colinsidoti

The final piece of the puzzle - for me at least - is the ability to collect money as a business, then pay out my service providers through Stripe.

There's a temptation to just let the money sit in my Stripe account, then payout using a "Special Case Transfer" https://stripe.com/docs/connect/special-case-transfers

But this approach seems non-compliant.

How long before we can payout service providers so the charge is seen as coming from my business, instead of from my customers? (This appears to be the compliance issue.)

An ACH "source" is potentially a good solution (and apparently in beta), but I imagine I'll incur additional fee. Perhaps using my own bank account as a source will be free, but using others will be paid? (Kinda like managed accounts)

Is this a change in price for $0.25 per transfer, to 0.5% per transfer? I guess there's additional value-add from tax management.

With Bridge, will this still work with the API?

This came up on HN not too long ago - I imagine it's how they do the caching:

https://www.netflix.com/openconnect/hardware

To answer 1, I would guess this kills the argument for a wired connection, but not necessarily wireless since there are greater bandwidth restrictions. That's just a guess though, since my perception of how far wireless tech has come might be off.

Ehhh, that's pretty cynical. I don't want to blindly support YC, but this seems fairly debatable. YC wants to give founders resources to succeed. One necessary resource to succeed is employees. Given the current tech hiring climate, I wouldn't be shocked if more foreign employees leads to a measurable and significant improvement in their bottom line. I think you will need to make a few too many assumptions to argue that one is definitively better for their bottom line.

Perhaps one appeal of this approach, though, is that this effort aligns better with legislator's "bottom line" - if you look at their bottom line as job creation.

It's a bit sad that such big players are fighting for such a small, incremental step. The number of successful founders facing immigration problems sounds like it would be orders of magnitude smaller than the number of potential foreign employees. Is my intuition wrong there?

I also fear that a "win" here will allow legislators to push off further reform (e.g. "we just did something") instead of serve as a meaningful stepping stone.

Shoot me an email - I have a long-term client I need to hand over. Email in profile.

Also - in general I've found craigslist to return the best leads. Typically takes at least one meeting in person though.

You can also work through recruiting firms - they often get temp jobs they're happy to intro you too. If you do good on your first job, they'll keep sending you to more.

At an airbnb techtalk they stressed how this is a really annoying problem for them. They actually have a subdomain that substitutes longer than normal english strings within their design:

https://xxlong.airbnb.com/

1. IMO, the bigger issue with response_body == stdout is that the default data output is unescaped. Take a look at Wordpress templates. The fact that the template framework is PHP doesn't really cause any issues. And WP is diligent about keeping the escaped data easily accessible, so calling <?php the_post(); ?> actually works fairly elegantly.

2. I wonder if reliance on == has ever caused any major security issues? I know there's some edge cases, but I can't remember a time == ever came back to bite me. (Yea, you can point to strpos(), but everyone knows that example and it's marked with a big red box on php.net.)

I'm excited about this.

I think you'd be better off with a delivery fee instead of rolling it in to the cost. My local wine shop sells fresh baked bread from the local bakery. I go in 2-3 times a week for bread, and they've gotten to know me as a regular. Each loaf is $3 and I'll buy one or two depending on what I'm doing that night.

If I just wanted one loaf, I'd be okay footing the extra $3 for the bread. Walking to the wine shop is pretty freaking annoying, and I think they might resent me for rarely buying cheese/wine.

But if I wanted two loaves, I just can't imagine spending $12.

That's just me. If you take anything away from this post, let it be this: When you come to Boston/Cambridge, get Iggy's bread. Or pick a few North End bakers.

Another thought...maybe go cheap on the bread and build margin into cheese/meats. Call it the Car-cuterie ;)

More interesting... They bought Kiva Systems for $775 million from Mick Mountz, a former Webvan employee who identified warehouse fulfillment as a prohibitive cost in delivering groceries.

http://www.kivasystems.com/about-us-the-kiva-approach/manage...

It's unclear if Amazon has actually started using Kiva, though. Does anyone know? That 60 minutes special didn't show them using it.

Edit: Changed from "the prohibitive cost" to "a prohibitive cost."

I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker.

It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.

I don't know the details of IMAP well enough, but isn't the proxy what allows them to inject HTML into the email that iPhone's Mail app sees, but not any other client?

I'm going to venture against the grain here: this is a really cool hack by LinkedIn. The OP's phishing attacks are equally cool - basically just HTML injection that leverages a vulnerability in LinkedIn's message rewriter. LinkedIn should be able to patch it relatively easily, just as they would on their website.

Are you actually sending arbitrary files over SMS? How does that work?

My thought is it would be technically possible over MMS, but most default messaging apps wouldn't play nice with them. Also getting into the network is a huge challenge.

The glory of this system is that WP retains their stupid easy install.

I suspect they pull down the data for whether a cron needs to be run in an initializing query that also pulls down a ton of other data (site name, for example). So in theory, they're only doing a few time comparisons of extra work per request.

