DoubleMalt

Not that I am envious for the karma, but I wonder why this was not merged into my exactly identical submission 1 hour earlier (https://news.ycombinator.com/item?id=5749969) -- afaict there was no ?repost or similar stunt ...

You don't honour your choice of nickname very well.

In the case of AirBnB, you want to restrict a system that reduces inefficiencies in the allocation of living space on the base of nebulous fears, giving authority to prosecute victimless crimes to the government?

I disagree.

Big Mistake!

After a couple of weeks at the Helldesk he will inevitably turn against humanity!

Judgement Day is near!

Another proof of the fact that security questions are a really bad idea.

I'd rather have to go through some manual time intensive procedure in the unlikely instance of losing access to my password safe, instead of opening myself that wide to social engineering.

There is one important rule all good poker players must learn:

It is never too late to fold.

Whatever your investment was, consider it lost. The experiences you gathered getting the stuff done are all you gained and nobody can take that away.

An ultimatum might give you the opportunity to negotiate rights to the assets you created during your work (If there is no formal incorporation yet you might own the stuff anyway).

I'm sure you'll find something worth your energy! Good Luck!

Can I fork microha.us on github?

No seriously, I am currently thinking about renting office space, and this seems to be a great idea so I will think about using it for a microha.us session at the beginning.

Of course the requirement exists for all SaaS providers. But while a break in on Evernote reveals my notes (which would be bad, but not lethal), a break in at bastio might compromise the servers where I host my SaaS products, triggering a very nasty chain reaction.

So while the risk you face may be the same, the damage that can be done is vastly greater. But I'm sure you're aware of that.

Assuming someone gains root level access to one of the boxes bastio is hosted on, then he could

1a. block all outgoing traffic from the server except for the service (to avoid alarms getting through) or 1b. replay the heartbeat sent by the server 2. retrieve the database 3. Sniff on all incoming traffic for the HttpOnly Cookies

The worst thing is you might not even know which customers' keys are compromised.

I'm sure you are thoughtful about security, but of course you are a great target because of the valuable loot (root access lot's of other servers)

A lot of your concerns are considerations for me too as I am thinking of launching a distributed SaaS. Just take it as input to your threat analysis :)

So there are less than 100 reports of interference of radio devices with planes. And then there is the study where 30% of the people said they do not turn off their devices.

The probability that something happens is minuscule, but above zero.

Other examples where the trade off between security and convenience has to be made is the driving of cars and liquids on a plane. I'm really curious in which direction this debate will swing. (FTR: I'm all for convenience ;) )

That is better but not good enough. If your servers were compromised, that attacker could add JS code to your page that quietly farms that facets that are securly stored in the browser, when the user logs in.

Makes it harder against a targeted attack, but does nothing for the average user.

You can mitigate the problem by having a really good intrusion detection system, but not eliminate it.

When I came to Vienna, the big city, being a slightly awkward nerd, it took serious adjustment to the fact that all male/female and female/female greetings of people that know each other fairly well involved cheek kissing (twice, starting with the right cheeks).

But I got used to it, and even learned different forms (twice, starting left - dunno where high chance for funny misunderstandings, thrice, starting right - Serbia iirc).

I greet everybody with a Handshake when I meet them the first time but can say the most universal rule is just to be relaxed about it.

People that are so uptight to have a bias against someone where the first greeting results into some awkwardness through cultural differences (where cultural differences cann also easily occur even within the same city), is not someone I want to be acquainted most of the time.

Contrary I even find a little misunderstanding about greeting protocol on a first meeting being a good ice breaker.

For business purposes I would of course always plead for erring on the conservative side ;) handshakes work well most of the time.

Sorry, but this sets off my bullshit detector. If someone compromises your server he also has access to the routines decrypting the ssh keys. How do you encrypt them?

How about patents? I remember having read that IBM holds patents for homomorphic encryption. Does the open sourcing also include a royalty free license to IBMs patents?

EDIT: Just saw GPL2 or later, so choosing GPL3 would mean patent license included, right?

In times of widespread face recognition software this might prove futile ... and raise even more suspicions.

I had to refresh the page after cleaning the cookies and before the login, too.

For me too.

Can someone proficient in French provide a tl;dr?

I have been thinking about renting a server from then so this interests me greatly.

Doubtless. But never estimate the power of sane defaults.

File based locking. If you want to write something to the database file and something else is writing there (User stats, logs, new blog), the database just gives you an error instead of a database connection.

I went for a pretty tiny install of a webapp with SQLite, figuring being the only user, what can go wrong, but had to migrate to postgres pretty soon because I kept getting errors when my actions clashed with one of the background task (that ran every 15 minutes).

Unrelated.

Nice project, but I d think SQlite will not cut it. Not even in the short run.

Other than that, definitely an interesting project.

Google search terms could also predict a completely random time series. You just have to pick the right search terms.

If you look at enough words the chances, that some of them have predictive value approaches 100%.

That kafkaesk mess just makes the business case more compelling.

The $60 were meant with the inexpensive verification step. Then the number of wildcard certificates is not limited.

You can get unlimited *.domain.tld certificates from StartSSL after inexpensive verfication step. But don't tell anyone.

More like 6 Million strikes ;)

I did not see it mentioned except in the copy for the free trial: Are your servers at UpCloud all equipped with SSDs?

Resulting at higher prices for almost all use cases than this and DigitalOcean ...

Great post. It's a trap I tend fall into myself far to often. And it's the same direction as DHH's famous rant about winning in Vegas.

It's a virtue too rarely seen, that you should try to solve a problem with the minimal set of code possible.

Everything should be as simple as possible., but not simpler. (Sometimes attributed to Albert Einstein, even if he probably never uttered the exact words)

Drop me a mail if you're interested in working on visionary products.

Great! Sorry for not checking.