Peter Bessman

Using JavaScript to Strip Out HTML Tags from URL-Encoded Data

A user came to me with some data that the web app wasn't accepting.  It took about 2 minutes to figure out that the problem was the presence of HTML tags in the data.  Allowing HTML in input data has security implications which weren't worth sorting out.  We decided to simply strip those tags out of the data before storing it.

The web app in question is highly AJAX driven, so I decided it would be best to strip out the HTML tags in the JavaScript layer.  There are plenty of articles out there that describe how to strip HTML tags out of raw data, but surprisingly, I found nothing that handled URL-Encoded data.  So I whipped up the following snippet.  Short, sweet, and effective.

function stripHtmlFromEncoded(data) {
    return data.replace(/(%3C)(%2F)?[^(%3E)]*(%2F)?(%3E)?/gi, '');
}

Saving the World

Some kids want to save the world when they grow up.  Trouble is, saving the world is incredibly difficult, for one very simple reason: the world is big, you are small, and you only have so much time to do anything.

Young and ambitious minds do not readily grasp this concept.  But at some point, after so much time spent trying to move a boulder that just will not budge, you realize that you need more power to do something on the scale of world saving.

So if you have not given up on saving the world yet, you start trying to accrue the necessary power.  In simplest terms, that means making a lot of money - and the most direct way to do that is to get a job that pays a lot.  The problem here is that landing such a job is a difficult, competitive process, and excelling to the top is even harder and less certain.

You could also try to build your own company.  Plenty of people attain great wealth through entrepreneurship, but plenty more fail.  No two ways about it, world-changing wealth is very hard to come by, and chance is probably the dominating factor in attainment.

Nassim Nicholas Taleb once said something to the effect of, "You need skill to get a BMW.  You need skill and luck to get a billion dollars."  This applies to pretty much any measure of power you can think of.  For another example, look at politics; it is hard enough to become a Senator, and harder still - to the point of stratospheric unlikeliness - to become President.

The truth is that you probably never will have enough power to change the world, let alone save it.  (And consider that nobody in history is widely recognized as having saved the world.)  I think everybody realizes this at some point.  But some people get so wrapped up in the acquisition of power that they forget why they acquire it in the first place.

Many of these people die without doing anywhere near as much good as their younger selves might have wished.  This is unfortunate and unnecessary.

As you walk your own personal path of life, remember that you do not know exactly where it is taking you, or how long it will last.  So while you are walking it, you might as well clean it up as you go.

Maybe one day you will find yourself in a position to have a world-changing positive impact, although you probably will not.  But you can leave your own personal sphere of influence better than you found it.  And that requires something even more important than power: humility.

Berkeley and Baltimore

I have finally been to an American city that did not shock me with its
cleanliness, and that city is Berkeley. Denizens of Baltimore rejoice,
I suppose.

On a different note, it has been a pretty quotable week for me. I met
a friend for drinks in San Francisco this evening. At one point in our
conversation, he mentioned that getting a job is easy, but building a
career is hard. And previously in Baltimore, another friend told me
over brunch that it is not who you know, but who you run into.

This is a good reminder of just how sharp my friends are. I have tried
to come up with something of equal wit for this blog. Obviously, I
failed. I blame the jet lag, conveniently enough.

Do Internet Entrepreneurs Really Peak at 25? Occam's Razor Says "No."

In a recent TechCrunch article, Michael Arrington quotes an unnamed venture capitalist as saying that "Consumer Internet entrepreneurs [...] peak at 25, by 30 they're usually done."  According to the VC, there are two mains reasons for this: first, young entrepreneurs are more creative and imaginative; and second, they and are willing to put 100% of their lives into their startups.

While I can readily accept that most successful Consumer Internet startups are launched by 25 year old founders, I doubt this has anything to do with "peaking" at 25.  Instead, I think there are many more 25 year olds attempting to launch Consumer Internet startups than 30+ year olds.  I see three simple reasons to expect as much.

First, entrepreneurship is relatively risky.  A typical 25 year old is usually less risk adverse than a typical 30 year old, and this is very simply explained by the fact that the young have less to lose than the old.

Second, entrepreneurship requires long hours.  A 30 year old with a family is usually less inclined to work 16 hours days than a 25 year old with roommates.

Third, Consumer Internet entrepreneurship is trendy.  The young care about trends more than the old, and this goes for career choices as much as fashion.

