midnightmonster

Seriously? Anyone have a counter argument to go with those downvotes? I'll even take a "rtfa where they mentioned important evidence you ignored, jerk"

Your conclusion that bluehost was hacked smells of confirmation bias.

Suppose I wrote a password-guessing bot to spread my malware on PHP-based websites. To increase the effectiveness of my bot, I want to target websites where I'm more likely to be able to guess passwords, and where I'll need only a few methods of inserting my code, optimally just one. If I can figure out the username generating scheme of a large host, that helps make my bot more effective. If that host hosts only or primarily PHP sites (and not asp.net or cf or whatever), then that makes my code insertion easier.

Your evidence so far afaict: 1) you found a number of blue host sites newly affected 2) you did not find comparable numbers of sites on other hosts affected around the same time 3) the affected sites all had similar code inserted in a similar way 4) there was no single application being run on all the compromised sites

Your evidence supports the hypothesis that bluehost was hacked reasonably well, but it supports my supposition just as well. What kind of tests would actually give you reasons for preferring the bluehost hacked hypothesis? Well, if we found that a large percentage of domains hosted on a single physical server were affected, or a large percentage of consecutive customer ids, then it would look a lot more like bluehost data or systems having been compromised. But if there are no bluehost boxes with a large percentage of hacked sites (we probably can't check on customer ids), then it looks more like bluehost customers were targeted one by one by a password guessing bot. I wouldn't call that bluehost being hacked (if you do, I can see why bluehost disagree), and from what I see you don't have enough evidence to claim that bluehost has been hacked.

Sliders are nice large targets and look very touchable, but don't actually work at all on my iPad.

Yes, it is pretty easy. Just a baseline requirement for the hosting.

> I have this impression the language was designed to duplicate as much code as you possibly can

You're right about the limits of jquery, but JavaScript is not like Java inasmuch as repetitious JavaScript is a near-sure sign that you're doing it wrong. I'm working on a larger script too these days, and code organization is a problem for me, too, but repetition isn't really.

If you're having to turn down work at a comfortably livable pay rate (considering additional taxes, health insurance, etc.) for lack of time, and this is an ongoing situation, not a one time fluke, then I agree it's likely you'll be able to do just fine going freelance full time. And if your current job is approaching the end of the line, it's probably a good time to make that jump. Not worth all the energy you'd have to invest in finding another job and getting up to speed only to quit N months later.

I've been in a similar place. When my wife lost her job a couple years ago and we lost our housing (came and went with the job), I went full-time with my freelance work and became our sole income.

Think of the business entity as a form of insurance. You have to go through some hassle to set it up, and you have to maintain it at a minimal financial cost and possibly more significant paperwork time cost. If properly maintained it provides some legal protection of your personal assets if you are sued, but less than you'd think for a freelancing business. You decide whether it's worth the bother. I went ahead and did the LLC--it just seemed like a good idea to me, and it helps my brain a bit to have a separate legal entity for the business. When you get ready to actually release software, you may want to have a lawyer help you revisit your decision, whatever it was.

A separate business bank account is essential regardless of your organization you will need an EIN from the IRS. Just google for how to get one. It's free.

I use fresh books but have not found it to be really adequate for forming a solid financial picture. I'm currently using a beta version of gnu cash, but it won't be just right until I get around to enhancing it with some reports of my own.

Your tax situation will change. You will have no withholding, so you'll need to make quarterly payments. IRS interest charges are not out of line, but they can really add up over the year if you don't pay attention to this at all. Google "estimated payments safe harbor". Of course you're also going to be responsible for self-employment tax, which looks like it will be considerably more than my income tax this year. Use the google for calculators to estimate both so you know how much to be saving along the way.

Good luck, and ping me via letterblock.com if you want.

In Florida for me, both the biz bank account and the llc were extremely fast. Llc was an online form with instant results, and biz bank account just required a visit to the actual office of my credit union. I needed the llc first in order to get the bank account in that name.

Most freelancers seem to be concerned about being out of the loop if people followed this advice. I can feel that, too: IMO clients almost always benefit from the improvements I make to whatever they were planning.

But what I really wonder is how many people even could follow this advice. In the years I've been freelancing I don't think I've ever received even a single feature request that was thought out to the every click, every branch level of detail--let alone an entire application.

