Hacker Newsnew | past | comments | ask | show | jobs | submit | e98cuenc's commentslogin

Everybody loves to hate BendingSpoon, but there is a lesson here. They consistently rewrite the code of their acquisitions with a tiny team, fire everybody and are able to maintain and improve the product. They basically skip everything but engineers, and they are kept at a minimum. Feedback from users is the products they take over 1) become more expensive, 2) they ship features waaaay faster.

It looks like next generation private equity, and my guess is more houses will start copying them.


Also, their core development team is in Italy and they are considered by many the best company in the IT space in Italy.

What it means is that they have the top Italian talent, they pay them a very good italian salary that is still way lower than an american one.

So basically they have very capable people working on their engineering, at a fraction of the cost of the original staff.


> Also, their core development team is in Italy and they are considered by many the best company in the IT space in Italy.

That’s just PR to get students to apply and pay them peanuts. History shows that they acquire businesses, make them worst and destroy them.


I think that’s always the thing with any of these things. The companies private equity or Bending Spoons acquire are frequently inefficient, bloated and not the best-run businesses.

But its basically an admission that the business is in its extraction phase and will no longer innovate.

Relevant quote:

Private Equity is engaged in buying artisanal semi-businesses, turning them into businesses, propping up the numbers while destroying them —then, hopefully, destroying itself.


Can you provide proof that products ship features faster after they lay off their teams?


> It looks like next generation private equity, and my guess is more houses will start copying them.

Isn't this the same that Broadcom does on a larger scale?


As a Vimeo OTT customer, this is producing mixed emotions.


>They consistently rewrite the code of their acquisitions with a tiny team, fire everybody and are able to maintain and improve the product.

"improve" is doing a lot of heavy lifting here. Evernote and meetup are in worse states post BS. Shipping features and shipping value is very different in this landscape.

>It looks like next generation private equity, and my guess is more houses will start copying them.

Yes, that's why I hate it.


Citation needed for “improve the product”


Check out https://www.freepik.com/pikaso you can try flux and flux realism


These stats don't account for the much more common case of people that start renting a house and stop paying the rent indefinitely because technically it doesn't fit the definition of "okupas." I've seen estimates of that number being as high as 1% of the people renting, making it ~30K extra people living on a house they don't own and are not paying for.


The only stats I can find are https://www.idealista.com/news/finanzas/economia/2023/03/03/... - that shows 30k people actually evicted from houses they were renting but stopped paying for in 2022.

Can't find any numbers on how many people are not paying and indefinitely staying in flats. While I'm sure it's a slow process, personally I'd be surprised if there's that many people in that situation long-term, since there's clearly laws and a working process to remove tenants in this case (30k evictions for non-payment in a year means forcing an eviction is clearly possible).

Idealista has some details on the process and how long it takes here: https://www.idealista.com/news/inmobiliario/vivienda/2022/10... and suggests that 7-8 months is typical (really interesting how effectively Idealista dominates as the source for info on all these topics, superb example of content marketing).


That's interesting , where can I see those stats? And legally as you say it's not the same as squatting, it's quite different.


I don't see how they can continue the service, even with huge localisation effort. The capital sin is to be a US company. That subjects them to US law, including CLOUD act, which the UE considers to be incompatible with privacy guarantees.

Even if cloud providers use local datacenters they are still in "violation". If the US makes a data request using CLOUD act, they will have to comply, no matter where these servers are sitting.

Ironically, the UE intelligence services are happy to take the anti-terrorist information that the US is extracting with the CLOUD act and sharing with them.


To my understanding, the CLOUD Act is nothing like FISA already because it is about criminal law. Besides, the EU also recently enacted its own quite similar "e-evidence" law, and similar laws are pushed globally through the Budapest Convention. The biggest problem here probably is that the mutual legal assistance system is being replaced internationally by much more opaque practices. (And as for cyber crime, some major "players" are not participating.)


The intelligence services are not advocates for privacy laws.


Don't try to paint the US as the victim here because it's honestly ridiculous.


> which the UE considers to be incompatible with privacy guarantees.

