How I hacked Github again

Re:How I hacked Github again by homakov on Friday February 07, 2014 @12:30PM (#7197469)

There's a number of people who would like donate but not interested in consulting..

There were always people complaining "Add a donate address"

Now "why you added a donate address". Oh, Internet.

[ Parent | on HN ]

Re:How I hacked Github again by rdl on Friday February 07, 2014 @02:45PM (#7198289)

Is there a way to guarantee you will spend donations on alcohol and not waste them on things like rent or food?

[ Parent | on HN ]

Re:How I hacked Github again by gknoy on Friday February 07, 2014 @03:06PM (#7198393)

Send him an e-mail saying, "Hey, I sent you $100. I would deeply appreciate it if you spent it on your beverage of choice, or a nice dinner with a friend, rather than on necessities."

It's no guarantee, of course. :)

[ Parent | on HN ]

Re:How I hacked Github again by shortly on Friday February 07, 2014 @03:30PM (#7198533)

yes. donate to someone who makes $400/hour.

[ Parent | on HN ]

Re:How I hacked Github again by usaphp on Friday February 07, 2014 @05:31PM (#7199206)

Charging $400/hour does not mean he does not need extra money. His nature of business is a short term projects, it's not like a regular web developer who has to work 40 hours a week for many month to finish a project, he only does audits which don't last long because of that you see this "high" (I personally don't think it's high) hourly rate.

[ Parent | on HN ]

Re:How I hacked Github again by rdl on Friday February 07, 2014 @05:53PM (#7199323)

It's actually a good strategy to price high hourly but over-deliver (doing lots of free work behind the scenes, or speculative unpaid work, etc.) -- rather than the market-clearing rate of ~100-150/hr, at least when you're trying to build a brand. At $400, he's clearly a specialist, and will get more interesting work; at $100/hr, you could hire him and just treat him like another developer, have him do cookie-cutter assessments, etc.

Personally, I think he'd make more money at $400-600/hr if he could also get some kind of manager to handle the interactions with clients; it doesn't seem to be what he enjoys, or is particularly good at.

(I've had drinks with him before, so probably the most effective way to accomplish my goal is to buy him drinks when I'm in town.)

[ Parent | on HN ]

Re:How I hacked Github again by erichocean on Friday February 07, 2014 @08:25PM (#7199891)

Personally, I think he'd make more money at $400-600/hr if he could also get some kind of manager to handle the interactions with clients; it doesn't seem to be what he enjoys, or is particularly good at.

Completely agree. I'm not doing security, but my hourly is similar, and it was a game changer for me to have someone in a manager-like role working with me. Client relations are a huge time suck, but are also absolutely necessary. If he can find someone (or maybe someone on HN should volunteer), it'd be more than worth it.

BTW My manager takes a flat 15%. I'm much happier, clients are way happier, and my total income has increased as a result—not to mention another person is gainfully employed at something they're good at and enjoy. A win-win all the way around.

[ Parent | on HN ]

Re:How I hacked Github again by jmnicolas on Saturday February 08, 2014 @05:42AM (#7200881)

It seems your manager is more an agent than a manager.

[ Parent | on HN ]

Re:How I hacked Github again by rdl on Saturday February 08, 2014 @06:05AM (#7200911)

I meant manager in the sense of a band's manager. It's more than just introducing you to deals; it's handling the communications back and forth with the client on an ongoing basis; not merely the negotiation to set up the deal but the actual work-product communications as well.

[ Parent | on HN ]

Re:How I hacked Github again by erichocean on Saturday February 08, 2014 @07:36AM (#7201035)

Yup, that's exactly what I meant too.

[ Parent | on HN ]

Re:How I hacked Github again by akerl_ on Friday February 07, 2014 @12:36PM (#7197504)

At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.

[ Parent | on HN ]

Re:How I hacked Github again by homakov on Friday February 07, 2014 @12:39PM (#7197523)

95% of my security research is not paid. I fix gems, libraries, websites etc. Donated money go right there, through beers and coffee I need.

[ Parent | on HN ]

Re:How I hacked Github again by orblivion on Friday February 07, 2014 @12:54PM (#7197625)

Perhaps you could clarify that part in your future posts, to appease the Internet haters on both sides. "I do paid contract work. However I also spend lots of time fixing open source stuff for free. If you want to encourage me to keep doing the latter, here's how to donate."

[ Parent | on HN ]

Re:How I hacked Github again by akerl_ on Friday February 07, 2014 @01:06PM (#7197687)

Agreed. If it had said that, I'd not have been concerned by it in the first place.

[ Parent | on HN ]

Re:How I hacked Github again by avenger123 on Friday February 07, 2014 @12:43PM (#7197549)

This makes sense then for sure.

You are giving people that you have helped an opportunity to pay you without having any kind of contract with them.

Nothing wrong with that at all.

[ Parent | on HN ]

Re:How I hacked Github again by raganwald on Friday February 07, 2014 @01:19PM (#7197769)

Donate or don't donate, that's your call. But why are you complaining about him asking for a donation? Why try to "shame" him? What is he doing to harm you?

[ Parent | on HN ]

Re:How I hacked Github again by kmfrk on Friday February 07, 2014 @01:41PM (#7197915)

Start-up idea: let Hacker News users pay to berate you for x minutes.

