Viewing profile — jtdowney

It was posted after your comment, but https://news.ycombinator.com/item?id=40938025 indicates that a human was in the loop.

> - Both async/await and the question mark operator feel like rushed implementations, neither seem like the best long term solutions for Rust and are not in line with the otherwise…

Looks like it has been available since September 2017: https://github.com/braintree/braintree-web/commit/b79008a51c...

PayPal was very early in the 2FA movement, hardware security keys were available starting in ~2008 ( https://systembash.com/using-the-paypal-verisign-security-ke... ). If you're re…

Isn't it more like https://www.freebsd.org/cgi/man.cgi?if_bridge(4) ?

Dan went into a little more of the backstory last year during the first awarding of the Levchin prizes. If I recall correctly, he and Max had been long time acquaintances and Dan e…

I've spent time with lawyers on specifically this topic. It is about who is distributing the crypto code. There is also an exemption for open source crypto code. On iOS you definit…

I'm the Security Lead at Braintree. I am not sure what you're hearing in these circles. If someone could send details to security@braintreepayments.com we'd be happy to take a look…

Both Stripe and Braintree require you to use SSL (really TLS) on your checkout pages. They also both require you maintain PCI compliance (although you likely qualify for a reduce s…

To be fair, Cloudflare has no concept of how much reputation you have on HN.

I agree! I submitted it as separate item because this conversation was about rewriting iframes. Although hosted fields doesn't directly address the rewriting for now, we're looking…

At Braintree, we have been working on the approach you mentioned. We’ll soon update our iframe products to allow a merchant to opt-in to only ever receiving cardholder data via the…

Visa is slow at updating their site. MasterCard is much faster, you can find their list at http://www.mastercard.com/us/company/en/docs/SP_Post_List.pd... .

It is far worse in the sense that it can lead to remote code execution. However, the number of vulnerable sites is far far fewer. Like Heartblead this one will likely have a very l…

Ruby already has the ability to spin up a quick webserver for the current directory. This is supported through the un file in Ruby's stdlib: http://ruby-doc.org/stdlib-2.0.0/libdoc…

It wouldn't even need to be a poorly written component. There is a good chance they would log the card number along side the transaction in their database.

The site currently negotiates for DHE-RSA-AES256-SHA, which is forward secure.

They specifically allow accounts to be created for whitehat purposes at https://www.facebook.com/whitehat/accounts/

Debian Wheezy (current stable) ships with Ruby 1.9.3-p194 + various patches [1]. [1] http://packages.debian.org/wheezy/ruby1.9.1

It actually depends on the merchant category code (MCC) of your merchant account when it is setup. Only certain category codes, such as hotels and gas stations, are allowed to capt…