Dalton Caldwell: We Did It

Let's hope this doesn't become a verb. Tweeting is bad enough, but "apping"?

What App.net desires is for a trusted third party to say, "Yep, they're legit." So first, you would select an auditor who has a good reputation financially, technically, and ethically. Presumably, you'd line up a couple of secondary sources to publicly reinforce the auditor's reputation and bless the auditor's methodology.

It's been literally decades since I took any accounting classes, but I think you would need to follow the entire chain of some transactions, and this would necessitate showing real investor/customer data at some point. If you can secure that investor's/customer's permission, then sharing the data becomes a non-issue. How you get that permission becomes the issue.

If your auditor's reputation is strong enough, their name alone may be sufficient to secure permission. But you can also take steps to create a "security narrative" designed to put the investor/customer at ease.

You'd need to give the auditor access to your data, while preventing the possibility that they could leak this data. So the auditor would work in your offices, on your machines.

You'd provide laptops so that you can disable all peripheral ports. You'd secure the laptops to the table. The machines would have no optical drives. Those machines would net boot, have wired LAN access but not WAN, and no wireless access at all. They would run the software the auditors required but nothing else.

You'd confiscate phones and cameras from the auditors before they entered your audit environment. You could go a little crazy and record video of the auditors at work, with cameras angled so that you can see what notes the auditors are taking but not what screen they're looking at while they're taking notes. You could go a lot crazy and prove that the auditors are not sitting in front of any windows, thereby exposing data to high powered lenses across the street.

You could sanitize the data your auditors see, so that the auditor initially sees "Backer N" or "Vendor Y" instead of an actual person or company name.

Armed with some variation of the above security narrative, when the auditor says "I'd like to talk to backer N or vendor Y," you can present that narrative to the backer or vendor to secure their permission for auditor access to the information. I wouldn't be surprised if the average backer gets impatient and grants permission well before you're done explaining the security narrative.

Since the auditor was reputable and signed a contract to attest the $500k, the auditor would be careful to not divulge any of the sensitive, personally identifiable information.

1. They can be trusted not to misuse the authorisation they will be given to Dalton's Stripe account. The Stripe API (https://stripe.com/docs/api) does indeed give access to identifying information.

2. We can trust them not to misrepresent the facts on behalf of their client (i.e., Dalton).

I've no idea what kind of institutions Dalton is thinking of, but reputable accountants should fit the bill.

Seeing quite a few sites and blogs now getting a bit careless with CSS @font-face rules and seemingly not bothering to test their sites in Windows.

More on it here: http://blog.webink.com/why-fonts-suck-windows-hinting

> Why aren't you using Kickstarter?

> We wish we could, we <3 Kickstarter. Unfortunately, the Kickstarter Terms Of Service explicitly prohibits raising money for this kind of service.

"I paid for a product, I can't login, and I can't fix things so I can login. But I'll meekly 'reserve judgment' rather than lambasting what should be a fairly important issue."

I think that's a good summary: https://alpha.app.net/