In total, Consumer Internet entrepreneurship looks more attractive to 25 year olds than 30 year olds.  And if more 25 year olds go into entrepreneurship than 30 year olds, simple probability would expect most of the successful startups to have younger founders.  There is no need to posit some special capability that the young possess.

I think a VC could readily observe that there are more successful 25 year old Consumer Internet entrepreneurs, and that they are willing to give everything to their startups.  And those observations harmonize perfectly with the explanation I outlined.  But to claim that a 25 year old is more likely to succeed because of creativity and imagination requires both a way of measuring these characteristics as well as knowledge of the distribution of attempted and successful entrepreneurs by age.

Without the data, it is just speculation - and in the realm of speculation, Occam's razor rules the day.  That is, truth is usually found in the explanation with the fewest assumptions.  So while it is exciting to ponder what unique abilities 25 year olds have that 30 year olds do not, reality probably boils down to a simple numbers game (as it usually does).  Indeed, the truth shall set you free - if it does not first bore you to death.

Programming is Not Brain Surgery

If a brain surgeon does poor work because of a distraction, a patient very likely will die.  For this reason, there are strong social conventions supporting the isolation of the surgeon during a procedure.  A brain surgeon who does not pick up the phone while poking around in somebody's skull is not anti-social, but professional - in fact, I am fairly certain it would be considered unprofessional to answer text messages with one hand while guiding a scalpel with the other.

Unlike brain surgery, it is very unusual for anybody to die if a programmer does poor work.  This is problematic, because there are no social conventions supporting the seclusion of a programmer attempting great work.  In fact, the stereotypical programmer is anti-social, and usually depicted as reacting to interruptions with an inappropriate level of hostility.  Yet the amount of concentration required to do great programming is comparable to that required to do great brain surgery.

Here is the dirty little secret: great programming is overrated.  It pains me to say it, but it is true.  We always want to do our best.  And what is the definition of "best"?  In simplest terms, it is "maximally efficient" - which is a fancy way of saying "Just Barely Good Enough."  And while JBGE for brain surgery loosely translates to "brilliant," it is pretty rare that that JBGE for software really translates to anything more than "acceptable."

Put differently, there is much to be said for the calculated embrace of "mediocrity."  You might need days of absolute concentration in order to craft the best possible GUI for your client's web app - but 90% of the time, the client would be happier with an "ok" GUI at a lower price point; throw in world class relationship management between you and your client, and you will have the makings of business excellence.

Which is to say: Worse is Better.

Chris Dixon is Wrong about The Glory of Risk

In his latest post, Chris Dixon opines that there are two kinds of people in the world: those who started a company, and those who have not.  I do not take issue with this per se; on the surface, it is just another way to divide the human population into two groups.  But I have some concerns about the particular way he characterizes entrepreneurship.

What troubles me most is the glorification of risk.  (The emphasis in the following quotes is mine.)  Chris starts off on that theme by stating that, among other things, starting a company means "building an organization from a borrowed cubicle with credit card debt and nowhere to sleep except the office." He then goes on to say, "The important distinction is whether you risked everything, [and] put your life on the line [...] to make something new."

Let me pause for a moment and state that I do not think Chris necessarily intended to glorify risk.  More than likely, he was writing out of respect for entrepreneurs who struggled with unfortunate circumstances - so I think the message I am perceiving is not the one he intended to send.  However, he might not realize how many people will see this post as an elaborated version of Nike's "Just do it" campaign, and how they might consequently suffer.

What are the consequences of such a misreading?  Obviously, a failed business can leave you in bankruptcy.  But even if you avoid bankruptcy, a failed company can and very likely will damage your reputation and potential on the job market - and it is this rarely discussed phenomenon that I want to highlight.

In some cases, a failed company on your resume will not hurt you.  Say you are a young programmer turned failed entrepreneur, and you have no dependents and nothing to lose.  The hiring manager at Acme sees your application for their entry level programming job.  Acme is planning on paying you about $50k, so while they hope you work out as a hire, they are not terribly concerned about it.  If it is a big company, and you are able to demonstrate your skill, the hiring manager probably will not care all that much about your failed company and your bankruptcy (which will come up on the background check).  And if Acme is a startup, you might even have an edge with your demonstrated entrepreneurial spirit.