Well, the whole "global jurisdiction" is iffy for the rest of the world.


Hi krono, can you provide an example of a search where you want something different?

My guess is that this issue was already there with previous generations of the search engine, as we already tried to serve what’s most useful to most users. On this work we have not tried to get personalized results, except on a country level. On future work we want to give customized results to each user, and I’m very interested in understanding if there is some signals that we can pick up to give you a better experience.


Justin’s first startup was Kiko calendar. Google launched Calendar and it died, they auctioned it and got 250K. Then started Justin.tv, and it led to Twitch and Socialcam.

It takes time to build a billion dollar company, it’s unfair to compare his current ongoing initiatives to Twitch.


We use it in Freepik, Flaticon and Slidesgo. It has a good performance and I find the source code easy to read / understand. It lacks some features from Elasticsearch, like CJK tokenizers, but we were able to work around that.

Very stable, fast, and easy to connect to mysql.


Why are then things like AWS, Azure, Google Cloud, … legal? Are they? I assume Amazon can access data stored in any of their servers, right?


> I assume Amazon can access data stored in any of their servers, right?

If you encrypt the data with your own key, they should not be able to access it.


Only if you encrypt before upload and decrypt after download, which renders almost all AWS/Azure/GCP services completely useless.


In-transit encryption protects you against this attack scenario specifically (if you own the keys obviously).


How so? Amazon, Google and Microsoft need access to your unencrypted data in order to provide most of their services (such as databases, analytics, machine learning). There's not much they can do with encrypted data. They can store it. They can pass it through. That's it.

This problem has to be solved on a political level. There is no technical fix and the legal workarounds appear to be exhausted.


My RDS data is stored encrypted on disks with a private key AWS operators has no access to [1] (or at least that's what they tell you), and the application layer connection is controlled by a password transmitted over a TLS-only connection, whose private key - again - AWS has no access to.

[1] https://aws.amazon.com/blogs/database/securing-data-in-amazo...


You're decrypting data on Amazon's hardware using software provided by Amazon. Of course they can access your unencrypted data if they have to.

It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?


The data in memory in that server is not encrypted. Amazon owning the server can log in it and read whatever part of the memory they want. I don't see how encrypting data at rest helps you in this scenario.

If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all.

How about Netsuite (Oracle), Netsuite, etc.?

My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?


Would creating competing services within Europe, falling under EU law, count as political or technical solution?


Creating "competing"* services does not solve the problem of how Europeans can continue to use U.S. services if and when they (we) prefer to do so based on technical merit.

I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other.

We need a legal agreement to sort this out or everyone will be worse off.

* They wouldn't actually have to compete at all if U.S services were banned.


Wouldn't Amazon still have access to metadata, e.g. connection info, IP addresses, etc?


Yes, that's absolutely right, and in fact about that I don't really know how the GDPR applies, and it's an interesting question to ask.


IP addresses (for connection setup) are personal data: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

You can process IP addresses without consent only if it is technically necessary: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph b)

But you always (!) need consent to transfer personal data to a non GDPR compliant entity: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)


To add: The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)

"(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."

See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II


Thanks, I'll scale this up to our compliance department, I'm curious about their answer now.


That last bit seems incompatible with how TCPIP works? Unless opening a connection in considered consent?


No, opening a connection and exchanging IPs falls under "technically necessary" processing of personal data.

But from a legal point of view we, as a European company, are forbidden to use any US infrastructure provider. We can't ask for consent to transfer data to an US based entity if our consent form itself is already hosted by an US based entity. And even if we did find a solution, like hosting the main infrastructure with a European company and asking for consent for some later data transfer, we are most likely forbidden to transfer data to US based entities at all.

From what my lawyer told me the ruling from https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... applies to all services from AWS, Google Cloud, ...

There will be many rulings that follow. Everybody is just waiting for the Irish Data Protection Commission to actually do its work, but the Irish DPC does not seem to be much in favor of data protection: https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-wi... & https://bigbrotherawards.de/en/2022/lifetime-achievement-iri...

