clogston

> Overall, I've optimized to just using TurboTax, and I'm sure there is some laziness involved in that decision, but overall, unless something else is much much better, there isn't too much impetus to switch.

And in fairness, there's benefit to sticking with them year over year: that's a lot of data that gets transferred automatically. Most of the less expensive alternatives are horrid (I've used almost all of them). There's a good reason they're the king of their market. My point is simply that no one's giving them legitimate competition in the space and that surprises me. My evidence was only to point out the low-hanging fruit to go after (and while that low hanging fruit wouldn't be enough to sway a 10-year user, it's potentially enough to sway earlier users)

Oh FOR SURE. It's leaps and bounds better than paper forms... IRS says average time to prepare a 1040EZ(!) by hand is over 3.5 hours. Only ~5% of filers use paper forms anymore though.

Maybe "enjoy" is a high bar? But surely there's room for improvement.

> One of the craziest things is, it save their tax department money for every single tax filing done online vs paper

One of the HUGE benefits of e-file for them is that there are sanity checks that happen almost immediately and if they fail the IRS completely rejects the return. This does two things:

1. ensures accepted returns look much closer to accurate

2. places the burden of rejection notification on the e-file transmitter. For example, if I transmit a tax return that the IRS rejects due to a re-used SSN, the onus is now on me to notify that filer that their SSN has likely been stolen and provide customer service on what they should do next. From the IRS perspective this is a huge win. For e-file transmitters and tax software providers this is an un-fun problem to deal with.

IRS estimates an e-filed tax return will have the refund issued within 21 days. The paper form equivalent takes 6-8 weeks.

Source: http://www.irs.gov/taxtopics/tc152.html

The other thing to know is that e-filed tax returns are subject to an immediate sanity check (i.e., has this ssn already been used?, is this a valid zip code?), which doesn't exist for paper forms.

Both of those comments seem to come from call center workers (i.e., they mention clocking in, etc).

Each site has it's own culture (and each site has cultures within cultures). Like any mid-sized company, Intuit has a broad mix of personalities and talent levels. If I had to put them on the couch and nail down the core problem it's that they haven't really done anything groundbreaking lately. All the weird management issues you're reading about in those comments are because they're trying to hang on to what they have without moving the ball forward. All IMO of course.

> and I thought there used to be a "Basic" product between "Free" and "Deluxe".

There is, but it seems like they're not pushing it as hard this year: https://turbotax.intuit.com/personal-taxes/online/basic.jsp

Disclaimer: I used to work for Intuit/TurboTax and am now building a product in the same space. On topic: They rightly get beat up for this, and get beat up for their lack of pricing transparency, but somehow manage to always receive a pass on the software itself. IMHO it's pretty atrocious... Sure, the math is almost always right but the math is a commodity. The experience itself is overly-verbose and littered with repeat questions, confusing questions, open-ended questions.

I don't know anyone who genuinely enjoys using TurboTax. I'm surprised there isn't more legitimate competition in this space.

"End users are more likely to pressure their vendors for better security in the future if they suffer more pain today."

Your statement is true, but surely there's a better and less damaging way to reach the end goal? e.g., if I run over someone with my car and they're saddled with life-long medical bills, they're more likely to call their Congressman and demand a better healthcare system.

"yet it hasn't stopped vendors from claiming they offer protection"

100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.

In case anyone is wondering how to make this the default behavior:

"encrypt-to YOUR_KEY_ID"

in your gpg.conf

When you've spent hours upon hours deep in the engine room of your product it's SO easy to forget that no one else knows what you've built. Doubly-so if you've come from the corporate world working on a product that already has immediate brand recognition.

This is a good checklist.

Yeah, but keep in mind it's only applicable if you use instance-based storage (which you declare when you spin up the instance). If you use an EBS mount it's a moot point.

> If you're writing that code, you SHOULD know every possible incorrect certificate format.

If we define a correct format there are likely an infinite number of incorrect formats, no? A test explicitly checking for this bug would prevent a fix from regressing, but it seems to write a test that exploits this bug before understanding the bug itself would require quite a bit of luck.

EDIT: I'm re-reading the initial advisory and trying to decide if this applies to any cert with a ROOT CA fail or just a specifically crafted one. If it's the former my initial comment is garbage.

I started Common Form with two very good friends and it's been a hard grind to get live in time for this filing season!

Some high level milestones: we started on Nov 22 2013, finished our final acceptance testing with IRS on Feb 13 2014, launched closed beta on Feb 17, and successfully transmitted our very first customer's tax return on Feb 18 (100 days to the day from when we started the adventure).

We're open to the public now and I'd love feedback not only on the product itself, but our scope (1040EZ only), and whether or not you think the existing players are disruptable.