The situation changes as you mature.  Imagine that you have a decade of experience and, after your company fails, you apply for a senior job at Acme.  Now the company is planning to pay you $150k, which means they expect to derive somewhere from $300k up to $1MM in revenue off of your work.  At this level, they care a lot about whether or not this turns out to be a good hire.  And suddenly, your failed company and bankruptcy do not look so good.  You might hope that the company will respect your ability to take a risk and work hard, but with the amount of revenue pinned on your hire, what is really going to shine through is your demonstrated ability to lose money.  And if you have a wife, 2 kids, and a mortgage, it will look even worse - now you also have a demonstrated willingness to put other people at risk.  You better believe your resume is going to the bottom of the pile.

But what if your company does not fail?  Suppose it just delivers middling results after 5 to 10 years and you decided to get out.  (This happens way more often than you might think.)  Regrettably, your situation is not much better than if your company folds completely.  When someone hires you for $50k, it is not a huge deal if you leave after a year.  But when they hire you for $150k, you typically need to stick around and be productive for at least 2 to 3 years before your employer has made a net-net profit.  So a hiring manager sees your middling startup that you want to leave, and they wonder "How do I know this person really wants to work for me?  What if they just get bored in a year and leave me in the lurch?"  After all, the one thing all entrepreneurs really do have in common is a demonstrated preference for working for themselves.

These are the kinds of risks that bust up families and lead to suicides.  And I am not speaking from theory here.  I have personally witnessed families destroyed by bad businesses.  And I have also done enough hiring to speak from experience about the aforementioned risks that entrepreneurship poses to your value on the job market.  Suffice it to say, the consequences of playing and losing the startup lottery are very serious, and not in some abstract way.  "Bouncing back" is rarely a very bouncy process.  "Crawling back through a mile of mud and broken glass" would be a more apt term.

Chris Dixon is ferociously intelligent, and a very accomplished entrepreneur - and I believe that is why he is actually more risk adverse than you might think (or he might realize).  Consider that he has three Ivy League degrees - including an MBA from Harvard Business School - and worked on Wall Street before entering startup-land.  For those who might not know what that means, I will quote a friend who put it best: "I wish somebody told me when I was growing up that, with most jobs, the most you can make is hundreds of thousands of dollars, but with banking, the most you can make is millions upon millions of dollars."

And Chris is not alone in this phenomenon.  What do Bill Gates and Mark Zukerberg have in common?  Surprisingly enough, they both attended Harvard, and only dropped out when their businesses started to take off.  And even if those businesses had failed, they more than likely could have returned to Harvard and then proceeded to work on Wall Street.  So they were a bit more able to soak up failure than average.

Likewise, look at the founders of Google, who studied at Stanford (which is very much Ivy-tier).  Or look at Amazon's founder Jeff Bezos, who graduated from Princeton and worked on Wall Street before founding the company for which he is now famous.  In fact, among the entrepreneurs I personally know who have had successful exits, every single one has either an Ivy league degree, or something comparable to that (e.g. Johns Hopkins).  In all these cases, failure would hurt a lot less than for someone lacking the career benefits of an elite education.

I joined SkyLine when it was in startup mode.  We really did work out of borrowed cubicles.  The president and I both have the same humble alma mater - which is to say, he could not "fall back" on Ivy League credentials and a job on Wall Street.  He also has nearly two decades of industry experience, and an extremely strong network.  He put a ton of thought and preparation into the creation of SkyLine - in other words, he worked assiduously to reduce risk.  Which is a very smart move, considering that if SkyLine had failed, the consequences for him - a family man - would have been tremendous.

I have a good friend who is a serious mountain climber.  On those rare occasions where I brave the heights with him, I am struck by the intimate relationship he has with risk.  The risks of climbing are palpable and lethal - if something goes wrong, you very well may die.  He works meticulously to ratchet the risk level down to something manageable.  And while he cannot completely eliminate or control that risk level, his efforts at risk-reduction have a great deal of influence over the likelihood of us living or dying that day.

Entrepreneurship is a lot like climbing.  It can kill you.  And just as the longest-lived climbers tend to be the ones who are the most calculating about reducing risk, so too are the most consistently successful entrepreneurs the ones who do not simply "take the plunge."  You can always throw caution to the wind and hope to be lucky - but nine times out of ten, you will be unlucky.  And as another friend likes to say, "hope is not a method."

