Hacker News new | past | comments | ask | show | jobs | submit | c0nrad's comments login

I do security Capture The Flag (CTF) writeups on YouTube. It's been fun, I've learned a lot, just published my 100th video.

https://youtube.com/@SloppyJoePirates


Not sure if this is interesting to the HN crowd, but some challenge writeups from a recent security Capture the Flag competition.


Going back to school for Physics (age 30). It'd be cool to understand why the universe exists before I die.


> It'd be cool to understand why the universe exists before I die.

I'm affraid physicsts aren't interested in this question (as it can't be answered by science).


Might be able to get enough understanding as to "what we have" (if not "why we have it") to be content for a human lifetime, though.


Ah thanks for the heads up. We'll wrap it in a html picture block. (Google's https://web.dev/measure/ recommends webp, but I should have done more research)


> Interesting article. How much requests can you support for 20/month before losing money with this stack?

Ha, I haven't profiled it yet. I'm not too sure. But, I think a decent amount. If a slack team with 10000+ physicists signs up, I may need to talk to them offline.

I do plan on doing some stress testing in the future for fun, I'll try to remember to reply here.

> partner frontend

Yep, to repeat what steve_adams_86 said, she did the frontend completely. Usually I'm forced to do the frontend, it was very nice having someone else just do the whole thing without me.


Teams with this number of physicists exists only in CERN which uses self-hosted mattermost. Don't worry from that for now.


Thanks for the insight!


Disclosure: I used to work at MongoDB, left 2 years ago.

True, it probably would have made sense to stay completely within AWS. If I didn't know MongoDB very well, I would have used DynamoDB.

But I know MongoDB well, and MongoDB Atlas (the hosted platform) also has a free tier, and it's hosted in ec2, and you can setup VPC peering (so network speed _should_ be comparable to dynamo, but not sure).

Also, Atlas (MongoDB's Cloud Platform) has a really nice "charts" product (sort of like a built in web based tableau) which I use for my internal dashboards (it takes <5 minutes to setup, for stuff like "how many customers do I have", "at what stage in the pipeline are they", "how many renders does each customer average", etc), and they have a nice web based "query explorer", which I randomly use when debugging something, when I don't feel like connecting with terminal.

But yeah, if I wasn't already biased, I would have used DynamoDB.


(Profitable Solo founder)

Thankfully lots of tools do most of the heavy lifting. I use k8s, GKE does most of the work for me. It's very nice to have autoscaling for traffic spikes. Same with database (MongoDB Altas), dead simple autoscaling. I would never run my own k8s nor database.

I wrote more details about some of the Ops stuff I do here in a previous similar question: https://news.ycombinator.com/item?id=26204402

Coincidentally I also wrote some architecture notes about a new product last night: https://blog.c0nrad.io/posts/slack-latex/

I think everyone's milage will very, but as general principles, staging is nice, reading docs saves time overall, tests help you sleep at night and make it easier to make changes 6 months in the future, simple health checks (or anything on a critical path) help you catch the real issues that need immediate attention.

Good luck!


I've been solo running/building a startup (csper.io) for over the last year, it just hit profitability a few months ago.

It's easier said than done, but if you can prevent issues in the first place, things will be much more enjoyable.

Some things that worked well for me:

  * GKE on GCP is pretty smooth. When there's a spike in traffic everything autoscales up, so I don't have to do anything. Nice observability, things just work. Just make sure to set container cpu/mem limits.
  * Along that same note, I use MongoDB Atlas which also autoscales very nicely. It autoscales both up and down very well, saving both money, and making my infra resilient
  * GCP has a lot of monitoring/alerting/dashboards that I take advantage of. Health checks around the world, easy integration of logs/metrics. I find structured logging (json), makes setting up alerts pretty easy
  * Good consolidated logging for when there is an issue you know exactly what went wrong
  * GCP also support application tracing which can make timing issues easy to debug (although it requires a bit of work to setup) (for example if you are missing an index on some db)
  * Automatic deployments (thanks to k8s), there's no checklist for doing a deploy, I just run a single make command. I can't screw that up
  * A staging environment that's a match of production. Plenty of times I've crashed staging, it's worth every penny. It also makes life much less stressful
  * Lots of tests. The tests aren't important for when I'm writing the code, but for months later when I make changes and want to know I didn't mess something else up. I find a good test suite can really help you sleep at night, specially if the test suite covers the critical paths
  * An easy way for users to contact you if there is an issue. No one is perfect, but being able to respond quickly is usually forgiven.
Also "stay-cations" are also pretty nice. I try to do one a quarter. I'm still at home if something does break, but I don't do any work for the week. Just load up a new video game and relax for a week. I call it my "monitoring" week.

Hope that helps!


Can you expand on the "Health checks around the world" ?


https://cloud.google.com/monitoring/uptime-checks

If I remember correctly you can specify a bunch of regions for the health checks to originate from. It was super simple to setup (point and click) and it's nice that it's decoupled from the rest of my infrastructure. When there's a failure I get a notification.


I built a little tool to turn the dial on my thermostat. It's called the Thermoshat.

https://blog.c0nrad.io/posts/thermoshat/


Okay, the name gave me a giggle. Then I clicked the link. Then the picture of the device gave me a giggle. Then the tagline gave me a good laugh.

Well played sir. Well played!


I run https://csper.io. It's a web app that simplifies some web security stuff Content Security Policy (CSP).

I helped setup CSP at a company back when I was an intern (2013). I learned that CSP can be an unpleasant experience.

A year ago I decided I wanted to do something new with my life so I quit my job and Csper was born. Hopefully it makes CSP easier for other people.

It's not super profitable, but it almost pays my rent, no complaints.


Is CSP required by any security standard?


Not many mention it, but I would imagine 5 years from now many will.


The copy in the subtitle has an error "the most advance set of ..." should be "the most advanced ..."


Spelling mistake "Under the hood the extension injects ..." in 'How it works' section


Nice website and service. I hope you do very well!


Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: