arielm

I think the real "issue" here is that those paywalled content publishers want to get paid but also want the free advertising that comes with having a well indexed site.

It's a pretty interesting subject in my opinion because I can easily see arguments for both sides, and if we compare it to the real world we have the exact same "issue.

I can read an article that's on the newspaper's first page when it sits in the newsstand but I can't open it and look for any other articles without paying for the paper.

I think the real solution has to come in the form of a better subscription model. I usually get to paywalled sites wanting to read a single article so a subscription is a bit too much for me. If there was a way for me to get what I want by paying quickly, maybe using some sort of a federated payment platform (much like downloading apps doesn't require subscribing) I'd be more inclined to pay.

I started by building services but never really expected a payment, I just wanted to build something and figure out my way around servers. I think that's the best way to get started because it affords you the opportunity to start over if you find a new framework/database/server/etc. and there's no penalty for failing.

I think a leak requires intent.

Major ouch. Although it's pretty funny to see that their first reaction was to call it a leak before investigating...

> "When you visit a participating website, part of your contribution goes to the creators of that site."

Umm, why does Google have to control this sort of ad-prevention mechanic? Obviously because it lets them profit from potential lost ad revenue, but what about the publishers? What sort of "cut" are they getting? And why are they only getting a cut of contributions that are essentially for their content?

The advertising business is getting really messy...

Interesting question!

* I upvote articles that discuss something(s) I believe _everyone_ should know.

* I upvote comments that either help clarify a topic, add context, or present an interesting thought that isn't mentioned.

* I downvote comments that are blatantly disrespectful, silly, or grossly incorrect/ignorant.

Great post, and something I've been thinking about for quite some time. Would love to see an open source framework made available that simplifies many of the nuances necessary to maintain a "secure" user database.

Don't get me wrong, this won't solve everything, but in my opinion it's a pretty big step in the right direction.

I can't say this surprises me, but as a founder based in NYC who's seen how unpleasant the city is to small business I'm disgusted by this.

I want NYC to grow into a hub for entrepreneurs and founders, one that's better than bloated valuation valley, but this sort of behavior will never let it...

+1

I think that's a pretty blind statement. Just because you're a technical founder doesn't mean you have to ignore the finance and other non-engineering activities. That's just a bad way to run any company.

Also, being a technical founder doesn't mean you don't have common sense. Yes, GS's founders got nothing, but really it's the employees that saw the largest loss... They signed up to see the company really take off, and it didn't.

But at the end, if your company doesn't make enough money and requires raising amount of money you just don't know how to waste you shouldn't expect a big payday. Being technical isn't an excuse.

There are other ways to run live js on a page. It just has to do with how you load the pages. If it's just an http request to get the body it won't work, but using a headless browser will do the trick just fine, and without too much async headache.

Although worse, they almost had me for a split second there. It's when they mentioned temperature and apps that I finally gave up...

That said, a "smart"/connected mailbox isn't a terrible idea.

To those saying the OP shouldn't talk to the founders: why? I'm just curious.

I'm glad to see common sense coming out of the SF area. With valuations being way over-bloated and salaries being completely unrealistic from an ROI perspective, a crash is inevitable.

appFigures is looking for a full time javascript (AngularJS) developer in New York City.

appFigures is the leading app store analytics and intelligence platform focusing on helping app developers make data-driven decisions instead of flying blind.

My co founder (and brother) and I started the company to make great analytics affordable and accessible to developers of all sizes, from indie to Fortune 500.

We've been around for almost 6 years and are completely self funded, profitable, and growing.

If you like the idea of helping fellow devs and want to make big data easy to visualize and understand appFigures is the place to be.

https://appfigures.com/jobs#javascript-developer

P.S. - we're also looking for data scientists, back end developers, and sales reps.

As a founder I manage various teams full-time. I don't consider myself to be a manager because ultimately I don't report to anyone, but I disagree with most of what you're describing.

Skills - You may have only worked with bad managers because to be a good manager, much like anything else, requires certain abilities. While some have those it's practice and experience that make you really good.

> You can't wire up a house without the skills. You can't build a web app without knowing a whole lot of stuff, at least not within any time frame someone would pay you to make one in.

You sure can wire up a house without skills. The house will probably end up burning down due to the many mistakes you'll make but it doesn't mean it won't work. On the same token you can manage without skills, but those you manage will burn out, produce less, be unhappy, and pray that you'll disappear one day (or get fired).

Delegation isn't as simple as just telling others what to do, that's a gross misconception.

> You can have responsibilities, in which case you can justify doing anything so long as it fits into the responsibility and you can make your bosses believe that.

Really? Don't you feel behaving in such a way won't help the company you're helping build?

I do agree that finding things to do and potentially developing something that may not get the attention it needs is a good idea, but that's good for any stage of the business.

As a technical founder I actually face the issue on the other side, which is how to keep those that have been around for 5+ years challenged and motivated. Here are a few things I've learned that might help with perspective:

1. You shouldn't be afraid to ask for what you want. As a founder, it's tough to always know what goes on in everyone's mind. I try as much as I can but when I'm a part of the conversation I will be able to help much more than just being looped in after a conclusion is reached.

Every good developer wants to be challenged. Some want to stay on the technical side, others grow into managers, and some like to blend the two. Talk to the ceo/founders and let them know how you feel. I'm sure they appreciate what you've done so far and will be happy to figure out the future.

2. You're at a very unique position where not only do you know how the entire system works but you also know how it's supposed to work. This gives you the ability to contribute to any of the different roles you mentioned in a really meaningful capacity.

One of the comments said something about not being good at those. I mostly disagree with that on principle. Just because you don't have the training doesn't mean you won't be an awesome manager. Some companies actually don't hire managers but rather promote. I believe LinkedIn is one of those companies, and they do it because they want those the manager will oversee to really trust the manager. That's something that, as a developer, you can do when you've seen the person's work.

3. The skills needed to get something off the ground are somewhat different from those needed to take it to "the next level". It doesn't mean you can't have both, but it is a question you should ask yourself. Do you like the rush and the excitement of creating something new? Or do you like the joy of seeing a large system run smoothly at super scale with time to sleep? Or both.

Fair point. With their non-existent review process it's much easier to deploy spam/malware (or plain crap) to the store.

That said however, look at the categories that have been getting most of those new apps. Games in particular, wasn't a category that was as busy in years before. That to me is where the shift is happening, and I'd attribute it to the success of freemium apps (which is most likely the result of putting Android devices in the use of mainstream users).

I'm guessing he didn't think the company wouldn't fix such a huge issue...

While your point is valid I think you're getting doe voted because you're completely forgetting that the probability of someone malicious finding out about this vulnerability and exploring it without disclosing is quite high. Going through legal channels would just mean the api will be live for longer. Lawyers like to take their time.

Instead, the disclosure resulted in the API being shut down within the hour. A much better result IMO.

It's astonishing that somewhere out in the modern world there's an api that returns personally identifiable information without requiring any sort of authentication.

What I find absurd is that the company hasn't done anything about it. Even if they don't care/know about security they must at least care for bad PR...

But with all of that in mind, I don't know what's the best way to fight these clueless behemoths. You disclose and thousands or even millions of people will be compromised. You don't and those same people could be compromised but no one will know because the attacker(s) will just continue to siphon information quietly.

They should be waterboarded for making a responsible individual have to choose.

For the record, I approve of this disclosure. Better to know the evil than let it go on unnoticed.

Looks like India is using a cannon to kill a mosquito. Regardless of what we think about terrorism, disabling access to entire sites companies rely on for their daily operation is simply careless.

As noted by other commented they didn't even try to resolve the situation but rather went the route of blindly blocking access.

This is a huge red flag, in my opinion, that the Internet as we know is has reached a big fork in the road and where we go from here will do are if our future will look like Biff's world in Back to the Future II or not...

I'd understand the argument if GitHub was an opinion news site of some kind, but the fact is that it's a place where code is shared, code used to create software.

GitHub is a US company but so are many others. To say github is "pushing" to Americanize the world and trump local communities is either foolish or a complete misunderstanding of what github does.

I don't mean to be a jerk but you're really missing the point here and barking up the wrong tree.

Wow, this is really bad.

With all the discussions revolving around the more advanced side of SSL for non PII something like this, which violates PCI and other requirements, simply goes unnoticed.

I wonder if the person deploying this warned the company and the higher ups just ignoring him/her...

Having only been tangentially involved in open sourcing one project (pixelwave.org) I probably can't give you everything, but I do have a few nuggets that might help:

1. Documentation: a very important part of any project is its documentation. A detailed getting started guide, installation/setup instructions, and api documentation are what gets developers interested. If they don't exist, or aren't good enough, the project wouldn't gain any traction.

2. Licensing - there are many types of open source licenses and it's important that you select the right one. Some require attribution and some don't. This is one area I leave up to the experts, but know is important.

Losing weeks of work isn't pleasant, but I think your reaction is a bit over the top.

As a developer I know that even when you put in the time to bug test your app it can still misbehave, and as someone who's involved in managing a support team I think kathrine did a pretty good job considering she didn't erase the notes and she can't really will them back into existence.

I've lost plants of important data in the past because I only had it in one place, the lesson here is that when you have important data you really want you should keep it in more than one place.

Good luck with your novel!

You may have misunderstood my point as what I was aiming at is that MITM is always bad for us even if it's not done by malicious attackers but rather by for profit companies.

By not encrypting traffic, web masters who think they don't have secrets are really just selling their users. That's bad.

Einstein's simplification of this situation, even though it was made in a time where political correctness wasn't common, is a fresh view that reminds me how important it is to stop pronouncing racism and instead to each do our part in extinguishing it by action.

And also from them tracking what you read to give you specific advertisements.

Man, it's really all about advertising these days...

While those are all valid reasons they land on the "greater good" side of the scale, which doesn't have the obvious "what's in it for me" I think many people are looking for.

My thoughts

1. Not having secrets - MITM isn't necessarily conducted by malicious attackers, but that doesn't mean it's bad. Consider for example a company that wants to identify usage behavior and buys traffic data from an ISP. While the data may be anonymized it's still someone's usage. With https, a webmaster is limiting the info those companies can get so instead of being able to run a complete analysis on the type of text a user reads and images they see, over https they could only tell what websites you go to. It's still pretty bad, but not as bad.

2. Cost - I do see the value of cheap hosting on S3 and getting redundancy. I've been hosting servers from the days before AWS existed (I started young) and know one thing - if you can't afford something you probably don't need it.

Why does you $0.06 site need to have a multi node setup? I don't mean to sound like a jerk but if you had the kind of traffic a multi node + DSL site needs you'd probably have the funds to invest in it. It's really not very expensive considering a cup of Starbucks coffee costs 100 times what you currently pay for hosting...

If your content isn't secret why not go with a cheap SNI that can host your certificate and put that behind cloudflare (which is free)?