Is The Village a Baltimore in NYC?

I was having a cappuccino in Think Coffee by Mercer and 4th when I
realized that I felt, literally, right at home. (And mind you, I am
not name dropping. That cappuccino represents a fair chunk of my NYC
experience.) Generally speaking, I got the feeling that the village
was pretty BMore-esque. And given that I cannot explain Bmore
("coherent incoherence" was the best I could come up with), I do not
really know how to elaborate on that. But I will try, and here is my
best attempt:

After ordering my drink, I went to the other counter and waited for it
to be prepared. It was a busy day, and the process took a while. The
barrista was a heavily tattooed guy with a substantial beard, wearing
a plain white t-shirt and a hat with the BIC logo. Several times,
without any prompting or expression of dissatisfaction on my part, he
cheerfully updated me on where my drink was in the queue. When the
cappuccino arrived, it was expertly prepared and incredibly delicious
- and while I am nowhere near a coffee epicure, I wager I can tell a
good cappuccino from a great one, and this was a great one. And it
was all fair trade to boot.

The combined elements of that trivial experience - an unconventional
aesthetic, earnest friendliness, high quality, and social awareness -
struck me as very bmore. And it was representative of the rest of my
day.

Of course, one day only conveys so much. So I wonder how valid (or
tenuous) this impression is.

And yes, it was better than Starbucks.

The 10 Step Guide to Fogo de Chao

  1. Fast for at least 8 hours prior.  You need the space.
  2. Walk to the restaurant if possible.  You need the exercise, and it will limber you up.
  3. Avoid the salad bar.  It is a trap.
  4. Avoid the cheese bread.  It is also a trap - the food equivalent of a Siren's song.  You will be awfully disappointed if you spend $60 to fill up on cheese bread.
  5. Order a Caipirinha.  It is strong, and will numb the pain.
    • By the same logic, keep the Caipirinha's flowing.
  6. Do not wear your slim jeans, shirts, etc.  This will only cause shame.
  7. Do not count calories.  You do not want to know.  Especially if you are brave enough to heap dessert on top of your already strained midsection.
  8. Avoid going with only one other person.  You will do little more than bear witness to each other's gluttony.
    • A party of 4 is the preferred minimum.  At this size, consumption and conversation are not mutually exclusive.
  9. After the meal, go out drinking.  You will rarely be more prepared for a night of drinking than after a meal at Fogo de Chao.  Carpe diem.
  10. Have Alka-Seltzer waiting for you at home.  There is a very simple reason it has been around for 80 years: it works.

More Evidence that US Airways Hates its Customers

If you have not read about my ordeal with US Airways, suffice it to say that they cancelled my flight, gave me a refund, and told me to take a hike - with all the graciousness of a professional wrestling match.  A couple of days later, I have more reasons to believe that the company holds its customers in contempt.

When US Airways issued my refund, I was told I would receive a confirmation email immediately.  Two days later, I have nothing from them in my inbox.

So I visited the website and looked up the refund status.  The system told me that it had no record of my refund, and that I should call a certain phone number for further details.

I called that number, and the teleprompter asked me to enter my 13 digit ticket number.  I would have been happy to do so, but I have a 14 digit ticket number.  I entered it anyway.  This choked the system - two prompts played on top of each other - and then it repeated the original request to enter my ticket number.  Each time I entered the ticket number, the cycle repeated.

I gave up after a few attempts and called the customer service number that was specified in the cancellation notice I had received on the day of my flight.  When I finally reached a customer service representative, she asked for my 13 digit ticket number; thankfully, the extra digit I supplied did not cause problems.

The representative then told me that it would be 7 to 10 business days before I heard anything at all.  Which is not a huge deal in the grand scheme of things.  But I do wish I had been told that from the beginning, so I would not have wasted an hour of my time looking into the matter.

As the call drew to a close, the representative told me that I could stay on the line to take a survey.  That sounded fantastic to me.  For a moment, I harbored a fantasy of pressing 1 for "Extremely Unsatisfied," and then receiving some kind of special attention that would make my experience less painful.  Perhaps there would be some grand reversal, and all would be made right, and I could go forth and heartily endorse US Airways for the way they graciously and courteously recovered from one of those errors in performance which no organization can avoid entirely.

The call then terminated abruptly.