Which web technologies do you work with? Drop me an email or phone call. Contact information is at http://letterblock.com/ .

Dallas seemed to be a problem for mosso -> Rackspace Cloud Sites, too. Just setup a linode in Dallas for a client last week, too. I hesitated to use Dallas, but I thought surely I was being irrational. It's still probably true that I was, but dang.

For me, it's Linux support, ease of use, features, and economy.

When my little Samsung laser printer finally died, I bought an HP inkjet (OfficeJet Pro 8000 Wireless) for a bit over $100. I got home and took off all the tape, stuck in the large individual-color, separate-from-print-head ink tanks, plugged it in to power and my network, and printed the network settings page (which I turned out not to need). Then click-click-click on my Ubuntu system, and I was printing. Download driver click-click-click on my wife's macbook, and she was printing. One of the easiest setups I've ever done for network printing, and even easier on Linux than on Mac.

And it duplexes automatically.

My 6 year old is thrilled to be able to print in color, and I'm happy not smelling ozone.

So I'm happy with razors and razorblades inkjet, albeit with HP's most economical cartridges. (And there's a little part of me that is bothered by the lack of perfectly-sharp text printing that I've always missed when not using a laser.)

With much deliberation, I had got to where I could accept the ipad--window on the future of computing--being a walled (and barbed-wired, and guarded) garden. I was planning to get a 3G iPad if I have any money left after taxes, and a WiFi one for my wife soon. But this... I think this is farther than I'm willing to go. And even if they were to back down on this requirement (as they did on the original NDA)... I'm rambling, but I feel hurt by this.

Article authors seem to be confused by the phrase: "Pass quarterly remove vulnerability scans". From what I know about PCI compliance, this is probably just a mistype and not indicative of anything actually meaningful. PCI compliance usually requires a quarterly security scan from a certified vendor. (The "Hacker Proof" "Hacker Safe" and similar badges are from these same services or similar.) These scans check your server(s) from the outside against a large panel of known-vulnerable software versions and common dangerous practices. They're useful tools, but no one should be misled into thinking they actually demonstrate security. The scans are typically passive only and don't do anything that could actually exploit a vulnerability or that require interacting with your site in any interesting way (such as logging in).

And it's not (as the article authors supposed) about removing vulnerabilities found in previous scans--you get the same (though updated) set of tests each scan and either pass or fail each time. Should you happen to fail, though, you can just upgrade, protect, or remove the problematic software (or make it hide its version number) and get scanned again until you pass.

I appreciate this link. I gave up reddit for lent since it's mostly just a way to waste time for me. I was comfortable doing it since I was confident that anything really good would get linked on HN, too. I'm pleased to see that a worthwhile discussion thread, even on a relatively small subreddit, made it here.

Needs more upvotes for figuring out how to ride a rare form of Malaria.

I might respond to something like this.

> an agreement where Metalab is reimbursed for the entire amount of their initial quote.

Why on earth would/should that happen over a few mockups? It's not that Mozilla asked Metalab to do a bunch of work, claimed it sucked so they wouldn't pay, and then used it anyway. No: Moz decided not to hire Metalab, and someone ripped off some existing work of Metalab's for some mockups.

Now, I think that was an inexcusable thing to do on the part of whoever did it, but even if it was actual Mozilla staff, I just don't see why Mozilla ought to pay Metalab for not working nor hire them unless they happened to be the second choice. (Because the first choice--assuming they were responsible--has got to go.)

Documentation. Or if my eyeballs start falling out from that, a mass mailing engine in PHP for use on commodity-type PHP hosting. (For non-evil purposes, I promise.)

...water.

All I can think is how horribly motion-sick I'd feel.

Unlikely. "work for hire" is standard terminology in copyright law, and it means (roughly) work done while an employee as part of the normal course of your job. So that's why they need to add an explicit copyright and patent grant for non-work-for-hire cases: an invention related to the company's business might not be ruled a work for hire if it relates to a part of the business you don't work on or if you only worked on it on the weekends, etc..

And even if the company does transfer IP to its customers sometimes, that detail wouldn't be in an employment contract. You assign your IP to the company, the company does whatever it pleases with it. The alternative is every employee that works on a project for a customer executes a separate agreement with the customer to assign IP.

