Hacker News: kevinr

Practical Threat Modeling for SaaS Software Engineers (and Friends)

kevinr — Thu, 03 Jan 2019 01:34:35 +0000

Article URL: https://increment.com/security/approachable-threat-modeling/

Comments URL: https://news.ycombinator.com/item?id=18812071

Points: 3

# Comments: 0

New comment by kevinr in "Stripe has frozen Gab.com's account"

kevinr — Thu, 04 Oct 2018 01:51:20 +0000

Start a nudes pinterest. Lmk how it goes

New comment by kevinr in "Stripe has frozen Gab.com's account"

kevinr — Thu, 04 Oct 2018 01:46:44 +0000

> If you are looking to subscribe to other profiles you will need to add a payment card. When adding a payment card, your card information is stored by a payment processor, which is called Stripe; or if you are subscribing to a profile containing sexually explicit content, your card information is stored by a different payment processor, Securion Pay.

https://onlyfans.com/terms/

New comment by kevinr in "Stripe has frozen Gab.com's account"

kevinr — Thu, 04 Oct 2018 01:44:43 +0000

Try following any of those links now, you fucking tease

New comment by kevinr in "Stripe Is Now a $20B Company"

kevinr — Thu, 27 Sep 2018 06:52:15 +0000

> [I]t's clear that the top 10% of companies make up the overwhelming majority of their portfolio. So they go for moonshots.

You've just described the entire business model of every Silicon Valley VC firm, not just YC.

New comment by kevinr in "GDPR for lazy people: Block all European users with Cloudflare Workers"

kevinr — Fri, 25 May 2018 22:37:10 +0000

It depends on the law. In the case of the GDPR, it does apply despite the person not being physically in the EU.

New comment by kevinr in "GDPR for lazy people: Block all European users with Cloudflare Workers"

kevinr — Fri, 25 May 2018 22:21:47 +0000

There's one very important problem with this approach: this blocks people from accessing your site who are doing so from the EU, whereas the GDPR applies to EU citizens, wherever they access the Internet from.

In other words, an EU citizen residing in and accessing the Internet from the US has just as much right to invoke the GDPR with these sites as an EU citizen residing in and accessing the Internet from the EU. Blocking people accessing your site from the EU does not allow your site to not respond to such requests.

New comment by kevinr in "From Java to Kotlin and Back Again"

kevinr — Wed, 23 May 2018 23:28:57 +0000

This is a really useful article. What I really want is Java-minus-Oracle, and it sounded from some of the chatter around Kotlin like it might be that, but it seems what I really want is Groovy.

New comment by kevinr in "New Number Systems Seek Their Lost Primes"

kevinr — Tue, 21 Nov 2017 09:55:10 +0000

What a missed opportunity, not to title this article "In Search of Lost Primes".

(inb4 all the Proust fans downmod me to oblivion)

New comment by kevinr in "An engineer’s guide to cloud capacity planning"

kevinr — Wed, 08 Nov 2017 22:14:10 +0000

It's not coincidental; I believe the 'sole application' the author talks about was in fact an online game.

New comment by kevinr in "Netflix Employees Are Happier with Their Job Than Facebook or Google Employees"

kevinr — Thu, 02 Nov 2017 08:23:34 +0000

Netflix explicitly have a policy of trying to pay the best in the industry, as I was told when I interviewed there. Turns out it works!

New comment by kevinr in "Netflix Employees Are Happier with Their Job Than Facebook or Google Employees"

kevinr — Thu, 02 Nov 2017 08:22:32 +0000

Recognizing both expenses and revenue over time is part of generally accepted accounting practices (GAAP).

Intuitionistically, it makes total sense that you get a clearer picture of the true state of the finances of Netflix as a going concern if they recognize the costs of a show on their balance sheet over five years when they expect subscribers to still be watching it for the first (or second, or third) time several years on.

New comment by kevinr in "Netflix Employees Are Happier with Their Job Than Facebook or Google Employees"

kevinr — Thu, 02 Nov 2017 08:17:51 +0000

The hed is a little misleading---what is meant by happiness in the article itself is that Netflix employees more likely feel they're compensated fairly and aren't looking for other jobs.

That is, however, really nice confirmation that Netflix does in fact live what I was told when I interviewed there, that Netflix prides itself on offering the best comp package in industry. (They followed that by casually offering to more than triple my salary, so I had some inkling they weren't just making that up, but it's easy to write off one data point in a high-demand field as an anomaly.)

I'm most impressed that Amazon is doing as well as it is in those rankings, given how much shit they've gotten in the press over the last few years.

New comment by kevinr in "Procedurally generated electronic music"

kevinr — Sun, 29 Oct 2017 10:05:28 +0000

Oh this is very cool. The structure reminds me of Matthew Brown's "Music for Shuffle" project: http://musicforshuffle.com/2014/04/06/session1/

New comment by kevinr in "WePay's (YC S09) next chapter"

kevinr — Wed, 18 Oct 2017 03:34:06 +0000

Zelle is not really the same thing as what WePay does. Zelle is peer-to-peer payments, competitive with Paypal, Square Cash, Venmo, etc. (P2P is a term of art in the industry; it's not P2P in the Bittorrent sense. :)

WePay is about providing payments infrastructure to marketplaces and crowdfunding platforms (Lyft, GoFundMe, etc.). WePay are competitive with Stripe's Connect product (disclaimer: my employer). Braintree and Adyen also have similar products.

Congrats to the WePay folks. I hope this new chapter works out well for them!

New comment by kevinr in "Questions to ask in interviews"

kevinr — Tue, 17 Oct 2017 00:49:19 +0000

So few companies are clear about it in their hiring processes, and therefore wind up hiring for all sorts of skills which have at best weak bearing on actual job performance in most roles (eg. brain teaser memorization) that the answer is, empirically, yes.

New comment by kevinr in "The Long-Term Stock Exchange Is Worth a Shot"

kevinr — Tue, 17 Oct 2017 00:46:31 +0000

I think it's all going to depend on how the tenure mechanism is implemented. There's got to be some way for new money to "catch up" to old money within some reasonable time horizon, say 10 years, rather than old money's voting power growing unbounded.

New comment by kevinr in "Questions to ask in interviews"

kevinr — Fri, 13 Oct 2017 23:53:15 +0000

Does your concern about an interviewer misinterpreting the intent of the question change if the asker presents as a white man?

New comment by kevinr in "Questions to ask in interviews"

kevinr — Fri, 13 Oct 2017 23:50:00 +0000

It's going to depend a lot on the individual interviewer how well they can answer that question. If recruiting and the hiring manager don't both have good answers to that question, though, that's a big red flag.

New comment by kevinr in "Questions to ask in interviews"

kevinr — Fri, 13 Oct 2017 23:46:54 +0000

Companies above garage size literally employ people to answer candidate questions. If the company hasn't invested the time to answer "What are you trying to figure out about a candidate in an interview?" and its recruiters don't have a simple, objective answer, they should stop interviewing and go answer that before they start again.

A simple answer is something like, "We want to figure out whether a candidate can do the work we need them to do. We do that by giving candidates sample work problems which are streamlined versions of problems we've actually solved at the company in the past. People we hire are more likely to still be employed with us than they are at our competitors after a year. We know we don't hire enough women and URMs into technical roles, and we're instituting a rule that at least one woman or URM candidate needs to be interviewed for each open role."