aquark

Good point ... we don't have this db encrypted as the DBMS level. Internally sensitive information is encrypted using keys not managed by KMS

Great, thanks -- will take a look at this.

The challenge with RDS in the past has always been getting the data easily and scriptable into an S3/etc bucket to start with. This might be a good enough solution.

Restore would be a pain, but at the point its needed the pain would be acceptable.

I’m interested in an easy backup-out-of-aws solution.

We use snapshots for regular backups, and have implemented a solutions to share and copy snapshots to a different aws account.

But given that our production database is absolutely vital to the existence of the company I’d like to have an easy way to create a secure ‘not affliated with Amazon’ copy regularly in case of the nightmare scenario where an account is compromised/terminated

I switched from LastPass to 1Password earlier this year (after 5+ years of use) due to issues with LastPass stopping sync.

1Password fixed that and numerous UI glitches around the actual password filling in that I was just living with. It is night and day a better experience ... and no invested interest in them (unfortunately!)

Nice, I assume this give Stripe the ability to shortcircuit Visa/MC on a payment between a Stripe card and Stripe as the processor and capture more of the revenue without needing to share it.

Microsoft accounts are definitely a mess.

I had a Microsoft account from a long time back: me@company.com

Years later the company decides to adopt the whole office365 thing and so company.com is now 'managed' by MSFT for email, etc .... so I have a me@company.com 'company' account as well as the 'personal' one.

I'm sure there are a lot of complicated edge cases around all of this which make moving forward really tough for MSFT without breaking things, but the current status quo is confusing and very user hostile.

How are they able to do ad insertion into a https page?

I'm sure Google would not be happy with content injection into gmail.

We had to deal with this in reverse: we had a form that depending on what you fill in and the settings doesn't show some options.

The browser was submitting the form with auto-fill details that failed the validation checks for those fields. Hard to show an error message for fields the user can't see.

Yes, it is more robust to have code on the server side discard input that isn't expected rather than validate it, but it annoying extra work when those fields have no security impact.

The alternative is to tell the browser not to auto-fill those fields, but doing that feels broken too.

Hardly seems like the same thing -- the coach is a representative of the organization and communicated something (by whatever means) that they shouldn't have. The organization honored that commitment.

If the athlete turned up waving a _spoofed_ email and they let them in then that would be a more appropriate example.

A lot depends on the detail of their definition of 'white label'.

Do they want just a version of the product that has their branding front and center, but which with even a cursory scratching of the surface is your product.

Or do they want a complete white-label version including domain names (incl. backend services not shown in the browser), email, payment processing, etc, etc.

In the later case unless they are willing to pay $$$$$ up front for the development it would seem very unlikely to be worthwhile.

In the former case, you could decide if it is worthwhile for a moderate amount of development effort and perhaps even include a 'Powered by ...' link in the footer. Then offer them a 30% discount on pricing: eg. a plan that costs $300\year normally you'll sell them for $210 and require they market it at a price of at least $300 ... if they can sell it for more and capture more profit take that as a signal to raise your prices!

You really need to talk to a good accountant that understands the nature of your business, your goals and the tax implications.

I don't know about US law, but in Canada there are distinct disadvantages to keeping large amounts of cash inside a operating small business corporation and you would potentially be better off distributing the cash or setting up a separate holding company for it (or rather having your lawyer & accountant handle that).

You can then invest within the holding company but keep your operating business and investments separate.

This feels like a large disconnect?

Assuming these two sets of people are not the same -- there are a lot of people in the west earning > $32K a year and having less than $770K in assets.

So they are in the top set but not the bottom. Since the cardinality of the sets is the same, where are all the people that have more than $770K in assets but earn less than $32K a year.

Even a fairly modest 5% return would produce more income than that, or are the stats excluding investment income?

People with that much equity in their home wouldn't realize the income ... but how many people in the west even live in $700K+ homes and yet have less than $32K in income a year? Maybe some seniors, but surely not a very large group.

Whilst they don't in your example, choosing a password between 1 and 65K is a very bad decision to begin with (assuming the attack knows this ... if they don't the password search space is far larger than the port search space)

In general A does not improve your security 65K times since a single attempt will tell if there is telnet on the port or not, whereas with B all you know if you got the wrong password.

