ainsleyb's comments

ainsleyb | 12 years ago | on: Show HN: Automatic VPN Generator – Protect Yourself at Sochi and Starbucks

That's awesome. We used OpenVPN because that's what we were familiar with, but your L2TP script looks great. Would you mind if we tried to integrated that at some point?

ainsleyb | 13 years ago | on: Hackers Think Cookies Are Tasty, Too

There are a number of ways: malware, browser extensions, man in the middling, etc. SQLi would have been a better example than XSS, but there are definitely ways in which XSS can still be harmful if thrown in a cookie. If you wanted a persistent XSS for example, you could use a reflected XSS to create a longer lasting XSS attack in someone's login cookie, causing that to be executed every time they hit the page rather than just the one time they click on a malicious link you sent them. Does this make more sense?

ainsleyb | 13 years ago | on: The Top 7 Startups From Y Combinator’s Winter ’13 Demo Day

Flying cars DO exist! :) http://www.terrafugia.com/

ainsleyb | 13 years ago | on: Rails Vulnerability Compilation

No problem at all! We may very well start crawling your advisory DB for our own mailing list, which isn't limited to just Ruby, to be fair. ;)

It's always good to have more eyes on security issues - Ruby or not - and keeping the community informed. Feel free to get in touch with us at [email protected] - we'd love to chat about any ways we can work together.

ainsleyb | 13 years ago | on: Hiring Great People (and rules for how we do it)

This is an interesting take. For us, it's not about age, but about personality. We have a financial controller who is 20 years older than everyone else on the team and we'd bring her on full-time in a heartbeat if we needed a full-time controller. She has a great personality, is fun to have in-house, and knows what she's doing.

How I look at the Sunday test is less of a "are they like me" and more of a "will I get along with them many hours a day"? We work anywhere from 7 hours a day, up to 18 (especially during major code pushes) - we try to avoid this as much as we can, but sometimes (for us at our stage), it's inevitable.

I do have to enjoy working with my colleagues, and someone for whom I won't be willing to come in on a Sunday has a higher chance of bringing me down on a regular basis. That doesn't mean we work Sundays (we're typically in the office M-F), but it's important to be able to get along with people and it's a good litmus test, imho.

ainsleyb | 13 years ago | on: A Most Peculiar Test Drive – Follow Up

As a founder your job is to take the high road as much as possible while still pushing through the strengths of your company. It seems pretty obvious that NYT won't be changing their opinion, and maybe even reached out to Musk to confirm this suspicion. If Musk were to reply to this negatively he'd essentially be feeding an ever-lasting flame. He's taking the best parts, spinning them to those who care about his product, and is continuing on with building out a great product.

Not to mention, he's gotten a lot of good press from other media sources since (as he points out in his blog post).

ainsleyb | 13 years ago | on: Use Rails? Check yourself for the YAML exploit

Sorry about the confusion.

If you run a scan from our homepage, you're actually looking for a lot more than just the YAML vulnerability (XSS, Mixed Resource, etc.) as our product isn't limited to just the YAML vulnerability.

If you run the scan from https://www.tinfoilsecurity.com/railscheck, then you'll get a quick check for just the YAML vulnerability.

Does that clarify it a bit?

ainsleyb | 13 years ago | on: Use Rails? Check yourself for the YAML exploit

There are other workarounds, too. You could disable XML parameter parsing, for example (as seen here: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...).

Thus, you might be running an old version, but still actually be safe by disabling the vulnerable bits.

ainsleyb | 13 years ago | on: Use Rails? Check yourself for the YAML exploit

I've posted a little bit more on our blog at: http://blog.tinfoilsecurity.com/use-rails-check-yourself-for...

ainsleyb | 13 years ago | on: Use Rails? Check yourself for the YAML exploit

Mind if we copy that verbatim? :)

ainsleyb | 13 years ago | on: Ask HN: Anyone heard anything regarding YC Winter 2013 Applications?

We're actually offering free web security, too: http://news.ycombinator.com/item?id=4792073 :)

ainsleyb | 13 years ago | on: YC Rejection Emails Are Out

Love what Mixpanel is doing, so we'd like to jump on the bandwagon. Offering our $59 Basic plan for free for life, and 50% off all other plans. Happy to keep startups secure :) Email your YC rejection letter to [email protected]

ainsleyb | 13 years ago | on: A Review of the TV Show Start-Ups: Silicon Valley

Try http://www.youtube.com/playlist?list=ELdlNqFzO2slw&featu...

ainsleyb | 13 years ago | on: A Review of the TV Show Start-Ups: Silicon Valley

The first episode is available for free on iTunes: https://itunes.apple.com/us/tv-season/start-ups-silicon-vall...

It's a travesty, and puts female entrepreneurs in a poor light, pitting them against each other and making them look petty.

ainsleyb | 13 years ago | on: How should we price our startup?

This looks a lot like BugHerd (http://www.bugherd.com). Might be worth looking at what they do?

ainsleyb | 13 years ago | on: Wingman: Git + GitHub + OS X

Seems awesome - like a GUI for git-flow.

What is the pricing for this? Seems there's a free download at the top, but the bottom says "Buy for $29.99". Might want to make the pricing structure clearer. :)

ainsleyb | 13 years ago | on: How to get your IP unbanned on HN

And this is the precise reason we exist. :)

ainsleyb | 13 years ago | on: Tesla's First 6 Superchargers Open to Public Today

I'm super surprised that the plans for 2013 don't include a charging station in the Bay Area, seeing as they're headquartered here.

ainsleyb | 13 years ago | on: How I made Stripe as easy to use as Paypal in 5 days

This looks great! It seems to make Stripe simpler (since Stripe is essentially simple payments for developers, but non-developers have a hard time grasping all of their docs). If you don't plan on expanding it too much, you might try to talk to the Stripe team and have them integrate :)

ainsleyb | 13 years ago | on: Never Give Your Information To 10 Minute Old Startups

What we've found is that there are 2 mindsets: building and breaking. When you're building a product it's super hard to switch to the breaking mindset of security, simply because mental context switching is expensive and mentally exhausting. The most important thing is to force yourself into that mode before posting anything publicly. If you don't have the security experience, have a friend or service (like ours) look it over. Data is one of the most important assets to your company (or project), and any sort of disclosure can shut you down permanently.