eduardordm

In my company we have an application that stores an API key in its local storage. This API key is generated by the client app when it's first run and it's individual. If it gets stolen only that client will have its security compromised. That happened to us a couple of times, always on rooted android phones with pirated software installed.

I'm a heavy AWS user but not too familiar with S3 keys, couldn't the keys be generated and isolated per user?

Oi!!

The general idea is this: IIN is issued to visa branches around the world each branch can only have one IIN. Problem is, visa is not the only issuer of visa cards. Many banks and financial institutions can also issue in lieu of visa and have their own IINs as they please. My visa credit card starts with 2 because it was issued by an airline under a mileage program. I never had problem using it online but most websites won't show the correct card type.

Merchants are not charged according to a card type, the charges applied to merchants have nothing to do with visa. Visa is only doing processing service for a bank. Banks are the ones who charges merchants and pay visa a percentage of the fee the bank charges you. Because banks can't handle the volume of merchants, they usually have gateways or other companies to do that for them.

My company also issue visa cards and we use the same IIN: 6371.

Yes, we do have around that number of tables which reflected into those thousands of models. Many of them are related to storing 'frozen' regulation data. One example: every X time we need to create something very similar to a IRS forms (electronic) and send it to a bunch of government agencies because the data sent must be available for reports we can't just store a text file. One of those regulations requires hundreds of tables:

https://www.fazenda.sp.gov.br/sped/downloads/GUIA_PRATICO_DA...

Some systems are very sensitive to transient data and pretty much needs to store all of it, depending on how you plan to use that data later it can add a good number of tables to your software.

Hi, my credit card company is not listed there, yet it exists: my IIN is 6371.

I'm afraid this is not completely accurate at all. There are many credit card IINs and those are just a very few and will not work with some international cards (including international visa cards). Those numbers are issued by the American Bankers Association - in accordance to ISO 7812. They are not attached to a credit card flag, but to a company and a single company can have only one IIN. What happens is that Visa is composed of many companies in many countries, that's why they have many IINs which may or may not start with the same numbers, there are no strict rules about that.

The number this website calls 'prefix' is actually named IIN and it's composed of 6 characters, not 4 (nor 2 or 3). They are disposed in groups of 4 for a variety of reasons and no issuer owns whole lots of IINs.

The only completely correct way to detect a credit card is to just contact ABA to obtain a list of issued IINs.

This is what an issued IIN looks like, we also have many:

https://drive.google.com/file/d/0B-Sa2A0cesh4eDVMY3NwQ3ZEVlZ...

I also built a thing to help me parse those numbers (ruby):

https://github.com/eduardordm/iso7812

Certainly most of you have already read but next time you read "A Brief History of Time" focus more on how Stephen thinks and how he deals with uncertainty, it's like reading a new book.

Certainly a good - and probably the best - option right now.

But maybe there are simpler alternatives. Maybe passwords shoudn't mean anything, just like losing a key on a busy street is not exactly a security threat to its owner, password leaks shouldn't be harmful. Maybe the problem is not how passwords are stored or encrypted but how meaninful our 'ids' are - and how they are attached to that password.

Hi Marco, I own a credit card company/bank/gateway and I can answer that:

They are using a small protocol (XML or plain ISO8583) over a somewhat fast connection (X.25, GPRS, 3G or the store's internet - ADSL, etc). Connections are always kept alive for a certain amount of time.

The bank side of processing is very simple and shouldn't take long. Keep in mind that the data used to authorize a transaction is minimal. After the authorization is given, the bank will process the actual payment, which is a two-step job with the first step being executed minutes after the purchase and the second one usually at night.

I wouldn't recommend you digging too much into banking standards without a specific purpose. There are just so many and almost no one strictly follows them. This is a good start: http://www.aba.com/Pages/default.aspx and https://www.pcisecuritystandards.org/

It's been a while since I didn't comment on anything on HN, but since you are doing something that is really hard and I have some experience with accounting and banking, may I offer you some tips that you might want to investigate further:

- Regulation: Some countries (and some US States) do have guidelines on how this type of software must be constructed, make sure you are compliant to those regulations if it's the case. Example: IIRC you need permits to even start building a POS solutions in some states.

- Integration: An usable accounting software must include HR or have integration with common HR software used by most companies. HR is one of the most complex parts of accounting. Most clients will have outdated solutions they are comfortable working with and won't change completely to your software, make sure you can integrate with tools they want to continue using. Only fight the old if the option you are offering means task elimination. Don't forget you need to integrate with banks, but that's easy.

