skysight-inc/HackerNews huggingface dataset:
Ask HN: How should a startup without a lot of money pay bug bounty rewards?
I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K MRR, < 50 customers).

Recently a security researcher contacted us about a few vulnerabilities. I told them we don't have an official bounty program, but we're willing to compensate. I said that Slack's program could be a guide of how we could pay (it really depends on the issue and the impact/risk to our business).

They reported an issue for an IDOR attack that allowed any authenticated attacker to "disable" any user in our application. Disabling a user in our application just sets a flag that they can't log in. This attack doesn't disclose any information, and is easily reversible. Right now, we believe that the actual business impact/risk is very low (since it can be reversed and doesn't expose customer data). We fixed this vulnerability immediately. The security researcher was very pushy with their expected reward in their initial report. They quoted $15000 for an IDOR attack on Uber, and $1500 from Slack. I responded and said we're going to internally discuss the reward because we feel the impact is low. They sent a response saying how critical this issue is and how it can cause havoc on our business. English isn't this person's first language (and the reports are dramatic/low quality in terms of communication), but I've cut through that and only focused on the business impact (not the report/reporter).

We want to encourage vulnerability reports and we want to reward/compensate reporters with market rates. However, we don't have a lot of money since we're a startup without any investment. I'm having a larger internal struggle of compensating for vulnerabilities vs being out of jobs because our money is going to payouts for vulnerabilities.

Right now, I'm in the mindset of "pay what we feel it's worth to the business" (which is probably less than $500). How do other startups without a lot of cash handle this?
Slightly related - there's weird (probably unfounded) suspicions around gold stored in the US on behalf of some countries. May or may not have led to things like Germany repatriating its gold reserves: http://www.zerohedge.com/news/2017-02-09/bundesbank-has-comp...
Oops, right. I'm counting the number of states wrong. But the general point stands, you'll see everyone hit the maximum amount of money possible for one individual.
Has anyone tried https://storj.io/ "Decentralized storage based on the blockchain" ?
> I'm an American and I understand too. We are living through the decades where America gave away its leadership in the world. We can't get anything accomplished at a reasonable price in reasonable time

It's not that we can't get it accomplished reasonably, you'd be amazed at how fast and cheaply major projects can be developed if funding is properly structured. It's rather that we've wasted our treasure on other things. Jack Ma had an interesting comment at Davos[1] - what would the US be like if we had spent the $14 trillion we've wasted on war and wall street bailouts on infrastructure, research, and education in the Midwest?

[1] http://www.cnbc.com/2017/01/18/chinese-billionaire-jack-ma-s...
I'm not sure that counting gay porn searches (example they gave in the article) is a reliable indicator of whether the seeker is gay. This may be TMI for HN but once in a while I (a straight male with zero attraction to men ever) have searched for and "enjoyed" gay porn.

I was curious about this phenomenon and found many forum posts where straight guys say they've watched gay porn.
Yeah, I've seen it. The overhead for making it work is definitely a tad on the high side (through no fault of the devs that make it). Either way it's really swell though.
How about "old people"?
The physical book comparison is interesting. Imagine there would be a way to publish physical books with DRM that all publishers would embrace. You open such a book without authorization and it's all gibberish. To read it you would need to have bought a special strip that you lay over the pages in order to read (don't matter the technical aspect, it's gedanken-experiment so let's consider such a strip magic for now). You buy this strip and enter a user agreement to only use it for yourself (you are not allowed to lend it - even to your children), it could easily be reverse-engineered but no-one would do it because that would be a felony.

No sane person would agree to such state of affairs but somehow now because our books are digital it's all off a sudden okay with almost everyone?
So you pay a little more than 2x as much to have a car that is 5 years old at most, vs forever having a 15 years old car. Sounds alright if you have the income for that.
Google Analytics Logger: An Open Source WebExtension for debugging analytics
> In 2015, women held just 25 percent of computing jobs, according to the National Center for Women & Technology. Start-ups are even less diverse. According to data from PitchBook, just 16.8 percent of U.S. companies funded last year had at least one female founder.

