Hacker News Reader

Yes. Uber Freight is basically a freight brokerage that's being operated at break-even levels:

> UberFreight, which would not control the trucks it relies upon to move customers' freight, is building in only a 5-percent average margin for its net revenue per transaction, according to another person familiar with the matter. On average, net revenue, defined as the revenue a broker generates after its cost of purchased transportation, is around three times that for established brokers. UberFreight's other costs would then be subtracted from its net revenue threshold, leaving the brokerage business either to operate at break-even levels or be a loss leader for the San Francisco-based parent.

Source: http://www.dcvelocity.com/articles/20161212--uberfreight-ste...

ssclafanion Uber Freight

> The way most shipping works for most companies today is by going through a brokerage firm, which makes calls to trucking companies and arranges the best deals for its customers. The broker takes a commission of between 15 and 20%. To start, the Uber Freight marketplace will eliminate that middleman and offer shippers real-time pricing of what it will cost to move their goods based on supply and demand.

Source: http://www.businessinsider.com/uber-to-launch-uberfreight-fo...

ssclafanion Thoughts on Uber’s List of Postgres Limitations

https://eng.uber.com/mysql-migration/

https://news.ycombinator.com/item?id=12201353

ssclafanion How we broke PHP, hacked Pornhub and earned $20k

The r/netsec subreddit: https://www.reddit.com/r/netsec/top/?sort=top&t=all

ssclafanion Facebook rewarded a 10-year-old for finding Instagram security flaw

"The problem lay in a private application programming interface (the slice of code allowing certain outside access) that wasn’t properly checking the person deleting the comment was the same one who posted it, the spokesperson added."

http://www.forbes.com/sites/thomasbrewster/2016/05/03/facebo...

ssclafanion Gilt’s Unicorn Tale Comes to an End After Being Acquired for $250M

This is the correct answer.

ssclafanion United Airlines Bug Bounty: An experience in reporting a serious vulnerability

You can't talk about the details of the bug but you can talk about the reward: https://twitter.com/Stephen/status/627190837735239680 The program is legit, they are just very slow (I didn't actually receive the miles until October).

ssclafanion Sam Altman's Twitter AMA

It's not public yet.

ssclafanion Responsive CSS grid, reordered with native HTML5 drag and drop

Also:

https://github.com/jrowny/react-absolute-grid

https://github.com/xudafeng/autoresponsive-react

https://github.com/flipboard/react-canvas

ssclafanion Four RCE Zero-Day Flaws Plague Internet Explorer

Google's Project Zero team has written some good blog posts on this topic if you want to read more:

http://googleprojectzero.blogspot.com/2015/06/what-is-good-m...

http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my...

ssclafanion Create a character voting app using React, Node.js, MongoDB and Socket.io

He provides his rational towards the bottom of the post:

> But do we really need a separate template for this? Why not just render everything inside the App component? Yes, you could do it, as long as you are okay with invalid HTML markup and not being able to include inline script tags like Google Analytics directly in the App component. But having said that, invalid markup is probably not relevant to SEO anymore and there are workarounds to include inline script tags in React components. So it's up to you, but for the purposes of this tutorial we will be using a Swig template.

ssclafanion The easiest bug bounties I have won

Some programs require you to register an account to report a bug while others use email, but you don't need to get permission to look.

All bug bounty programs have rules that outline what parts of their site/product you can test and what kinds of bugs they are looking for (here's Facebook's https://www.facebook.com/whitehat/). As long as you follow the rules you won't have any legal problems.

ssclafanion The easiest bug bounties I have won

I've been doing bug bounties for the past few years, here's some advice to get started:

1. Monitor https://hackerone.com, https://bugcrowd.com and Twitter for announcements of new programs.

2. When looking for bugs in sites with existing programs like Facebook your best chance is when they announce a new feature or product. This includes acquisitions (Facebook paid out over $100,000 for bugs when they added the Oculus websites to their program).

ssclafanion How Google Hires

Yes, from a 2013 interview with Laszlo Bock, senior vice president of people operations at Google:

"We found that brainteasers are a complete waste of time." "They don't predict anything. They serve primarily to make the interviewer feel smart."

http://www.nytimes.com/2013/06/20/business/in-head-hunting-b...

ssclafanion Deleting any Facebook album

Philippe Harewood (@phwd on Twitter) mantains a list of published Facebook bug bounty reports. It's a very good resource for anyone looking to learn about bug bounties and web app security in general: https://www.facebook.com/notes/phwd/facebook-bug-bounties/70...

ssclafanion Jet.com’s Valuation Nears $600M Before Launch

It's for marketing:

> The capital will help fuel Mr. Lore’s grand plans, which include an estimated half-billion-dollar marketing budget and projections for $5 billion in annual transactions by 2020.