- Customization: Human systems are not pretty. There are things that do not make sense to accounting and are often loaded with emotional decisions, human relationships and corporate strategy. Sometimes a software just streamlines the human mess, make sure your software can be customized by your clients to a certain point.

In my company I started to issue smart cards instead of simple magnetic cards, because the tech is so hard to implement I started to question if this was a mild case of security through obscurity. I really hope this isn't the case, many banks store passwords in those cards, including us. This password cannot be easily transported back to our servers.

Anyway, there is something missing, as a security measure SIM cards should burn out if you keep calling it.

There is just one single (and dead) negative comment about Tim Ferriss in this thread.

"What have you done?"

Ask that more often, you will be surprised to learn that mostly every single person actually creates and do things that are important to others in one way or another. Don't diminish people just because their work is not broadly recognized, everyone is important.

Maybe it came out undervaluing Tim's help (which is worth much more than 100k), we share the exact the same opinion. I'm sure that with Tim's help, any startup would get a huge investment within weeks.

I would also invest 100k-1mi in a company that's growing 10% month-to-month and had 10k+ paying users.

No companies in such position should need to raise that amount money. It's not completely useless, but: you can't hire talented developers with it, you could spend cash with office and 'stuff'... My point is, if you are profitable, raise 20mi, 10mi. 100k won't make much difference.

Maybe you want to work specifically with Ferriss, but the truth is, profitable startups are in high demand (because there are none) and they are the ones choosing partners.

80% of my costs come from securing client data and having a HA environment. We were using Oracle DB for many years, switched to PostgreSQL last month due to usability problems, not cost.

I hope you make clear to your users that there will be data lost (to the point of your last backup) in an event of failure (which is certain thing in AWS).

If you think Multi-AZ will save the day: we lost a whole region of data in 2011 and again in 2012. If we didn't have a slave node on another region, we would have to restore a 13 hours old backup, that would pretty much make us go bankrupt.

I've been postponing writing about this for a long time, mostly because I wanted to talk at railsconf before writing a post (who am I kidding, I just procrastinate a lot), having submitted the talk for the last 3 years without getting in I'll definetly write a long post about it.

Already is! I've submitted talks a few times about my experiences with Rails in an enterprise environment, no luck. Anyway, We run rails since 2006, we got large and became a bank.

Numbers: 5032 models, 42 gems, 16 submodules, lots of C extensions and eventmachine servers running in threads. From our website to ATM servers, it's everything inside a single rails application. We managed to upgrade from 2.3 to 3.2 in 6 months. Already running 4 (took only a few hours). We just completed our migration from Oracle DB to Postgres.

You are wrong. Rule of law is a judiciary state or institutional system in which every actor respects the same set of rules, from individuals to the very institutions that creates the rules, those rules usually imply separation of powers and always respect to fundamental rights (privacy is one of them!!)

The damage this did to american tech companies doing business overseas is HUGE.

How can you trust Amazon won't give access to your RDS account to someone? A hyperbole now but could happen in the future: How can I trust a judge didn't ask cisco to add backdoors to give NSA access to our networks???

I do business with the government (in Brazil) and they asked me to move out of amazon ASAP, we pay a small fortune every month to amazon, we will have to set up a custom environment to this one single contract now.

I'm sorry, but google's response was demagogical at best (what does 'direct access' even means!??!). In many countries the judiciary would already be in the case and the head of those companies (which didn't provide 'direct access' but there is obviously something happening) would have a lot of explanation to do.

Ha! I knew I wasn't the only one.

I'm a large user of AWS but, in general, I never feel like I'm in a true VPS. My last experience:

Out of the sudden one of our EC2 instances could not connect to another, causing our HA solution to spun dozens of instances and eventually crash too. It was clear to me that the dest machine was behind some firewall, we went to the security group, the machine was supposed to accept any connection, from any port, any host. The instance itself had no active firewall.

Out of desperation I added the very own security group to itself. It worked for a few hours, then stopped again, I removed, it came back to work and still working (8+ months now)

This is only one of various mysterious events I've seen happening on AWS.

I don't know much about IBM products but I'm a heavy Oracle DB user in the process of migrating to Postgres due to simple problems, cost not being one of them. In fact, you will see a lot of users still using very old Oracle versions and getting full support from oracle.