This can't be far from how many females have studied computer science. Not that this is the only way to get "computing jobs", but it says a lot about the wider trend. I think I had 0-4 females present in my computer-oriented nonobligatory classes.
Lately, I wanted to buy an eBook. I usually buy prints, but this time I needed it as soon as possible.

Upon searching, every book store told me, I would need to install some Adobe stuff on my computer to read the file. I am neither a fan of Adobe nor of the idea of being locked in to an application to view a book. After realizing that there is no other digital way, I simply bought the printed version and waited the two days it took to ship.

It's a very frustrating situation for someone who just wants to read something.
I guess what sounds authoritative is that I'm using jargon while trying to explain the jargon at the same time, as if I knew what I was talking about. I've since edited my comment. I know it's stars and bars, but I keep messing up the count. Anyway, it's a finite amount, it's not huge, and your count is wrong too by a sister comment. :-)
Chrome dev tools layout management with goldenlayout
Another data point confirming your 1% as in line with seller's agent additional effort in handling buyer-side paperwork, communication et al. I just sold through a discount broker, independent and therefore free to set his own rates. His fee for buyers without their own agents: 1%. This was in Mountain View, California.
The Disastrous Fyre Festival May Have Wrecked It for Everyone
Buying no car is the best choice. From environmental perspective.
I don't think this is the problem most people address.
Those are awful enough, but they are not landmines.
It is impossible to eliminate an idea or culture save by the most extreme measures. What we'd like to do is start remdining everyone going to work and going to fund that they have a responsibility to push back against and avoid funding this culture.
i'll need to interview some talented women before this is an issue.
Yes; because it's mentioned in the article:

> Both the Verdi framework and our verified Raft implementation are open-source. Please feel free to submit comments, issues, and pull requests on either repository.

[1] https://github.com/uwplse/verdi-raft
I grew up in a family that did the "buy used cars keep until the repairs got too expensive" thing. We spent a tremendous amount of time at mechanics, paying lots of money for repairs that may not have even been needed, and then selling or trading in the piles of junk to repeat. I remember many times waiting for tow trucks by the side of a highway or out in the middle of nowhere to come tow one of our cars. I made a list one time and I believe my family has owned at least 20 different vehicles this way.

Thus conditioned, the idea to me of buying a used anything and keeping it for 10 years sounds like a recipe for answering the Ship of Theseus thought experiment.

When I first struck out on my own, I had a used, but good condition Toyota that a year later had $3500 worth of engine trouble that ended up costing me a job. I finally swore never again.

After that Toyota, I bought a brand new, small, car for $12k with the highest reliability I could find and kept it for over a decade. It required exactly one repair to an O2 sensor after 10 years. Being small and commodity, maintenance was cheap (a set of four new tires ran under $350). One day, 12 years in, the engine conked out and the repair was estimated at $500. The car was still worth $5k. I made a deal with the mechanic and he bought it for $4k.

Considering that the cost to "buy" the car was about $8k, maintenance was cheap, and fuel efficiency was high, the car cost pennies per mile to drive over its life with me.

I've since bought another reasonably priced new car that I fully expect to drive for another 10-12 years. And my family, after seeing my experience with proper cars has also cried uncle and now only buys new, reliable, cars. My father can't believe that he doesn't even know a mechanic anymore, whereas he used to spend significant time cultivating relationships with "good" mechanics to deal with repairs. Hundreds of dollars a year used to go into towing fees, and thousands were lost to lost work or other opportunities when a vehicle was down and being worked on or to rental fees so we could still get around.

