jaypaulynice

OAuth2 is the way to go for REST services especially if you plan to let users give other apps/developers access without giving out their passwords. For better security, you want to decouple the authentication server from your web application (2 separate databases at least)

The authentication server stores email/username, encrypted password, and roles. To access the web app, you first get a token from the authentication server by exchanging a client_id, secret, username, password and grant type. The token is used whenever you want to make a request to the web app. The authentication server has an endpoint that lets the web app check to see if the token is valid and what roles the client has.

The token is only valid for a short time and can be revoked. To know who is making the request, you associate the username/email from the authentication server with a user object on the web application so you can look up based on username/email.

It's not worth doing this from scratch as there are plenty of open source implementations out there already like Spring Security Oauth2 and other libraries for Django/python, but they all require some reading to get started.

I've used Spring Security Oauth2, but it's not very well documented. I've thought about open sourcing my work, but not sure yet.

The on demand platforms fail because these startups can not predict demand like Uber can. Uber has public data like concerts, sport events, rush hour, nightlife which are all pre-planned. Uber can then direct its drivers where the demand is.

On the other hand Uber for healthcare for example is impossible because you can't predict who will get sick when and where. It's impossible to know how many doctors you would need on a given day. So it's a lot of wasted money and doctor time.

There's been a lot of discussions on Mockists vs Classicists. See Martin Fowler's article: http://martinfowler.com/articles/mocksArentStubs.html. In my experience, projects that use mocks extensively usually have the most bugs. If you also have integration tests then mocks are ok. But then it's more code to maintain.

Given a choice I would always do "integration test". Fact is you can test a single class/method, reality is that no class/method exists alone.

I've thought the same as well...it's an opportunity for someone to invest in early stage startups. It's not just YC that's changed. Pretty much all the accelerators have decreased their risks.

Minor typo...the link says the deadline to apply to YC is October 4 2017...should be 2016...could throw some people off...

I'm actually working on a startup to provide medical/mental health benefit for startups, but I think we might be too early to apply to YC...we're doing a private beta right now...interesting to see this come up.

Google probably has excess capacity. There is nothing more to be paid if the server is sitting there doing nothing. It's actually good for Google because they get to analyze a huge amount of traffic which they can use to protect paying clients.

The underlying technology isn't that difficult to understand...there is a web application firewall that sits in front of the web server serving the real content. There is also a load balancer to distribute the requests.

You can block the attack based on IP, request headers, rate control, geo, etc. The problem with some ddos attacks is the size of the request body. That's what usually overwhelms a server.

Ddos attacks do knock out the servers, but since the requests are distributed, then you don't see that. Because so many servers are getting knocked out, then real paying customers can't serve their content. I'm guessing that's why they pulled the plug.

Google's infrastructure is so large that knocking out a few servers won't impact much, they just spin them back up.

Very funny...I wrote an article about how someone could beat youtube's ads machine a few days ago...

https://www.linkedin.com/pulse/beating-youtubes-ads-machine-...

What does YC have to lose by telling people the actual numbers? You created the misconceptions in the first place. It's also reinforced by the number of 'Common misconceptions' articles...

Does this change mean YCombinator is going to invest in primarily mature startups?

It feels like the research and mooc will boost early stage startups to eventually apply to the YC core program. Is that the goal?

Have you heard about cache busting? Someone just needs to request a page that's not cached and the request will always hit your web servers.

I work at a CDN/Security engineering company, but this is just my view.

First off you need to determine where the attack is coming from. You could redirect based on IP/request headers in a .htaccess file or apache rules.

Your next bet is to distribute/auto-scale your application if possible.

You need to setup a web application firewall that sits in front of your web servers and analyzes the requests/responses that hit the web servers. A lot of the ddos campaigns are easy to identify based on the request headers/IP/Geo and requests/second.

It's not hard to write a small web server/proxy to do this, but it would be best left to someone who knows what they're doing because you don't want to block real user requests. You can use ModSecurity's open source WAF for apache/nginx, but again you have to know what you're doing.

When I faced this issue, I wrote a small web server/proxy here that you can start on port 80:

https://github.com/julesbond007/java-nio-web-server

Here I wrote some rules to drop the request if it's malicious:

https://github.com/julesbond007/java-nio-web-server/blob/mas...