(From the full WSJ article : http://www.wsj.com/articles/jet-com-raises-140-million-led-b...)

ssclafanion Native Americans Say Facebook Is Accusing Them of Using Fake Names

You should probably edit that quote so people know it's by Mark Zuckerberg (from 2010). Zuckerberg did back off that position in a more recent interview though: http://www.forbes.com/sites/tarunwadhwa/2014/02/03/zuckerber...

ssclafanion The Implications of Facebook Indexing a Trillion Posts

There're two posts on Facebook's engineering blog that discuss this (they're from 2013 when they first started working on the feature):

https://www.facebook.com/notes/facebook-engineering/under-th...

ssclafanion A look inside Facebook's source code

This was someone's attempt at a bitcoin public challenge: https://news.ycombinator.com/item?id=6765801 (Get a wallet's passphrase which was the username of someone in the Hacker News top 100, minus 2 characters).

ssclafanion Nobody expects CDATA sections in XML

Facebook as well: http://www.ubercomp.com/posts/2014-01-16_facebook_remote_cod... XXE to Remote Code Execution. They paid out their largest bounty ever for it, $33,500.

ssclafanion A Japanese-based multinational made a CD-based console once

Check out Hacking the Xbox: http://www.nostarch.com/xboxfree It covers general reverse engineering techniques as well as going in depth into the original Xbox's security mechanisms.

ssclafanion Amazon’s Twitch Acquisition Is Official

All of the top Twitch streamers have revenue sharing partnerships with G2A.com, a digital download videogame marketplace. It will be interesting to see if Amazon pushes their competing offer.

ssclafanion Earthquake early-warning system gave 10-second alert before Napa quake felt

People in Tokyo had a 60 second warning for the 2011 quake. Here's a good translation of the TV alerts from that day: https://www.youtube.com/watch?v=24KfBwkMw_M Phone alert: https://www.youtube.com/watch?v=bAAIcqI_0Jk Warning countdown: https://www.youtube.com/watch?v=n-FMpNBfna8

ssclafanion Hacking Facebook’s Legacy API, Part 1: Making Calls on Behalf of Any User

It worked on the Facebook mobile sites that use the touch UI (x/touch/iphone but not m).

ssclafanion How Hacker News ranking really works: scoring, controversy, and penalties

Votes made from an article's direct link (e.g. https://news.ycombinator.com/item?id=6799854) don't count towards its rank and too many of them will set of the voting ring detector (this is why it's a bad idea to link directly to a HN submission from your blog or from Twitter/Facebook). This is probably what happened here.

ssclafanion Penny Arcade’s Insultingly Horrible Job

My comment is not an endorsement, it's merely an explanation of the mindset of the person who wrote the ad.

ssclafanion Penny Arcade’s Insultingly Horrible Job

Robert Khoo, the business manger of Penny Arcade and the one who wrote this job ad subscribes to the "work is family" level of cultural fit. He looks at hiring as adding a new member to the family rather than just filling a position. This is why his job ads and hiring methods are so harsh. The three seasons of Penny Arcade's video show paint a good picture of what it's like to get hired and work at Penny Arcade: http://penny-arcade.com/patv/show/pa-the-series.

ssclafanion DoorDash (YC S13) Delivers Food Quickly In South Bay, Hopes To Expand Beyond Food

When I was at RIT in '02-'03 there were two companies doing this. Both of them shut down a couple of months after launching. After I graduated and moved back to Connecticut I found two services in the area that did this. They too both eventually shut down. This model seems to have a problem making enough to pay drivers.

ssclafanion Security Vulnerabilities in Heroku

Heroku will be publishing a blog post sometime today.

ssclafanion How I got a $3,500 USD Facebook Bug Bounty

To report a security or privacy vulnerability to Facebook use their Report a Security Vulnerability form: http://www.facebook.com/whitehat/report/ Anyway else and you risk your report not being received.