I know that its possible to get a highly reliable used vehicle, but honestly, its impossible to know what a used car has gone through before it ends up in your hands.
In the USA, in my experience, older cars are always cheaper to insure. Also you can often reasonably drop the collision coverage.
The main thing preventing me from using Clojure on the backend has been that db libs (pgsql, mysql) seem to not be under particularly active maintenance/development, which also feels at least somewhat true for other libs in the ecosystem. HugSQL as recommended by Luminus hasn't seen any development in the last year. What's been your experience here?
Using https://golden-layout.com/
Both these statements can be true and informative. Why do state it as an alternative?
The difference is it's a noticeably sexist statement disguised as non-sexist.

Would you argue that your statement "racist workplaces keep talented minorities out" is equal to "white workplaces keep talented minorities out?"

There is a difference between an argument against "bro culture" and an argument against "sexist culture" -- one is neutral whereas the other is clearly anti-male.
no, they'll just flat out not hire men.
"Availability of tutorials" vs. "searches for tutorials" doesn't affect the point. It's still selecting a subset of programmers. While it's somewhat useful as a leading indicator of popularity over the next couple of years, it's less so w.r.t. either the present or the further future. I'm not saying it has no value at all, but it's not clearly a substitute - let alone a superior substitute - for surveys that measure other things.
Admittedly I'm reading between the lines here, but I suspect that these don't need computationally expensive reconstruction. The reconstruction is done entirely by setting up the delays correctly on the input sensors, then the image is formed by simple interference. You'd read the image off just like an ordinary ccd.
Sounds great! Feel free to adapt this to your usecase, if useful: https://github.com/yesbabyyes/tfidf
>because if you were really super-super-capable you would have alredy found another job, another field, etc. and be successful at it.

Job markets aren't efficient at matching supply to demand. Trying different opportunities takes a large amount of time. I can't hit up construction, IT, healthcare, physics, retail, banking, and academic industries in a week to find out if I'm cut out for at least one of them.
To me, it says you can get a hiring advantage by avoiding the image of a "bro" culture.
Yes, for AI, it really is all about the data
> We wouldn't be questioning something like: "racist workplaces keep talented minorities out."

This seems like a given, but a vile and vocal minority of people here do indeed question that.
Men are the least sexist just as white people are the least racist, from my observations at least. I think this comes from the spotlight being cast on white males, giving everyone else no reason to reflect upon their own behaviour. Also, if you constantly hear about how bad whites and males are, you probably just accept it as indisputable truth.
“Ransomware’s stranger-than-fiction origin story.”
Yes.

http://www.huffingtonpost.ca/entry/mans-suing-yahoo-for-gend...

But men told to shut and and man-up
Because it is interesting enough to be upoted, relevant to the industry, relevant to a business, and newsworthy.

Why wouldn't it be? What kind of political agenda do you bring here that would demand we not talk about it?
In practical terms, copyright-free software would be "viral": you would be free to redistribute under the same (lack of) terms that you received the software under. There would be no mechanism for things like tying source to binaries or the anti-Tivoization terms, but those aren't defining aspects of copyleft.

I'm not sure what "share publicly" has to do with anything. GPL doesn't apply until you do share the software, and even then doesn't require you to do anything publicly.
Nukes make large scale warfare between superpowers much less likely.

Nukes can also diescalate any situation between superpowers before it blows into a full out war.

I'm not entirely sure that complete disarmament would actually benefit the world as a whole.

Also at thisn point disarmament is pointless you can't disarm physics and knowledge any nuclear capable country would be able to rebuild a tactically significant arsenal within a span of 2 years or even at a much shorter period if they poses either large stockpiles of nuclear fuel or have sufficiently large production capabilities.

This is nothing more than posturing.
Given the relatively low entry costs to create a technology company, what's stopping the talented women from starting their own companies and competing with a superior product or service? It's sad to say this, but at the end of the day, you comply or you compete [1]

[1] To be fair, women (and minorities for that matter) have tried and "the forces that be" sabotaged them. For example:

https://en.wikipedia.org/wiki/Greenwood,_Tulsa
But that's a 30-year old Volvo, no? In 2017, buying a 10 year old car would mean getting that Renault.
Things have gotten much more mature in the past few years.

