HN user

rsobers

2,605 karma

[ my public key: https://keybase.io/rsobers; my proof: https://keybase.io/rsobers/sigs/I5GxRcXt_TYlWPkKP-xO416o4qTMJE0hbXRncyC2t_4 ]

Posts158
Comments139
View on HN
www.varonis.com 6mo ago

Reprompt: Single-Click Microsoft Copilot Data Exfil

rsobers
1pts0
www.varonis.com 1y ago

Root Privilege Escalation on Azure AI and HPC Workloads Using Aznfs-Mount

rsobers
1pts0
www.varonis.com 3y ago

CrossTalk and Secret Agent: Two Attack Vectors on Okta's Identity Suite

rsobers
2pts0
www.varonis.com 4y ago

URL Spoofing in Box, Google, and Zoom

rsobers
2pts0
www.varonis.com 4y ago

Bypassing Box's SMS-Based MFA

rsobers
3pts0
www.varonis.com 4y ago

Bypassing Box's one-time password MFA

rsobers
2pts0
www.varonis.com 4y ago

Salesforce bug exposes Outlook/Gmail calendars

rsobers
2pts0
www.varonis.com 4y ago

BlackMatter Ransomware

rsobers
2pts0
www.varonis.com 7y ago

New strain of Qbot banking malware actively compromised thousands of victims

rsobers
3pts0
blog.varonis.com 8y ago

The World in Data Breaches

rsobers
1pts0
blog.varonis.com 8y ago

Adventures in Malware-Free Hacking

rsobers
5pts0
info.varonis.com 8y ago

Troy Hunt's Web Security Fundamentals Course

rsobers
2pts0
blog.varonis.com 8y ago

Guide to the GDPR Breach Notification Rule

rsobers
3pts0
blog.varonis.com 8y ago

The Right to Be Forgotten and AI

rsobers
2pts0
blog.varonis.com 9y ago

Practical Powershell for IT Security: File Access Analytics

rsobers
1pts0
github.com 9y ago

Curated list of threat intelligence resources

rsobers
1pts0
www.troyhunt.com 9y ago

Ways for a conference to upset their speakers

rsobers
4pts0
www.youtube.com 9y ago

Internet Security Basics by Troy Hunt

rsobers
1pts0
blog.cylance.com 9y ago

Cylance Discloses Voting Machine Vulnerability

rsobers
155pts120
blog.varonis.com 9y ago

The Definitive Guide to DNS TTL Settings

rsobers
2pts0
seekingwisdom.io 9y ago

Advice for Young Makers

rsobers
1pts0
info.varonis.com 9y ago

The Enemy Within: A Free Course on Insider Threats by Troy Hunt

rsobers
6pts0
info.varonis.com 10y ago

HaveIBeenPwned.com Creator's Course on Ransomware

rsobers
2pts0
blog.varonis.com 10y ago

Football player hacked live during draft, agent blames Silicon Valley

rsobers
8pts1
blog.varonis.com 10y ago

Chimera changes the ransomware game

rsobers
1pts0
blog.varonis.com 10y ago

List of Penetration Testing Resources

rsobers
7pts1
www.telegraph.co.uk 10y ago

WhatsApp Security Vulnerability

rsobers
34pts5
www.davidslog.com 11y ago

David Karp: What do you actually do at Tumblr?

rsobers
1pts0
medium.com 11y ago

Culture Is the Spec; Process Is the Code

rsobers
1pts0
calacanis.com 11y ago

Calacanis on Ellen Pao and Fixing the Gender Issue in VC

rsobers
28pts5
The 2016 Election 10 years ago

Agreed. This is crazy:

1. A rich and powerful person parroting Trump's evil statements --> ban from YC.

2. A rich and powerful person helping put Trump in a position to turn his evil statements into reality for an entire country --> No ban from YC.

In my experience, skilled people have no qualms about showing their work. I don't care if it's through a game, research, conference talks, whatever.

I'd just want more proof than "Bob says he does a bang-up job" -- there's so much incest in enterprise, recommendations and upvotes mean nothing.

I'll be interested to see what you come up with!

But why must demonstration of skill be limited to elite red-team style pentesting? You could devise challenges geared at demonstrating all sorts of knowledge (HIPAA, PCI, websec) basic or advanced.

If you've seen the sad state of PCI audits in particular these days, you'll get my drift. I think there's a huge opportunity here to raise the quality bar with your marketplace.

I like the idea of a marketplace, but I don't think background checks and references are the way to build a credible list of the world's best pentesters.

I think what patio11 is doing with Starfighters.io is orders of magnitude better. Run developers through a gambit of supremely difficult tests via a fun CTF-type game and pair the best hackers with the highest enterprise bidder. Works not just for pentesters, but all devs really.

Also, I know where to get the best pentesters because they're listed on all the top companies' bug bounty pages. It's proof of skill I'm after, not some Gartner-esque gatekeeper telling me who's best because they've "background checked" them.

Give me a system more like StackOverflow or Starfighters where I can see the work. Not something subjective like eBay or Yelp, which can be easily gamed.

I would change:

Moments, which we launched last week, is a great beginning.

To:

Moments, which we launched last week, illustrates the problem. It missed the mark.

I honestly don't think Jack or Ev think Moments, in its current incarnation, embodies what Twitter is or should be.

Won based on what criteria?

Atlassian has over 1,100 employees. When I was at Fog Creek we had ~30.

