ainsleyb

That's awesome. We used OpenVPN because that's what we were familiar with, but your L2TP script looks great. Would you mind if we tried to integrated that at some point?

There are a number of ways: malware, browser extensions, man in the middling, etc. SQLi would have been a better example than XSS, but there are definitely ways in which XSS can still be harmful if thrown in a cookie. If you wanted a persistent XSS for example, you could use a reflected XSS to create a longer lasting XSS attack in someone's login cookie, causing that to be executed every time they hit the page rather than just the one time they click on a malicious link you sent them. Does this make more sense?

Flying cars DO exist! :) http://www.terrafugia.com/

No problem at all! We may very well start crawling your advisory DB for our own mailing list, which isn't limited to just Ruby, to be fair. ;)

It's always good to have more eyes on security issues - Ruby or not - and keeping the community informed. Feel free to get in touch with us at [email protected] - we'd love to chat about any ways we can work together.

This is an interesting take. For us, it's not about age, but about personality. We have a financial controller who is 20 years older than everyone else on the team and we'd bring her on full-time in a heartbeat if we needed a full-time controller. She has a great personality, is fun to have in-house, and knows what she's doing.

How I look at the Sunday test is less of a "are they like me" and more of a "will I get along with them many hours a day"? We work anywhere from 7 hours a day, up to 18 (especially during major code pushes) - we try to avoid this as much as we can, but sometimes (for us at our stage), it's inevitable.

I do have to enjoy working with my colleagues, and someone for whom I won't be willing to come in on a Sunday has a higher chance of bringing me down on a regular basis. That doesn't mean we work Sundays (we're typically in the office M-F), but it's important to be able to get along with people and it's a good litmus test, imho.

As a founder your job is to take the high road as much as possible while still pushing through the strengths of your company. It seems pretty obvious that NYT won't be changing their opinion, and maybe even reached out to Musk to confirm this suspicion. If Musk were to reply to this negatively he'd essentially be feeding an ever-lasting flame. He's taking the best parts, spinning them to those who care about his product, and is continuing on with building out a great product.

Not to mention, he's gotten a lot of good press from other media sources since (as he points out in his blog post).

Sorry about the confusion.

If you run a scan from our homepage, you're actually looking for a lot more than just the YAML vulnerability (XSS, Mixed Resource, etc.) as our product isn't limited to just the YAML vulnerability.

If you run the scan from https://www.tinfoilsecurity.com/railscheck, then you'll get a quick check for just the YAML vulnerability.

Does that clarify it a bit?

There are other workarounds, too. You could disable XML parameter parsing, for example (as seen here: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...).

Thus, you might be running an old version, but still actually be safe by disabling the vulnerable bits.

I've posted a little bit more on our blog at: http://blog.tinfoilsecurity.com/use-rails-check-yourself-for...

Mind if we copy that verbatim? :)

We're actually offering free web security, too: http://news.ycombinator.com/item?id=4792073 :)

Love what Mixpanel is doing, so we'd like to jump on the bandwagon. Offering our $59 Basic plan for free for life, and 50% off all other plans. Happy to keep startups secure :) Email your YC rejection letter to [email protected]

Try http://www.youtube.com/playlist?list=ELdlNqFzO2slw&featu...

The first episode is available for free on iTunes: https://itunes.apple.com/us/tv-season/start-ups-silicon-vall...

It's a travesty, and puts female entrepreneurs in a poor light, pitting them against each other and making them look petty.

This looks a lot like BugHerd (http://www.bugherd.com). Might be worth looking at what they do?

Seems awesome - like a GUI for git-flow.

What is the pricing for this? Seems there's a free download at the top, but the bottom says "Buy for $29.99". Might want to make the pricing structure clearer. :)

And this is the precise reason we exist. :)

I'm super surprised that the plans for 2013 don't include a charging station in the Bay Area, seeing as they're headquartered here.

This looks great! It seems to make Stripe simpler (since Stripe is essentially simple payments for developers, but non-developers have a hard time grasping all of their docs). If you don't plan on expanding it too much, you might try to talk to the Stripe team and have them integrate :)

What we've found is that there are 2 mindsets: building and breaking. When you're building a product it's super hard to switch to the breaking mindset of security, simply because mental context switching is expensive and mentally exhausting. The most important thing is to force yourself into that mode before posting anything publicly. If you don't have the security experience, have a friend or service (like ours) look it over. Data is one of the most important assets to your company (or project), and any sort of disclosure can shut you down permanently.

Legally you must disclose any sort of security breach to your users: http://en.wikipedia.org/wiki/Security_breach_notification_la...

This is a severe lack of customer service. The least that can be done is a quick shutdown of the site until there's a good fix, an email to all customers (since legally they have to disclose the breach: http://en.wikipedia.org/wiki/Security_breach_notification_la...), and a thanks out to whomever reported the issue.

If you make a mistake, own up to it. Honesty is the best key to building a business, and I'm sure they've at least lost the HN trust for any product in the future.