Check out edwardlib.org which is adapting Tensorflow to support probabilistic modeling (with a heavy focus on variational inference, less so on MCMC methods). If you’ve got trillions of observations you can use stochastic VI. And tensorflow now can do distributed computation graphs, or you could just go data parallel and then average your parameters at the end.

In general David Blei’s group at Columbia does a lot of work in scalable probabilistic inference.

The other big option is of course Stan, which is really well optimized but I don’t think is particularly intended for “big data” of this kind. If you have “medium data” that fits on one machine though, it’s blazing fast.
I think in all of the years I've been around startups and the valley I have seen maybe one company that actually fits the description of "Bro Culture."
Now invent a tax rule that brings back the equality. And simulate it.

And then simulate how this tax rule works in a capitalist market model.

I'm curious.
I agree with your point. :-)

Why is my solution incorrect, though?

* Oh, I see why my solution is wrong. It's never the case that one person has all the money. I should take some of my own advice.
Visual C++, if I am not mistaken it was introduced on VS 2015.
Apple iPhone 8 Rumours – New iPhone 8 Specifications Details
She's confused. Startups are the Wild West of America. Wild West comes with Wild West rules. The rules are simple:

1) The loudest ones get heard

2) The most ruthless get some combination of (fear + respect)

3) Those from a combination of (1 and 2) get funded

4) A fraction of (3) succeed, and a fraction of those does phenomenally well.

5) Everyone else in a pool will murder to be (4)

6) When (4) for some reason stops performing as (4) is supposed to perform, it becomes not "Jack is drunk at work again but we are exiting soon and I will be multi-hundred millionaire so I'm just going to figure out how not to piss off Jack as he is my payday" but "That drunk Jack pissed off a big customer by hitting on his wife and now he is hitting on me and I'm just not paid enough to deal with his shit" That's when the cracks start showing. That's when the "culture" becomes not a culture of "we win rararara!" but "these people are behaving like frat boys!"
We saw this at Zenefits. We see that at Uber.

We are starting to see it at Tesla.

AirBNB is going to be next - there are already grubmings about its "culture"

[Edit: Formatting]
>> Finally: don't use JWT. JWT terrifies me, and it terrifies all the crypto engineers I know. As a security standard, it is a series of own-goals foreseeable even 10 years ago based on the history of crypto standard vulnerabilities. Almost every application I've seen that uses JWT would be better off with simple bearer tokens.

This is really surprising to me. I use Play! framework and the whole play framework community suggests to use JWT for authentications as Play! doesn't support sessions out of the box. Is it just JWT itself is bad or how developers use it is bad? Just a noob question.
I don't really understand why the culture of some companies is something that needs to be fixed. As long as there's nothing illegal going on (like harassment), then what difference does it make from the outside whether a company has a toxic environment?

If women don't want to work at those companies, that's fine.

I'm not a woman, but I don't want to work at those companies either, and that's fine too.

Is there anything stopping 'sis culture' companies from being formed and dominated by women?

Or companies dominated by people who make everything about video games or sports or chess or cosmetics.

Some of these companies will succeed, most will fail. As long as no one's getting harassed, why should we force them to have this culture or that one?
Many people told me to go to meetups. I know I must do this, but what pushes me back is that I have lack of social skills. I am trying to overcome this and I am planning to join an iOS group that I just found online.

