LabSlice

Cloud seems to be the ultimate Rorschach Test, both in the real world and the IT world. (From http://blog.labslice.com/2010/09/wispy-cloud.html).

Lab environments are places were you can play with machines -- eg. customer POC, product evaluation, training environments etc. The objective is to move those lab environments to the cloud, for certain customer use cases.

We use regular AMIs. What we do is add management around it to make it into the 'lab' type environment. For example, we offer policies to help control costs, we can allow you to share an AMI simply by sending an email and we offer a multi-user environment for all employees within a company. These are all features that aren't readily available in the off-the-shelf EC2 environment.

I am quite certain that the EMV chip, which is the chip on your card, must authenticate the POS machines it talks to. The authentication is done using public key cryptography.

So it's not sufficient just to host a fake machine and expect it to be accepted within the EMV infrastructure (cards, POC machines and backend processors).

> my email address, is shared with a famous (in a bad way) world leader

Kim Jong Il?

Brute forcing gmail is not really feasible, especially not if you have a decent password in place. I suspect that they would just put up a captcha and maybe slow down the login process if you fail too many times.

If your computer is compromised and you keep using the system to either login or change your password then that password will continue to get compromised.

In many ways you are also best off to reimage your PC and create a completely new gmail account. If the account was sending too many nasty things then it may be on various blacklists already, which will just affect your ongoing usage of it.

I may be opening myself up to attack, but I find that the best programmers around are the ones who started at the lowest levels and then progressed up the abstraction levels. It's quite easy to move up in levels of abstraction, but not the other way around.

It's quite possible that the Chinese government hacked your iphone so that they can send out spam for fake Rolexes. But in most likelihood you have a keylogger or browser based password sniffer sitting somewhere in your computer, and you are just a victim of a generic hack. You would have got this malware by installing something you shoudn't or maybe you're running buggy software with a vulnerability. BTW, I'm wondering if your father in law was using your computer recently and had his passwords stolen?

"... that have not generated more than $10 million USD (approximately 7,584,950 EUR) in gross annual revenues and no more than $10 million USD (approximately 7,584,950 EUR) in outside funding."

I didn't want my own words to be the only source for this claim, so above is a cut'n'paste from the rulebook.

But still, LabSlice (and I believe one or two others) aren't near these figures and did get some sort of nomination.

My business (LabSlice) was just announced as a semi-finalist. I didn't even realize it was publicly announced until I clicked this link in the poster's blog: http://aws.typepad.com/aws/2010/11/aws-start-up-challenge-20....

I am just a data point, but it's worth mentioning that LabSlice has no VC funding at all, and is truly a startup (ie. the website has only been online for a month or so). So on the one hand I can attest to some success, even without serious VC backing. On the other hand I will admit to surprise that the AWS competition classifies a startup as a business with less than $10M in revenues or $10M VC funding. Sure, they may technically be a startup, but they are in a much different league to the guy in the basement.

In some ways it would be pragmatic to have a VC funded tier and a non-VC funded tier. That's the only way to differentiate businesses to give a better chance to the little guy. But in reality this is a competition that Amazon funded out of their pocket and they can call whatever rules they see fit.

And a really good security guy may also know of Shibboleth as an implementation of identify federation / cross-domain SSO. ;-)

I completely disagree. A person who is really passionate about IT security will know about cryptography because they are interested in how security works, not because it's a requirement for the job interview. In fact, I am surprised at the number of highly paid security 'professionals' who are little more than auditors with a pen and a form to tick.

Asking about crypto is a great way to weed out the auditors from the pros. There is also a difference between cryptographic algorithms and cryptographic implementations. I wouldn't expect you to write algorithms, but I definitely would like you to explain real-life implementations. A good set of crypto questions to ask, that are quite basic and yet will trip up lots of security pros:

* What's the difference between a Verisign certificate and a self-signed certificate?

* In which environment would I use the Verisign cert and in which one would I use a self-signed?

* In what cases would I expect the Verisign cert to generate warnings in my browser? What about the self-signed? How do I fix these errors?

I've just spent several days improving the startup time of my ASP.NET based business. Some things to note:

* Install both the 'Google PageSpeed' and 'YSlow' plugins for Firefox. They provide great metrics and tell you what's actually slowing down your page.

* Ensure that all images are sent out with a long expiry time. This is not the default setting for IIS. Just setting a long expiry for images, CSS and JS will easily give you a power-boost in your performance.

* Minimize JS and CSS using the 'Chirpy' plugin.

* Make sure to retrieve any library code for its respective CDN (ie. Microsoft AJAX<, Facebook etc.)

* And of-course, as above, make sure your plug-ins load asynchronously. The default code given to me for the 'Add-This' plug-in was synchronous and took about 1.5 seconds to retrieve. Quite silly that they don't give you asynch code by default for these plugins!

It's very hard to say. Ten years ago I wrote an app in C++ and thought it's the greatest language around. It's fast, close to the OS and rather interesting to work with (as opposed to VB6, at that time). Five years ago I was doing a lot of Java work. Now my latest business is completely based on C#. The programming domain is moving too fast to make serious statements about future languages. Actually, I can bet that Cobol and C++ will still be popular in 5 years.

I believe that established businesses sell for 3-5 times their annual revenue. Your situation sounds different. With practically no costs, steady growth, and the claim that you don't advertise --- well, that can make you quite a premium company to acquire. And the fact that you are being courted allows you to try pitch for even higher $$$.

Every startup has the chicken and egg problem -- It's worth a million dollars, but only if it had the customers/dollars/advertising/partnerships to make it succeed.

You've obviously got belief and vision for the project, which are great traits to have. But consider yourself being an investor. How do you calculate the ROI? Will giving you $500/week (peanuts) generate a future return of $1,000/week or $20,000/week, or maybe just $10/week? Investors are business people, so they need some way to guesstimate a ROI. If I sponsor you, then how can you convince me that I will at least break even on the investment within the next 2 years?

LabSlice | http://LabSlice.com

LabSlice allows you to create demos, evaluations and training environments that are stored in the cloud and can be easily shared. Deploy either thick or thin client applications that your customers can load, tweak and play with in just a matter of minutes.

We offer 1 month of free access, but can extend to 6 months to HN users (just request on contact form on our site to get this enabled).

Help from HN:

1) Our solution uses Amazon EC2 as a backend. This causes problems for those not familiar with EC2 or without their Access Keys being readily available. Should we bite the bullet and use our own Access Keys for 1 month trial environments?

2) The product is very much targeted at the enterprise market. What's the best way to reach such a group without the high costs of direct engagement with a salesperson at the customer's permises?

In the last couple of months they also created new 'Micro' EC2 instances, billed at 2-3 cents/hr. They also had a recent promotion to give annual access to a single Micro instance for free for a full year. It seems like price wars will be on the horizon for 2011. Great news for startups using EC2 (like myself).

A timely offer for my recent launch of http://LabSlice.com. I'll send you a private email request, but don't mind if you paste back a reply over here.