Of course I am not a lawyer (but I am an English major!), but I think many are misreading the last part quoted.

"any of the foregoing" means "anything we talked about earlier" not "anything whatever".

They need the last part because copyright is a sticky thing. All copyrights stick with the owner unless they are a "work for hire" or very explicitly granted in exchange for some good consideration, and you can't simply declare something to be a "work for hire", even by contract--it has its own meaning in law and (even more so) judicial interpretation of law. In (a) they try to define what they'd like to be included in "work for hire", but if it came down to it, a judge might not agree, so they require you to explicitly assign rights to everything in (a) (and possibly b, c,... don't know what's omitted) just in case they don't have them already.

If there's nothing important between the two sections you quoted, then I believe the ownership of your invention would hinge on the judgment of whether your invention relates to the company's business. Also any applicable state laws, etc..

I'm not qualified to answer completely, and even a relevantly trained lawyer would need to know the state, but I think there's good reason for hope.

It's terrifying to consider that you wrote this article without knowing me and in fact without living inside my head. Anything in your list that I don't do I avoid only by conscious effort.

Of course many of these behaviors are not bad so much as different, but my "best" categories are:

* Most of the time I actively analyze conversations for signs that people are talking past each other, so I usually catch myself if I'm using jargon without adequate explanation. (Of course this is fed by the commitment to accuracy and desire to educate, though.)

* I don't think I often evangelize technology, but that's mostly because I discovered some time ago that if I recommend it I'm going to end up supporting it.

Thing I'd most like to improve on in myself is struggling with turn taking in conversation. Like many of these categories, I can behave more normally, but it's amazing to me how much effort and attention this one requires.

Most cognitive dissonance for me is the whole issue of caring about the "how" more than other people do. I think I appropriately focus on what and why when making decisions, and on one level I know that most people do not in fact care about the how. But on another level I can't quite believe that (e.g.) anyone who watches American football wouldn't want to know how they make the yellow first down line show up.

Service may or may not pass basic PCI scan. Probably should see if it would pass any required scans before you go. If you're storing credit card data yourself, it's Definitely not PCI compliant. OTOH, you're already not PCI compliant in that case.

I have this service but don't use it for anything serious. The primary win is that I don't have to maintain the servers, and the email service is very solid with a good webmail. Downsides are I can't make them switch to PHP 5.3, the filesystem is NFS, and there's no API for the control panel stuff. (Most hosts don't have an API for control panel actions, but it would be nice if I could automate creating sites.)

What kind of conversations are you looking for that you don't see here? I don't ask to defend the utility of HN for All Purposes(tm), but to understand your question better.

I've read a case study of someone with essentially this service trying to make money by offering a pro service. It's not going well.

So it might be hard to get enough people to pay for it to make it a sustainable business, but at the same time I would have a hard time recommending anyone do anything important through a free service where I couldn't see what the provider was getting out of it.

1. I can't tell if you're saying that most banks now also credit my account instantly (none of the three I've used post-9/11 did), or if you're saying that getting access to my deposits instantly isn't really an advantage because... ?

2. Credit unions are insured by the NCUA, a federal agency backed by the full faith and credit of the US Government just as the FDIC, and in the same amounts with the same rules about accounts.

Or go the next logical step and move your money to a credit union, where the dollars in your account are shares in the union. Unlike banks, the average credit union isn't built to screw you in every way they think they can get away with.

Small examples:

* When I first opened my accounts there was a (required by law, afaik) probationary period where checks took ages to clear. Since then, all my checks clear the moment I deposit them through the drive through. Typical checks are in the $1000-$6000 range, out of state. (My parents use the same credit union. My mom thinks she remembers a check deposit taking one business day--once.)

* Transfers from PayPal seem to clear a day faster than they did with my bank.

* Overdraft protection from my savings account is free and automatic.

Being a part of a credit union is a different experience from depositing money at a bank. It's similar to the way you might feel different even about some big, "faceless" corporation if it was one you'd chosen to make a significant (to you, if not them) investment in.

I think your current solution is clearly the right one: It gives me the 'duh' moment.

Edit: But in real life the first solution might work better. Hard to imagine the henchmen who would be sure to spot you if you left your room even for a moment but would take no notice of servants shuffling back and forth three times with a [double-]padlocked safe.