Now if you ran a dummy telnet that always can slow 'wrong password' responses on the other (65K-1) ports that would potentially increase the security 65K times, but still isn't really a meaningful thing to do.

Our (rural wireless ISP) does something along these lines ... data between something like 1am and 7am does not count towards the monthly data cap.

At (peak) times they actively traffic shape and penalize the heaviest users. It sucks, but I don't see people willing to pay the $$$ to upgrade infrastructure faster.

More strictly: (investment returns - tax payable)

(unless your debt is tax deductible ... most car loans aren't)

Fair enough, I would be OK with having to run a Ford app through Android Auto to access that functionality on a Ford.

I just want the best of both worlds .. trying to hold onto being the main user interface feels short sighted. I'm not going to NOT buy your vehicle because I can use Android Auto vs your custom UI, so having both available shouldn't be a negative to the manufacturer.

Anyone know how Android Auto (and Car Play) compare to the functionality exposed through the OBD port?

I have Android Auto and love it for navigation/music, but it is missing any car specific controls, eg. climate controls, reporting speed, maintenance, etc. I have to exit out of Android Auto and into Sync to access some specific functionality only available through the Sync touchscreen.

Is this just a case of the manufacturer needing to provide the right app, or is that information not available to third party apps running in those environments?

Terrarium ... still has a repo at https://github.com/terrariumapp

We are seeing an opposite side to this: we have customers using Stripe that had very low fraud rates previously and now are getting more false positives causing grief because their customers cards are getting declined.

I can see that it is a good feature, but the lack of easy programmatic control is an issue for us.

As a corollary, are there any good libraries for helping build more complex onboarding flows, or do these all tends to be hand-built from scratch?

I've seen a few javascript walk-through tour type libraries, but what about something that integrates with a backend to be stateful on what a user has done?

Someone would still need to handle life-timing the objects in the presence of deletes. If the storage layer does it then it is one less thing to handle at the application level.

If you upload by hash then you need your own ref counting for deletes (or just don't support delete ... storage is cheap after all!)

Actually I think Stripe is a surprisingly bad name. I work a lot with Stripe (& love them technically), have over a thousand of (mostly non-technical) customers that are connected via Stripe connect.

The name gets mangled by customers, A LOT. The most common confusion is (repeatedly) calling them swipe though strip has come up more than once. People are thinking more in terms of swiping cards than the stripe on them and so that verb sticks in their mind.

Or to look at it another way, not even 20% of a single AWS snowmobile: https://aws.amazon.com/snowmobile/

Of course, they presumably need to duplicate it for redundancy too, so maybe a full 2/3s of one!

The BBC ran a story on a ship stuck off Singapore: http://www.bbc.co.uk/news/business-37335614

I switched back to wired headphones after going through several (different) pairs of bluetooth headphones that could seem to cope with the sweat overload for more than a month or two before dying.

The cord is a bit of a pain, but the cost of the bluetooth headphones was more so!

I think this is likely a really bad idea for 'side projects' ... by acting as the middle man here you are taking on a huge amount more liability than you would be if you are using the (non-managed) Stripe connect model where the your customer has their own processing account.

Sure, there is money to be made here, but it isn't free and you need to manage the extra risk and liability that comes with it. What if someone discovers your platform hasn't got the same anti-fraud/verification processes that the larger players can afford by virtue of being a larger player, and decides to take advantage of it?

> Money ... does you very little good if you are completely out of it in a nursing home

Well, there is the question of paying for the nursing home. The sad reality is that the options offered by our social safety nets at lot less attractive than the options available if you can pay for it.

Unless you are completely out of it to the point of not caring, at which point your loved ones may still care though.

> whenever your load decreases for even a minute or two, knowing you can just scale right back up.

Doesn't AWS still charge by the hour ... so if you were spinning instances up and down based on minute-to-minute load you would be overpaying for vs just maintaining a steady baseline.

If you turn an instance off you need to be pretty confident it will stay off for at least an hour.

Possibly, but also maybe the other way around. Perhaps they didn't have a before picture of the scene from the right angle, so the before one is photoshopped?

True, but we switched from SES to Mandrill because of delivery problems from SES.

Mandrill was way better, but now it looks like we need to move again. (And our complaint % on Mandrill was somewhere around 0.01%)