So if we're talking about profit per employee, I can assure you the people who built FogBugz don't feel like they've lost anything.

I think there's some truth in what you say about stroking journalists egos, but remember, nobody is forcing Uber to play so aggressively; they're doing it for the sake of growth.

Revolutionary, fast-growing, successful companies are going to be scrutinized no matter what. It's up to the Uber exec and PR teams to decide when to put on the brakes--at the expense of growth--to avoid it.

Certainly there are other groundbreaking companies (e.g., SpaceX) that haven't found themselves in Uber's position, and it's likely due to their leadership, not their ability or willingness to pay off journalists.

To start, the Uber exec was suggesting that they do their dirt-digging anonymously ("Nobody would know it was us.").

Also, those articles you linked to are examples of journalists providing commentary around direct quotes or facts/reports about the company. AFAIK, Sarah Lacy didn't dig up and expose personal information about people at Uber nor their families.

According to Levie, Box has 99% of the Fortune 500. Does it really count if 75 people in Toyota's marketing department uses Box to share a few hundred gigabytes of files?

The numbers don't lie: "Box’s average customer value (ACV) is $3,653, much lower than the median of 59,600." [1]

They're selling "enterprise" software at SMB price points.

Setting aside security concerns, getting a big enterprise to move a substantial part of their IT infrastructure to the cloud is a logistical nightmare. Perhaps they underestimated this.

[1] http://tomtunguz.com/box-ipo/

Certainly depression in tech is real and people suffering deserve help (and can hopefully get it given their station in life).

But when you strive for hyper-ambitious outcomes, whether it be selling your company for $2B, trying to change the world, or training to become a world champion fighter, you're likely going to suffer some injuries that you might not fully recover from.

I feel for all the people who are depressed AND struggling to find their next meal--working in fast food or in factories, being treated as if they were less-than-human.

I find it super-hard to get worked up when we founders and startup employees get to have health insurance, good salaries, free food and education, and a chance to win the lottery.

Is it fair for George Clooney to hit on your girlfriend? Yeah, let the best man win! But it's still kind of a dick move.

Regardless of whether you agree w/ tactics, the attitude and behavior leaves a bad taste.

Founders with Kids 12 years ago

I think it's even harder when both parents work full-time.

When your spouse doesn't work, you can often pull off late nights knowing your kids and house are under control. But when both parents have high-stakes jobs it's super hard because you're almost always subject to a hard stop.

It's also a mindset thing--keeping your startup's problems in your head and trying to think and plan for the family (who has practice this weekend? is the preschool application in? who's meeting the plumber today? etc.).

No, Buffer's MRR is 250K. Baremetrics' own MRR is $9K. Both dashboards are public. You might've been toggling between them.

The problem I have with customer development interviews is that people often suck at verbalizing what they really need.

I much prefer Amy Hoy's "safari" approach where you silently observe and record what people do and say in their natural environment (vs. the "zoo" that is a customer development interview).

Why don't you grandfather in your current free users and shut off the plan? That seems totally fair.

At present, it seems like bait and switch. You say it yourself in the post:

"One of the most prominent details we emphasized to everyone we spoke to in the early days of Trak.io was that we would offer a super generous Free plan."

So you got people to try and test your product based on this attractive premise, and now the ones who are perhaps too early stage to switch to a paid plan are stuck. With an analytics app, switching costs are pretty high.

Of course you have the ability to iterate, increase prices, etc.--and you should--I just think it should be done with a little more tact.

The term 'freeloader' was used because they're taking stuff for free with no expectation to pay anything in the future.

You set this expectation yourself by offering a free plan, no?

Wow, this is the absolute wrong way to ditch a free plan. Holy shit!

The post comes off really condescending towards the beta users that helped get the product off the ground.

Sure, the business lessons are valid and helpful (despite being a complete regurgitation of advice espoused by people like Rob Walling and Patrick McKenzie), but IMO they don't belong in the same post that tells a cohort of your very first users:

"Yeah, we needed you in the beginning to test our idea and product, but now you're a burden. Get lost."

Grandfather your free plan beta customers in. It's the right thing to do. The free plan, IIRC, had a really low ceiling in the amount of data that could be collected--like 150 people or something silly.

Lessons for SaaS founders: 1.) Don't have a free plan. 2.) Don't set an expectation that there will be a free plan to get more early testers. 3.) Don't ever refer to any of your customers (free or not) like they're a number in a spreadsheet.

(Is it just me, or is the trak.io blog theme eerily similar to Signal v. Noise?)

Firstly, firing you for making this statement is crazy.

But one problem with giving employees a cut of the profit from their ideas is that everyone becomes incentivized to try to come up with home run ideas vs. doing necessary but non-revenue generating projects and tasks. [1]

The pizza party and cardboard wheel is kinda ridiculous--like something from The Office--but that's the (sad) norm at a ton of places. Most of us are extremely luck to be at the other end of the spectrum in tech/startups.

[1]: Great article on this topic by Joel Spolsky: http://www.inc.com/magazine/20090101/how-hard-could-it-be-th...

I've been doing a lot of research on enterprise search products lately and one of the biggest issues is security. Unleashing search on corporate systems where permissions aren't managed really well is a big risk.

Tesla has a showroom at Short Hills mall in NJ. You can go in, check it out, test drive the car, and then order online. While it's really telling about NJ's government, I don't think it'll impact Tesla or its customers.

Also, I love how the article title reads "New Jersey Votes", as if the citizens got a vote in the matter.