Hacker News Reader

Comment by thaumaturgy | Hacker News Reader

For those commenting on the price, I'd point out that if you're a consultant or freelance developer you should be able to justify adjusting your rates enough after this to make the $1500 back in a month or so, and if you're a salaried employee with a smart employer, you should be able to negotiate a reasonable raise or get your employer to cover the cost for you.

I operate on a shoestring budget, I'm just about the most price-sensitive guy on here, and I'm still going to do my best to scrape together the money for this.

View on HN

I think your price is reasonable for people that will get a good return from this, and not for people that won't.

I'm not going to get a raise from doing the course, and my employer is not going to pay out for it, so I'd like it to be $500. People who are going to make the money back will pay more. If you fill the seats, the price is right.

If you have no way of recouping the cost of the class, the class isn't targeted at you. The most common pricing fallacy on HN (perhaps after cost-plus pricing) is the idea that every product must be targeted at all people to make sense.

So a person that simply want to learn something for the sake of knowledge is not the target of a teacher?

Not the target of a teacher that is asking for this price. There are plenty of teachers out there that can, presumably, teach the same material just as well for probably less cost to the student, however it's not the OP's job to find those alternative sources for you.

Consider that for that price, the teacher offers his time to help students.

If the price was lower, it's likely he'd have more students; perhaps a lot more. The more students he has to deal with, the less time the teacher will have to help each one of them. On one side you've got private tutoring, where a teacher can work 100% of his time with one student, and at the other end are free MOOCs with tens of thousands of students, where the students are peer-graded and are unlikely to ever interact directly with the teacher.

While MOOCs are great for what they cost, it's pretty obviously not the same quality of education as private tutoring, or by directly interacting with a teacher. So for this class, the teacher decided the minimal level of interaction he thinks is necessary to make a high quality web security course, and decided the price so that he gets an amount of highly motivated students that he can manage with the time he has.

Counterpoint: completing the course might make you a better candidate for the kind of employer that values their employees enough to pay for training like this. ;-)

Oh I'm not complaining. 2 of my colleagues just went on security training, so I think we have enough 'security experts' right now. I'd be more likely to get an android course.

Hum, I already know most of this stuff. Maybe I should raise my rates.

Well ... know it, or done it?

I know of most of the items listed in the syllabus. I know the basic mitigation strategies. I know the principles behind most of it.

But I've never done it.

That's what's worth the money, to me: I'll be forced to sit down and dedicate some time to actually doing it, with guidance from a professional. I could easily spend more time figuring it all out on my own -- and even at my meager rates, that would add up quickly cost-wise -- and I still might end up missing something, because it's likely that there are gaps in my knowledge that I'm unaware of.

If you haven't actually practiced any of the stuff in the course, it would still be valuable.

What do you mean by "it"? Implement the attacks? No, I haven't, but I don't need to know how to implement the attacks, only the countermeasures. If you mean implement them in apps, then yes, my code had a code review from a security company last week and the most severe item was a password reset form that had autocomplete turned on still.

Maybe?

Do you mean that I should, or are you asking me why I am uncertain? If it's the former, you don't know my rates, maybe they're already too high (they're not) :p

If it's the latter, I have no answer.

I mean you should.

I'd like to raise my rates too. I'm not an expert at security by any stretch but I don't completely fail at it like ~70% of the code I inherit.

But it is difficult to figure out how to sell that. Most clients don't seem give a shit about security until they've actually lost money due to it. It's also hard to prove that my code will be any more secure than the next guy.

This is IMO one of the strong benefits of daeken's course: he's formalized it to the extent that you should be able to turn it into a selling point if you wish to do so.

Yeah, that's the prevailing viewpoint. I will raise them by quite a bit, thanks.

Reply on news.ycombinator.com