Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Didn’t Homejoy Shut Down?

medium.com

Post reply on HN
Print view View original

181–190 of 361 posts

Re: Didn’t Homejoy Shut Down?

#181

Post by CatDevURandom »

crabasa wrote: post #156

I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twic…

> He graduated from MIT in 2009 ... he may not have the slightest idea what else he could possibly do instead.

There's endless ways we could speculate about why he's doing what he's doing, but is being six years out of school one of them?

He spent "his entire professional career" (5 years!!!) in home cleaning. And before that it looks like he spent four years at MIT majoring in chemical engineering.

Re: Didn’t Homejoy Shut Down?

#182

Post by ebbv »

aarontcheung wrote: post #125

I'm one of the founders of Homejoy. I'm still very passionate about the home service space. After leaving Homejoy, I started FlyMaids, where we're exploring a few different angles on the space. We recently acquired the customer and service provider data from Homejoy. We're a small team that has been focused on moving quickly while bootstraping. We tried to quickly test different approaches, but we realize now that we…

Everything you did is 100% wrong and makes you look like a Grade A sleezeball.

Re: Didn’t Homejoy Shut Down?

#183

Post by justinzollars »

jasonlaramburu wrote: post #162
nostromo wrote: post #158

Earlier quoted context omitted.

Your CC is probably safe on Stripe's servers. Which makes me wonder -- does Stripe allow entire accounts to change hands willy-nilly like this?

Are they using stripe on the new site(s)? Looks like those have all been taken down.

If so this information should be deleted. If I were effected I would be pissed.

I hope someone at Stripe responds because this is a personal data issue.

Re: Didn’t Homejoy Shut Down?

#184

Post by codezero »

chetanahuja wrote: post #179
chris_wot wrote: post #157

Earlier quoted context omitted.

I thought it was pretty clear, but I'm willing to elaborate. The requirement is that card data is securely removed when it is no longer required. They are no longer billing customers at HomeJoy as the business has been wound up, so the credit card data should have been deleted. Also: no customer has given them any right to have their credit card billed to an entirely new entity. Credit card information should not be…

and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.

Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data.

It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.

Re: Didn’t Homejoy Shut Down?

#185

Post by chris_wot »

chetanahuja wrote: post #179
chris_wot wrote: post #157

Earlier quoted context omitted.

I thought it was pretty clear, but I'm willing to elaborate. The requirement is that card data is securely removed when it is no longer required. They are no longer billing customers at HomeJoy as the business has been wound up, so the credit card data should have been deleted. Also: no customer has given them any right to have their credit card billed to an entirely new entity. Credit card information should not be…

and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.

Good point - can't believe I didn't pick that up! That's an even more obvious violation of PCI-DSS (and even the most basic security imaginable!).

Re: Didn’t Homejoy Shut Down?

#186

Post by chris_wot »

codezero wrote: post #184
chetanahuja wrote: post #179

Earlier quoted context omitted.

and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.

Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data. It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.

You really need to read the PCI-DSS standard before you make comments like that.

Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here:

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1....

At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.

Re: Didn’t Homejoy Shut Down?

#187

Post by wpietri »

ericsidelis wrote: post #111
thaumaturgy wrote: post #85

Earlier quoted context omitted.

Is this a new policy? Because the company that prompted me to start the list, Zenefits, is still a Paul Graham darling: https://twitter.com/paulg/status/654377298234224640 Or, might be that our definitions of unethical don't match up 100%. I consider spam to be unethical, maybe you just mean more serious offenses.

I guess we all have different views on ethics, maybe I'm just used to seeing spam and tossing it out. I find it harmless now because I'm so used to getting it...but its interesting to see how offended people get when they see unsolicited virtual mail which can be deleted with a click of a button. I'm actually more concerned about the actual spam in my real world mailbox that USPS dumps 3 times a week, no opt-out butt…

At this point I have been hearing this sorry excuse for twenty years. At least it once had the value of novelty.

Spam is illegal, so that's one good sign it might be unethical. About 90% of email is spam [1]; the reason you aren't spending all day "deleting with the click of a button" is that a lot of smart people and a lot of computing power are devoted to keeping most of that spam out of your inbox.

You should be thankful for the people who get offended about this stuff, because its only their reactions and their hard work that have kept email a usable medium.

[1] https://www.m3aawg.org/sites/default/files/document/M3AAWG_2...

Re: Didn’t Homejoy Shut Down?

#188

Post by codezero »

chris_wot wrote: post #175
codezero wrote: post #164

Earlier quoted context omitted.

Yeah, I get your position (hopefully!), but I think I'd rather hear from a lawyer whether this is OK or not, my guess is that it is OK. The snippet you pasted says also: ... regulatory, and/or business requirements A business that is going out of business may treat this data as a business asset and may need to retain it for a certain period even when they are inactive. Most terms of service do allow for transfer of a…

Yeah, you don't need to be a lawyer to implement PCI-DSS. You are entirely missing the following dot point: "Processes for secure deletion of data when no longer needed" Those dot points aren't using a disjunction, they must ALL be followed. The standard is very, very clear on that point: once you don't need the data, you securely delete it. That makes sense, incidentally. If you no longer have the data anywhere, the…

I'm not entirely missing the point, but I don't know enough about the PCI-DSS to be too much of a contrarian here :)

Processes for secure deletion of data when no longer needed

Is "needed" defined anywhere?

As far as I can tell this requires companies to create a plan – that plan could be very different between companies.

I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right?

Let me restate what I think you're saying though: When they shut down Homejoy, they should have immediately deleted all the data they had stored in Stripe (or what ever payment system they use)?

"That HomeJoy hasn't done this says to me they are cavalier with their customers data at best. I would not trust them with my credit card details, nor would I be happy letting them into my home."

Totally agree, maybe let's leave it at that :)

Re: Didn’t Homejoy Shut Down?

#189

Post by codezero »

chris_wot wrote: post #186
codezero wrote: post #184

Earlier quoted context omitted.

Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data. It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.

You really need to read the PCI-DSS standard before you make comments like that. Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.... At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.

Got it, thanks for the link.

Re: Didn’t Homejoy Shut Down?

#190

Post by huac »

johncolanduoni wrote: post #153
iamcurious wrote: post #140

Earlier quoted context omitted.

I'm starting to read "passionate about" as "wanting to make money of". I have to make an effort to read it in the classical sense. I fear the same will happen with "share". And when my kids talk about sharing at school I will only think of flooding with memes or of selling things. Now, I'm not a native english speaker, so I can't say if aarontcheung is misusing the term or not. Is this change happening to the english…

It is most definitely the latter, although SV isn't the only place this happens.

Deutsche Bank's slogan is "Passion to Perform"
Post reply on HN