There's a clearly huge market.

[ Parent | on HN ]

Re:How I hacked Github again by MarkTee on Friday February 07, 2014 @01:55PM (#7197998)

Although you'll have some competition:

http://www.youtube.com/watch?v=kQFKtI6gn9Y

[ Parent | on HN ]

Re:How I hacked Github again by nealabq on Friday February 07, 2014 @02:14PM (#7198108)

plus.inyourfacetwit.com, where you have 140 chars to berate anyone, and a whaling-wall for when you really need to get it off your chest.

Ad supported. Abusive ads berating potential users are encouraged.

[ Parent | on HN ]

Re:How I hacked Github again by Intermernet on Saturday February 08, 2014 @11:09AM (#7201518)

20 hours later, domain still not registered...

Get on that before someone filches it!

[ Parent | on HN ]

Re:How I hacked Github again by akerl_ on Friday February 07, 2014 @01:42PM (#7197917)

Not sure why you're viewing my comment with such hostility. I was mistakenly under the impression that most of his work is contracted / bounty. He's already clarified his reason for accepting donations below, and I understand. I just think the placement/wording was less than ideal.

[ Parent | on HN ]

Re:How I hacked Github again by raganwald on Friday February 07, 2014 @10:36PM (#7200199)

Raganwald! Downvote or don't downvote! Why are you trying to shame akeri_!?

Point, set and match.

[ Parent | on HN ]

Re:How I hacked Github again by justinsteele on Friday February 07, 2014 @01:08PM (#7197701)

Luckily, he is not forcing you to donate, so you can choose not to. :)

He also commented on his site that he "is poor", so it could be that he simply hasn't landed enough gigs @ $400/hr to be in good financial shape yet.

[ Parent | on HN ]

Re:How I hacked Github again by bfish510 on Friday February 07, 2014 @01:35PM (#7197872)

He's also providing this blog post. Something he doesn't have to do and has taught me something as I try to improve myself.

[ Parent | on HN ]

Re:How I hacked Github again by ics on Friday February 07, 2014 @04:00PM (#7198697)

I doubt Egor is being paid for posting these summaries to his own blog for all of us to see. Even if he weren't contributing code to various libraries and applications, these write-ups are a great benefit to everyone else who has yet to be a target.

[ Parent | on HN ]

Re:How I hacked Github again by patcon on Friday February 07, 2014 @12:39PM (#7197527)

Some people actively try to think of money as a proxy for appreciation ;)

[ Parent | on HN ]

Re:How I hacked Github again by patcon on Friday February 07, 2014 @12:38PM (#7197517)

If you think $400/hr is great, you should see the rate for black-hatting :P

[ Parent | on HN ]

Re:How I hacked Github again by shabble on Friday February 07, 2014 @01:36PM (#7197876)

Although you probably should factor in the possibility of several years of compulsory $0.30/hr labour, plus forfeiture of all your ill-gotten gains (and probably some healthily-gotten ones too, they're not so fussy)

And that's before legal costs and possible restitution.

</jokeruiner>

[ Parent | on HN ]

Re:How I hacked Github again by big_youth on Friday February 07, 2014 @02:06PM (#7198071)

Not a concern if you live in Russia or Eastern Europe.

[ Parent | on HN ]

Re:How I hacked Github again by ics on Friday February 07, 2014 @03:55PM (#7198665)

...unless you like to travel.

[ Parent | on HN ]

Re:How I hacked Github again by 6cxs2hd6 on Friday February 07, 2014 @12:32PM (#7197476)

Sure, I had a similar first reaction, but thought about it. If you have skills but haven't yet developed a deep-enough client base, you're in a quandary. You can't bill for $10/hour, or no one will take you seriously. You need perceived value, so you have to quote some reasonably high rate, even if you case-by-case discount it or work gratis.

(At least that's how I imagine it must work. I've never consulted.)

[ Parent | on HN ]

Re:How I hacked Github again by jmathai on Friday February 07, 2014 @12:29PM (#7197461)

Not everyone's time is equal. If you're finding security holes like Egor then an hour of your time is absolutely worth $400/hr.

[ Parent | on HN ]

Re:How I hacked Github again by akerl_ on Friday February 07, 2014 @12:37PM (#7197512)

I totally believe that he's worth that amount of money. I'm sorry if you thought I was questioning that. I'm questioning the juxtaposition of his hourly rate with a request for donations.

[ Parent | on HN ]

Re:How I hacked Github again by gatehouse on Friday February 07, 2014 @02:34PM (#7198225)

I think the contract makes sense for clients, and the donation makes sense for other security researchers who want an incentive for him to keep publishing ideas.

[ Parent | on HN ]

Re:How I hacked Github again by jmathai on Friday February 07, 2014 @04:29PM (#7198859)

Understood. But I imagine that his work isn't quite as "steady" as one might expect. He invests time by trying to find security exploits in hopes that the affected company compensates him. He doesn't set his price or even determine if he gets paid for his time.

I think that might be the rationale...or it might just be that he's found himself in a position where he can collect bounties AND donations :).

[ Parent | on HN ]

Re:How I hacked Github again by jedicoffee on Wednesday February 12, 2014 @05:50AM (#7223606)

Yea this is derp.

[ Parent | on HN ]