nfm

Being able to clearly describe a problem and work with the AI to design a solution, prioritise what to put the AI to work on, set up good harnesses so the quality of the output is kept high, figure out what parallelises well and what’s going to set off agents that are stepping on each others toes… all of this needs experience and judgement and delegation and project organisation skills.

AI is supercharging tech leads. Beginners might be able to skill up faster, but they’re not getting the same results.

ChatGPT is a great product, but the lack of stickiness comes into play because there are many viable alternatives.

They’re all going to have to monetise the consumer segment at some stage, and I think that’s likely to be via ads on a freemium tier in most instances.

What if you were able to get helpful support, 24/7/365, with no time waiting in a queue, in your own language (regardless of the service provider's location and 'native' language support)? And the company was able to provide the product and support for it cheaper, resulting in less cost to you?

We're far from there, but I expect it'll happen.

This can be very distracting if you’re pursuing it intentionally and treating ‘going viral’ as a prerequisite to success.

The value I get from copilot is the ability to code faster, not the ability to code.

Today they have announced further, related vulnerabilities, and if you're running your own instance you should patch again, or disable your instance until you have a chance to do so.

The vulnerabilities allow an unauthenticated attacker to run arbitrary commands with the same privileges as the Metabase server on the server you are running Metabase on. This would allow arbitrary querying of any database that Metabase is connected to.

> pg_dump is a utility for backing up a PostgreSQL database. It makes consistent backups even if the database is being used concurrently.

Hey HN, Nick here, CTO and co-founder at UsabilityHub.

We're looking to hire a couple of engineers, with some flexibility on seniority level. We're a remote first and cross functional team, and UsabilityHub is a bootstrapped and successful business that's been focused on sustainable growth over the last ten years.

The team is small, close knit, and has some really excellent engineers and designers. The focus of these roles is building new customer facing functionality - we're effectively building three new products this year so there's lots of greenfields work to do.

The big pieces of our tech stack are Ruby, Rails, Typescript, Postgres. We're not fussy if you haven't used some or any of those, but prefer T-shaped developers that are keen and able to pick new things up quickly and contribute throughout the stack.

For the three roles we have open, starting compensation ranges from $120k AUD to $160k AUD (or NZD equivalents) plus ESOP and profit share. We review this every six months and adjust upwards based on performance in the role.

There's lots more info about these specific roles on our careers page at https://usabilityhub.com/careers. Feel free to reach out to me directly with any questions (email is in profile).

Some kind of concurrency bug in a library they were using to retrieve cached data from Redis led to this leak.

> We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user’s chat history. It’s also possible that the first message of a newly-created conversation was visible in someone else’s chat history if both users were active around the same time.

If Twilio cops an unexpectedly high settlement for sending an SMS to +1234567890 in January, can they assume that a separate customer sending an SMS to that number in February will end up in the same boat?

I'd be very surprised if the toll fraudsters weren't using the same numbers to hit multiple Twilio accounts.

They know how much to bill the customer, so they must know how much it costs to send to a number.

I'm not sure that's right. There's a strong link between performance and repeat usage. Even in the complete absence of competition, Google search being fast could result in more searches per user being conducted and more revenue as a result.

> Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.

They correctly authenticated the attacker and checked they were authorised to upload a new version of their own package, but a malicious payload allowed the attacker to then upload a new version of a completely unrelated package that they weren't authorised for. Ouch!

All that to say the allowed timeline might be longer than you expect (or desire)!

Historically those markets have been localised due to the fact that few companies employed full time remote team members, and relocating countries is intentionally made difficult and expensive.

If we see a sustained transition where a significant percentage of companies (even in just particular industries) support full time remote work, we should expect to see supply and demand for talent in that market to become less localised (time zones are still a thing, and full time remote is different to full time remote _and_ distributed).

If that plays out, you'd expect locations with historically lower compensation to get a bump (regardless of cost of living), and locations with historical higher compensation to get a reduction (again, regardless of cost of living).

Companies don't care what your expenses are per se. The valley is an intensely competitive hiring market which forces up compensation, which in turn forces up cost of living - housing supply is very finite and many people living there have lots of disposable income.

I'm ok with paying for services like this that provide loads of value. I expect there's increasing diversity in terms of Stripe's customer base and how they use the product, and trying to pick a single percentage price point that works across all of them is no longer feasible.

That said, I'm quite unhappy with Stripe's pricing as an AU customer. We're paying exorbitant rates to convert USD to AUD (think retail bank rates despite transacting multiple millions a year, ~3x what we'd pay Transferwise). There's no option to settle in USD, and a lot of our expenses are in USD, so we then pay another currency conversion fee when we spend.

It's problematic to the extent that we're considering whether the ongoing costs and hassle of setting up a US entity, dealing with international tax, compliance, parent companies etc. would be worthwhile.

UsabilityHub is hiring senior engineers to join our team in Melbourne. If you’re not familiar, we help businesses (including Amazon, NASA, and Reddit) be more human-centered by making user research easy to conduct and fun to participate in.

We’re a bootstrapped, profitable, and sustainable company, with a focus on building great products, not chasing growth for the sake of it.

Ideally you’re a generalist who is capable across back-end (Ruby, Rails, Postgres) and front-end (Typescript, React, Redux, Webpack), but if you specialize in one area and are still getting up to speed in the other, don’t let that dissuade you from applying. It’s more meaningful to us that you’re a great developer and a keen learner.

We’re offering…

- Competitive salary

- Employee profit sharing

- Choice of working 4 day week, 9 day fortnight or full-time hours

- Flexibility around working from home

- Generous paid parental leave (14 wks primary / 6 wks secondary)

- Warm, friendly and relaxed team

For more info, and to apply, see the full job listing: https://usabilityhub.com/careers/senior-fullstack-engineer