks for making me seem far smarter than I am. My mental process was basically: "Etherpad was easy to use, I'll do that." (come on google, I'm just like them!)

You can also type in a more memorable URL (like etherpad, trend emerging) but that, of course, makes it much more guessable.

Re: Got a startup idea? Validate it with the Startup Toolkit

#14

Post by edw519 »

gizmo wrote: post #7
edw519 wrote: post #4

My first thought was that this would be silly. Until I went inside and saw for myself. Very thought provoking, an exercise definitely worth my while. Until I read this: We'll try our best to preserve your data, but no guarantees. Your canvas is secured by obscurity, which is to say it's not very secure at all. Anyone with your canvas' URL may view and edit it. If and when we add a paywall, we'll make sure you can exp…

> Honestly, how hard would it be to just fix this first? I thought it was a breath of fresh air. The unique ID is clearly very random and long enough to be unguessable. Even if the user and document hashes are not picked in a cryptographically secure way it's still going to be much more secure than the average alpha web 2.0 app that's hacked together with some generic login&auth component. I think you should be upset…

What you want is security, but what you ask for is a login page.

Sorry if I didn't make it clear enough, but all I want is:

1. the ability to add, change, or delete my any of my data at any time

2. the ability to share my data with exactly whom I want, no more, no less

OP guarantees neither (and, refreshingly, admits it). In fact, "We'll try our best to preserve your data, but no guarantees" and "not very secure at all" were his words, not mine. I was responding to his disclaimer, not my interpretation of his site's security.

[FWIW, I use ramamia by hner's jasonlbaptiste and markbao, which has a great and appropriate implementation of unique id. But then again, I'm less concerned about the security of my family reunion plan than of my business plan.]

Re: Got a startup idea? Validate it with the Startup Toolkit

#15

Post by gizmo »

edw519 wrote: post #14
gizmo wrote: post #7

Earlier quoted context omitted.

> Honestly, how hard would it be to just fix this first? I thought it was a breath of fresh air. The unique ID is clearly very random and long enough to be unguessable. Even if the user and document hashes are not picked in a cryptographically secure way it's still going to be much more secure than the average alpha web 2.0 app that's hacked together with some generic login&auth component. I think you should be upset…

What you want is security, but what you ask for is a login page. Sorry if I didn't make it clear enough, but all I want is: 1. the ability to add, change, or delete my any of my data at any time 2. the ability to share my data with exactly whom I want, no more, no less OP guarantees neither (and, refreshingly, admits it). In fact, "We'll try our best to preserve your data, but no guarantees" and "not very secure at a…

I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either.

When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm saying that a very simple system with very obvious security implications may be preferable to a complex system. It's easy to get Open Auth wrong, it's easy to get logins wrong, and so on.

Many apps will give you that login form and the share and delete buttons but chances are you would shudder at the thought of using the app if you knew what the backend looks like.

About those remarks on the page. The first one, "We'll try our best to preserve your data", is the best you can hope for in any situation, and the second remark that the website isn't very secure at all is also truthful given that it doesn't even use SSL.

So to reiterate, login forms on an app may make you feel more secure, but it won't bring you any closer to what you want.

Re: Got a startup idea? Validate it with the Startup Toolkit

#16

Post by edw519 »

gizmo wrote: post #15
edw519 wrote: post #14

Earlier quoted context omitted.

What you want is security, but what you ask for is a login page. Sorry if I didn't make it clear enough, but all I want is: 1. the ability to add, change, or delete my any of my data at any time 2. the ability to share my data with exactly whom I want, no more, no less OP guarantees neither (and, refreshingly, admits it). In fact, "We'll try our best to preserve your data, but no guarantees" and "not very secure at a…

I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either. When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm…

"We'll try our best to preserve your data", is the best you can hope for in any situation

If that's the best my customers could hope for, then I'd be broke.

I absolutely guarantee the integrity of my customers' data. To anyone who doesn't, I ask, "Why not?"

Re: Got a startup idea? Validate it with the Startup Toolkit

#17

Post by curiousfiddler »

To be very honest, my first thought is that in all "HONESTY" you CANNOT do all this - its impossible to do all these things (claimed on the website), without experiencing those in person and it will vary from person to person based on the context, circumstances, idea etc. I think it will be a disservice to any confused soul (I am guessing those are the kind of people who would hit your site) by claiming to do things that are not practically possible, without actually experiencing those.

Re: Got a startup idea? Validate it with the Startup Toolkit

#19

Post by aarongough »

edw519 wrote: post #16
gizmo wrote: post #15

Earlier quoted context omitted.

I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either. When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm…

"We'll try our best to preserve your data", is the best you can hope for in any situation If that's the best my customers could hope for, then I'd be broke. I absolutely guarantee the integrity of my customers' data. To anyone who doesn't, I ask, "Why not?"

Because giving an absolute guarantee of anything is impossible?

Re: Got a startup idea? Validate it with the Startup Toolkit

#20

Post by gizmo »

edw519 wrote: post #16
gizmo wrote: post #15

Earlier quoted context omitted.

I know you want to do (1) and (2), but my point is that you're not getting that from the other web 2.0 apps either. When you delete data perhaps only a is_deleted flag gets toggled in a database, and copies of your work may reside in backups for months or even years. When you want to share your data you want to be reasonably certain the app is secure, but there is no way for you to determine if this is the case. I'm…

"We'll try our best to preserve your data", is the best you can hope for in any situation If that's the best my customers could hope for, then I'd be broke. I absolutely guarantee the integrity of my customers' data. To anyone who doesn't, I ask, "Why not?"

Of course, I said this in the context of a free app that's still in beta!

Maintaining data integrity during worst case scenarios is difficult, even when you have the budget and expertise for it. Especially if you offer real guarantees to your customers you should know that it's completely unreasonable to expect the same from a proof of concept web 2.0 app.

Post reply on HN