Also - I haven't looked too deep into WP's implementation, but are they actually doing it on page load? I've seen it in other php software (I believe phpBB) as a 1px image. This kinda solves the caching issues others are talking about...your server might still get hung up, and that picture might never load, but if you're cached properly I think it won't stop anyone from reading.

Ignoring the bugs though...I've had my shared hostgator plan handle a couple of top page HN post with no additional caching installed, which makes me think it's probably not a problem for most people running WP. (I just double checked to make sure that's actually true, and it is.)

Err I don't think this would stop me. But let me preface this by saying I learn something new about security quite frequently, so if there's a major premise I'm missing, I am both interested in learning about it and not completely surprised.

The main issue here is that your Javascript can potentially be owned by XSS or other approaches. If you own the javascript, you can send plaintext passwords or keys (which should have only been available to the client) back up to some server.

Even with that possibility though, I still think using browser-based crypto creates a more secure environment than the server storing unencrypted files. The author makes a good point in saying that you download javascript on each request, which makes it more susceptible to getting owned than a native-app, but I think a successful attack with this approach will still be an order of magnitude less severe than if an attacker owned a server full of unencrypted data. If the data is unencrypted, an attacker that manages to own the server has access to everyone's data. With it encrypted, the attacker will only get data from users who are using the site while it's owned.

Isn't that still a better option?

I've looked into this before and concluded it was possible, although I forget exactly how.

I bookmarked https://crypton.io/ and http://peerjs.com/ . PeerJS is p2p WebRTC, which I believe I chose because I wanted to do secure, real-time p2p file sharing.

That isn't 100% relevant for this, but downloading the file over some socket into client-memory then decoding it there sounds like something webrtc could be a good option for.

Crypton handles the crypto.

I think the biggest thing someone who tackles this needs to realize is that perfecting the crypto doesn't matter 100%. If you could get something working that's doing some kind of encryption/decryption without exposing anything to the server, crypto experts will come in and help secure everything (see: mega)

Edit: I should mention that I didn't research this extensively, and better libraries might be (and probably are) available.

Bob Langer http://en.wikipedia.org/wiki/Robert_S._Langer

What if we put a little checkbox that says "Install the krrb plugin to automatically post your craigslist listings on krrb as well, thus increasing your chances at a sale."

I'm defining "piggyback downloads" as the extra page that comes up in someones installer. Isn't this a well-established practice? Maybe it's disappeared in the past few years?

I also love seeing this argument come within a community that's generally supportive of programmatically scraping that same user data and republishing it without user permission (although that was more what Padmapper did, not krrb).

Edit: your point re: increase chances of being sued vs. increase chances of success in court is well taken.

The tone of this letter is horrible IMO. I understand you're angry, but I imagine this will piss him off more than rile him up. I'd rather see you take them to court with a strong case than start a public, one-sided flame war. There must be a syndicate of investors that realize it would beneficial for them in the long-run to see Craigslist lose the stronghold they have on classified's data. PG (submitted this) and Garrytan (got angry re: padmapper) might be a good starting point.

Does it, though?

The plugin today quite arguably scrapes Craigslist programmatically. I think Craigslist has a case there.

However, if Krrb instead injected JS at post-time to publish cross-site, I think that argument becomes much less convincing.

You can make a case on either side, but I think doing it at post time is important (for one thing, it guarantees that the publisher is actually the person krrbing it)

You should piggyback your plugin into popular installers to get this on millions of computers. Then, don't make them push a button to post it on krrb, do it automatically. Make sure your TOS at install time says this is going to happen.

(I may or may not have been involved with a company that did this to great success.)

Ahhh...fluid vs not fluid: http://twitter.github.io/bootstrap/scaffolding.html

He casually nested two "col-lg-6" within a "col-lg-9"

Isn't that a bit of big change? In the past, I don't think we could get two equal size cols filling up a 9.

Cool. Dropbox seems to be pushing hard to become the goto for email attachments. If Mailbox doesn't win, they'll still have market share with Yahoo.

Mostly surprised Yahoo would do this - I can't imagine we'll be seeing a similar deal with Gmail/Outlook.

Would love to get some dialog going about better ways to accomplish this, any thoughts?

In Boston they started putting advertisements on the sides of the machines...any other cities seen this? I wonder how much additional revenue it drives.

> Let's assume mailbox.app utterly dominates the (iphone?) market.

There are two reasons I would potentially want Dropbox on my phone. 1: For photos. 2: I need to email someone a file on the run. If the app that I'm using for email plays nicely with Dropbox, this is suddenly much easier. At least that's the main benefit I've thought of, and it strikes me as pretty powerful.

As far as a big player cloning an app to take out a dominating startup, can't you argue that's what Microsoft, Apple, Google are trying against Dropbox now?

> I expect the next moves to be either developing or acquiring media sharing (photos, videos, etc) apps

It's not too big of a secret that they're doing this...check out their New Grad job description.

Hey Keith,

Thanks for your note, would you mind dropping me an email (my address is in my profile)? I'd love to have a brief chat about your experience and hopefully avoid any obvious mistakes, we're in the midst of making early decisions on hardware.

Thanks, Colin