moot

+1 for SizeUp.

Maciej is easily one of my favorite writers.

And speakers! I recommend: https://www.youtube.com/watch?v=5Vt8zqhHe_c

I just returned home from hauling most of my clothing to the local Goodwill. On a related note, I look forward to seeing more people wearing startup/conference t-shirts around NYC, since they comprised the lion's share of my wardrobe...

I've been researching these services for the past few weeks since I've committed myself to liquidating most of my belongings (I live in a small apartment with no closets -- thanks New York! -- and was inspired by this blog post: http://www.raptitude.com/2011/01/i-dont-want-stuff-any-more-...), and would prefer to see them in the hands of friends and those in need rather than a landfill.

Does anyone have recommendations for where/how to donate more valuable items? For example, I want to donate an expensive drone I never use, but would prefer to see it go to a classroom/after-school program. Thinking I'll search DonorsChoose.org and offer things to teachers, but is there another service?

mootxico

FYI, station agents will merge/combine MetroCards for you, so you can recover small balances from old/unexpired ones.

Now you can download memes from 4chan marginally faster!!

(I'm really glad they did this, because at 4chan's patented "SOON™" dev pace, it'll take us another decade to add native IPv6 support.)

Sounds like a good plan to me!

Our investors have been incredibly supportive -- especially these past few [rough] months.

The biggest concern I have is not so much the price it would fetch (which is probably not much given recent events), but rather finding a suitable steward for the community.

I found myself in the same exact position with Canvas/DrawQuest earlier this year. Everyone (including myself) was laid off a few months ago, but we'd hoped to keep the app running with the remaining revenue/cash-on-hand and volunteered time (cut short by a recent hack).

It sucks, but I think we'll see more of it in the coming months/year. A lot of the seed-funded apps/companies from the past few years simply won't represent later-stage venture opportunities, and may find themselves in a position where they can't raise additional capital but can keep the service afloat without the payroll overhead.

> Would it be possible, however, to take donations (cryptocurrencies?) that can be used specifically for the bounties?

I appreciate the kind gesture, but I really hate accepting donations, and to that end we haven't accepted any in ~8.5 years.

> I think it would be a very good idea for moot to bite the bullet and pay for a moderately thorough security audit of 4chan's code.

Where/who would you suggest? I'm certainly open to the idea.

> Looks like a good opportunity for an open source tool that scans a git repository for interesting/private information.

These already exist in droves, which is exactly how our Amazon credentials were found.

http://www.itnews.com.au/News/375785,aws-urges-developers-to...

> they were still committed by a dev as experienced as moot

I'm not a terribly good programmer, and have been very hands-off with 4chan's code for quite some time. I still direct development and am responsible for the servers/sysadmin tasks, but there are far more talented developers out there than I. In the case of Canvas/DrawQuest, I was 100% uninvolved on the tech side.

But again, in both cases I accept full responsibility for the breaches since ultimately it's up to the project leader to ensure these things don't happen -- even if not active on the technical side.

> I wonder how old the code was for "Mistake 2"?

Very new. It was in a once-off file that we used to quickly pull stats about reported posts, which a) shouldn't have been on a domain without HTTP auth, b) should have been deleted long ago, c) shouldn't have had a bugged auth check or injection vuln to begin with.

Good point -- frankly I'd suggest doing both (clean repo and revoke/replace the secrets). The developer in question simply overlooked the issue, and since we were busy spinning down the company, nobody else caught it.

Venture capital for a separate business/entity != money for 4chan and/or myself personally. It's incredible how so many 4channers confuse the two and have a fundamental misunderstanding of VC...

> 4chan has had a lot of beautiful code submitted by volunteers every year. It's a shame to keep it all locked up.

All of our codebase (the core application and related tools) has been closed-source from day one. Not sure what you're referring to.

The goal was to create a framework through which people could safely test and report exploits. In addition, 4chan isn't in a financial position to dole out large bounties.

That may in fact be the harbinger of the Apocalypse.

We actually implemented Facebook Connect for April Fool's back in 2010. It was a real app and posted your 4chan post(s) to your Facebook wall.

EDIT: Here's a screenshot -- http://i.imgur.com/p0peJp6.png The best part was the reviews. They were all either 1 or 5 stars. People were shocked it actually worked.

HELL HAS FROZEN OVER

Per meowface's comment, this code is ~4 years old. It's in a much better place now, but there's still a lot of room for improvement.

The vulnerability wasn't in the main application. I'll write more about it on my personal blog in the coming days (http://chrishateswriting.com).

Eh, Stripe has way larger/more high profile customers than us, but yes we've been very happy with them.

We've been using Adzerk on 4chan for the past year and it's been a Godsend. We'd previously been using our own in-house rotation that had minimal reporting because every third-party we'd used in the past either a) fell over under load, b) was extremely expensive, or c) had a restrictive ToS.

I know this feeling. One-man bands are especially prone to "Valve time." On 4chan, "soon" basically means "anywhere between an hour from now and never."

Thanks Dan!

HN mods should probably update the submission URL to this one: http://blog.4chan.org/post/81896300203/webm-support-on-4chan

And you need to disable HTTPS Everywhere for blog.4chan.org since Tumblr doesn't support HTTPS :(

Not instead of, but in addition to: http://blog.4chan.org/post/81891220996/reintroducing-the-4ch...

We already send the proper MIME type:

  Content-Type: video/webm

We don't have the resources to support transcoding, and since so much of our userbase is on browsers that support it I don't think we would regardless.

Tumblr doesn't support HTTPS, unfortunately. HTTPS Everywhere will need to update the 4chan config to account for it.