Oracle (DB product) is the wrong choice for most startups, I actually wrote a post about that some time ago: http://eduardo.intermeta.com.br/posts/2013/2/1/this-is-why-y...

My current company uses extensively .NET and I have almost a decade of experience working with it at my last employer, where I was also responsible for choosing and buying such products.

In my last employer (government), we didn't choose .NET, microsoft won the contracts. In the last update when I still worked there, we spent 250k USD to update our programmers VS to 2010 + windows 7. (I wonder if they will now update again). SQL Server prices are similar to oracle's with similar features.

In my startup (not a startup anymore) I had to spend 40k just to get the environment needed for a project (involving telephony) the only reason we had to use .NET was because the hardware manufacturer only provided driver+tooling for windows and some components were exclusively for .NET. Because we mostly use linux and macs, we also had to buy windows licenses. In my country, a Windows 8 license cost almost 2x the minimum wage.

We happened to have a discussion if we should give up or not a specific product because of the microsoft taxation on our business. The only reason we decided to keep using .NET is the cheap labor and the lack of hardware suppliers willing to provide us drivers and tools for linux.

So yes, microsoft damages not only startups, but companies in general.

BizSpark has rules many startups cannot follow and is only valid for 3 years. This is the same selling scheme used by drug dealers.

You couldn't buy the VS licenses + SQL Server + Windows Server with the money YCombinator provides you.

So, yes, most microsoft products are incredibly damaging for a startup.

Keep in mind that .NET is relatively new to the enterprise and lots of those companies didn't even get out of cobol yet.

Opinion:

Timing is a important factor here. My bet is those enterprise companies skipped the .NET/JavaEE era and will jump right into what is coming next.

I know a couple of banks that are heavy Adabas/Natural users for decades. When .NET/JavaEE boomed they opted to just wait. Now, no single framework can really solve most of your problems. In fact, the problems are so heterogeneous that using frameworks at all is becoming completely irrelevant.

That said, .NET, JavaEE, Rails, Django, they are all dead to a certain point. What we will see is the rise of the non-frameworks. People will start doing their own stuff on Go (or anything else) and maybe will start open sourcing parts of it. You will have a lot of mini libraries that you will put together to fit your needs.

I had a very difficult period* years ago while trying to finish a masters in NY (never finished it), I did something similar. I would never spend any cash, I would keep it until the last moment because it gave me options.

I believe people do this because, in case of an emergency, they can switch to public transportation and use that cash for something else.

*Difficult period: I had money for one meal a day. Didn't have money to pay for two subway rides so I would walk 6 miles a day to walk from the campus to the place I was living (which was a garage's attic).

Hard to understand why people spend so much time on a short game like Diablo III. Even before I finished it on inferno the game didn't make much sense, I just finished for the sake of it, which I regret.

Most Super Mario games requires way more abilities than that and less time.

Don't waste your limited time on earth playing consumption-driven games. I've been trying Eve online for a few days, It does not looks promising, it seems that Eve also is also driven by item accumulation and not actual playing.

(I lost my reply on a copy-paste / expired link, let's try again)

Sensors 'broadcast' the information across the systems in a very simple way (electronic but not hackable). Everyone get its data directly from sensors.

The FMC is like a pilot without hands. It is a client of the flight control system (another computer) like the pilot itself. When the pilot connects it (this is physically controlled) it can change the parameters of the AP, but it stills not controlling the airplane.

Hypothesis (this is wild): you physically get to the FMC and hack it. The only thing you will be able to do is to change the route (only if) it is engaged. But under a class A/B airspace, this will be immediately be noticed by air controllers that will notify the pilots. Anyway, the pilot should notice it right away. The FMC functionality is very restricted, really.

Exactly. Because the ILS range is short, it becomes easy to pin point location. Those protections are embedded in the ILS system itself

You are correct, but modern receivers will actually use the transmitter like a "NDB" and will detect that the incoming position is not the same as the stated in those messages, ignoring them.

The same thing happens with sudden changes in GPS messages that are completely out of alignment with the inertial system, they will be ignored. (unless you somehow are capable of knowing exactly where the plane is and gradually hack the GPS messages)

ILS systems are maybe the most dangerous and prone to hacking, but keep in mind that those frequencies are under surveillance and police is dispatched within seconds of a clandestine transmission on those frequencies. Again, here the gps and inertial is also used to guarantee nothing completely wrong is accepted as valid ILS sources.