dcao

The Keep Me Signed In feature is very useful and friendly, especially when users go to your website at home pc. It's all about trust with a little risk, and usually implemented using encrypted cookie.

Say when one user has turn this sign on in his account on one PC, somehow there is a second user also want to turn it on. Which way do you prefer to go?

    1. Do you allow the second user to have his own cookie? How? 


    2. Simply reject the second user?


    3. Simply turn off the first user's automatic login since the PC is shared? 

If the second user opens the browser, he may be already automatically signed in the first user's account.

One possible condition is: both of accounts are belong to the same user, and he would like to use the second one as default auto-login, but does not want to turn it off from the first account. This scenario is rare, but inclined to choose the 3rd way.

How do you think?

I got a prototype ready to approve the feasibility of my new idea for building up a classified search engine with multi-layered server farms including one centralized authentication server and a series of distributed content search/indexing servers. It was done in about a year using the spare time after work.

Later I quit my job and started to build a full-blown production version from the demoware with the basic functionalities working on Windows environment using multiple instances of Tomcat, MySQL servers and two Apache instances which supports virtual name and virtual IP hosts. It took me a year of full-time to beef-up the distributed network with solid protocols, which handles exceptions and security using SSL, cookies and encryption mechanisum and then deploy it on a dedicated Linux server environment in a hosting site with multiple static IPs and firewall.

I'm wondering based on your experience, how much time it may take from a prototype to a beta release of your product, a live MVP (Minimum Viable Product) website? Compared with the POC (Proof of Concept), the beta production release is way harder to come up with. You have to cover all the potential security holes, especially in a peer-to-peer server environment. And when do you think it's ready to release to the public, including registering the company, domain name, and applying for the IP protection?

Usually building a quick-N-dirty web application is like a piece of cake for a full-stack web and Java developer. Even if you don't know every detail of the tricks, it's fairly easy to find out from StackOverflow or some nice blogs. However, oftentimes, we quickly find some information, apply it and forget it without even understanding why it's working. Later on, we have to re-visit the complete scope of the knowledge from the basic level and then re-do it in order to ensure the quality of the feature.

How many iterations to go in order to reach the beta? To my understanding, it may take 6 man-months to deliver a prototype, quickly show to the investors, get funded, then takes another 6 month of a team of 3 to 5 to build the beta version with numerous of bugs and launch to the public. This year may easily burn out 1 million from the Angel investors. Then a Series A funding comes if lucky enough to build a GA (General Available) release, this may take another year of the team.

Can you share some your stories?