I will send you my resume. Thank you!
This problem lead to the discovery of Quantum physics.
Simply replace the $1 with energy quantums.

https://www.youtube.com/watch?v=SCUnoxJ5pho&feature=youtu.be...
In the same vein, I was recently working on a web app with a path at /advertisers, and discovered that ad blockers were preventing any AJAX requests to resources in that path. You might think twice before naming your paths to something containing the word 'advert'.
Heal App – On-Demand Physician House Calls
East German Security (Stasi) Training Film on Clandestine Apartment Search 1984
Have you not been reading the reports of "bro investors"? It could be, in part, the parallel of talented women getting tired of potential investors hitting on them and acting creepy.
How about purchasing a car that's only say 1 or 2 years old? I read that cars drop massively in value as soon as you drive out of the showroom because it's no longer "brand new".
Googled it and found this quote: "On average, a new car will lose as much as 19 percent of its value in its first year of ownership. That means that your $20,000 new car will be worth about $16,200 after just one year."
My only concern with DRM in browser is that, as far as I understand the technology, any website can put a small piece of arbitrary DRM content and your browser will send information to that website uniq to your device, and your device will be tracked by DRM providers and probably also by that website.

Firefox gives you the option to disable DRM in the settings. Chrome also has it but it is buried deeply in advanced settings. Safari does not seem to have it at all.
> Whether a business still makes money is not an argument as to whether torrenting their stuff would be OK.

But it should be in whether or not we spend lots of resources in helping them to increase their profits further.

> A physical business (e.g. clothes store) might make millions even though people steal stuff, but we wouldn't consider that as making stealing OK.

But at the same time we also don't attempt to prevent all theft, right? I mean, we absolutely could take tax money and have police officers strip you naked whenever you leave some store to make sure that thefts don't happen. We don't. Why not?
Believe me, I understand how this looks. To answer your questions:

- Yes, early storj employees were given tokens on a schedule related to achieving certain milestones

- Yes, when I felt it was appropriate for my own future, I sold those tokens

- Yes, not long after I sold, I (and others) left

- No, my intent was not to slander, but simply to explain why I have disappeared from the community and why core development has slowed

- Yes I forked a free software project and our hackerspace is providing what's called a "comprehensive sponsorship" which in no way risks 501c3 status

My goal has always been to create a great project and never to harm Storj Labs. Though, admittedly, given the circumstances I understand how it might appear that way. Because of that, can we not turn this thread into what happened on Reddit?
Please don't indent quoted material. It's unreadable on mobile browsers due to the horizontal scrolling.
What about bro culture in plumbing and sanitation, does that keep women out? Or maybe the fact that women in progressive free countries have to choice to choose a career path they might actually be interested in?

That's why the 25% stat is bullshit. I'm not denying bro culture is a problem, but its not the complete reason why there is a low adoption rate.
A question for those who've used TensorFlow on NVIDIA GPUs:

What range of GPU performance do you see? As in, if the card does 10 TFLOPS peak, does TensorFlow manage to reach that peak, or is it at 5% or 20% or some other percent of peak typically?

And are there expectations for Googles new generation TPU? What range of peak performance do people expect to get?
7-Eleven will soon sell Soylent
Which would mean that much much less of it would get done, which is not a clear win.
Silicon Valley startups are the next frontier for the class of paper pushers, compliance officers, and diversity officers that are dragging down the rest of America. Them and others who want to turn every institution away from its natural purpose and into a vehicle for their political ends. They're already floating gender and race quotas as serious proposals.
I have read those reports, but you don't necessarily need investors to start a company.
Just because a business model (e.g. retail sales) is so prevalent as to be invisible as such, and laws that enable it seem like natural laws or obvious for the common good, doesn't mean it's not a business model like any other. Just that some are unable to see it as such.

There has been criticism of the prevalent model too (e.g. from the "property is theft" type to money-less sharing communities etc).
Did the analysis include a buildup of defensive weapons? There was a school of thought that building up that stuff was a necessary prerequisite for eliminating nuclear weapons and I think it was because it ameliorated the risks involved with the "leap of faith." (and replaced it with risks of its own)
The extensive library of browser extensions on Chrome is one major advantage.
Fair enough.

The disproportionate effect DRM has on paying customers doesn't seem to be obscure or difficult to think about though.