This will change soon. From what I heard work is underway to let national data protection offices handle cases without the Irish DPC or force the Irish CPC to work.


It depends how much credence you put in the standard contractual clauses (SCC) added by these companies after the privacy shield was ruled invalid by the EU.

The idea with the SCC is that instead of all data transfers being covered by a single adequacy decision, each company adds SCCs to it's contracts with customers promising that data of EU citizens will be handled in a way that's compliant with GDPR.

Reading this piece from CNIL, I can't see how a US company is going to be able to use SCCs to protect EU citizens from data access by the US government. Non US citizens typically don't have a lot of rights in the eyes of the US gov and they've traditionally been pretty happy to rifle through the data of those people at will.

ed: the point by another commenter about using your own encryption key is a good one. However, the view of CNIL essentially seems to be that transferring any data to the US is risky so to me it feels like you'd be swimming against the tide.


They are probably not legal, either, yes.


Shameless plug, we have a good set of illustrations on https://www.storyset.com/. The big difference is StorySet illustrations can be animated and the styles are different. Both products are quite complementary.


Very nice. Is there an option to pay for illustrations to avoid having to place an attribution link?


Excellent question… we don’t have a separate subscription for StorySet, but you can download all these illustrations in Freepik.com without attributing if you subscribe to Freepik.

It’s an oversight that we don’t allow explicitly in the terms of use of the Freepik subscription to use content downloaded from StorySet without attribution. Let me try to fix that tomorrow.

Sorry the system is not straightforward, StorySet is a side project and we didn’t think of monetizing it.

Super glad you like it!


They look amazing. Is there a way to requeset custom illutrations?


This is awesome! Thanks!


The difference is that nginx really works. I had Panoramio, a photo website featured in Google Earth / Maps, using Apache. It started to fail down under load, and I quickly switched to lighttpd. It was faster but crashing, getting OOM, etc. I fixed a memory leak and a few more bugs, but it still crashed every now and then and I looked for alternatives.

This was 2006 and nginx was the only realistic alternative on the market. It worked beautifully since day 1. It saved my startup. Next year we got acquired by Google.

I only got 1 crash with nginx and it was partially my fault, I had an "expires 30y" on some images, and a morning on feb 2008 I came to the office and the whole site was down. After a very quick gdb session under panic I realized it was trying to get a weekday name on an array with a negative index. Nginx was adding 30 years to the current date and that was over 2038 and it overflowed. Igor fixed that issue in hours, and he graciously explained that I could have used "expires max"

Nginx has powered all my startups since then (Freepik, Flaticon, Slidesgo, Besoccer).

This guy has added more real value to the economy than most unicorns. A true hero.


Panoramio, Freepik and Flaticon? Man, you just collapsed what I thought there was an early Spanish startup success story and two different corporations from the US into a single person :D Maximum respect.


Wait you made Flaticon? I would like to to say thank you. Before I truly got into software I was a humble associate consultant and I honestly don't know how I would have made all those decks without you.


Thank you! My partner Alejandro Sánchez is actually who got the idea of Flaticon, and Fernando Fernández did most of the initial implementation. When we hired Fernando he was flipping burgers at BurgerKing :)


No thank you. I honestly don't know where I would be without you and Fernando. Those initial presentations gave my bosses the confidence to let me hang out with the engineers and start messing around with the code base even though I didn't know how to code. A few years later and I had my first CS paper published.

From the bottom of my heart, thank you.


How did you find Fernando?


IIRC we posted an internship. He was doing vocational training and applied. He didn't have any previous experience, but he was good on the interview. After the internship we hired him.


At the Burger King :-)


Panoramio was so good. I had photos there. People wrote me comments. Then Google just killed it. Fuck them.


Major Panoramio fan here. I have traveled a lot of places on that site. Thank you for making it :)


Yeah thanks to this thread I am definitely now remembering running into issues with memory usage and crashes with lighttpd.


Thanks for making Freepik


Panoramio user here! Big fan!


panoramio was amazing, thank you! a shame it was shutdown by g*gle.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: