Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Didn’t Homejoy Shut Down?

medium.com

Post reply on HN
Print view View original

191–200 of 361 posts

Re: Didn’t Homejoy Shut Down?

#191

Post by chris_wot »

codezero wrote: post #188
chris_wot wrote: post #175

Earlier quoted context omitted.

Yeah, you don't need to be a lawyer to implement PCI-DSS. You are entirely missing the following dot point: "Processes for secure deletion of data when no longer needed" Those dot points aren't using a disjunction, they must ALL be followed. The standard is very, very clear on that point: once you don't need the data, you securely delete it. That makes sense, incidentally. If you no longer have the data anywhere, the…

I'm not entirely missing the point, but I don't know enough about the PCI-DSS to be too much of a contrarian here :) Processes for secure deletion of data when no longer needed Is "needed" defined anywhere? As far as I can tell this requires companies to create a plan – that plan could be very different between companies. I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Str…

Is "needed" defined anywhere?

Speechless!

I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right?

No, Stripe would then be violating PCI-DSS themselves.

Re: Didn’t Homejoy Shut Down?

#192

Post by chris_wot »

codezero wrote: post #189
chris_wot wrote: post #186

Earlier quoted context omitted.

You really need to read the PCI-DSS standard before you make comments like that. Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.... At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.

Got it, thanks for the link.

It was in my original post!

Re: Didn’t Homejoy Shut Down?

#193

Post by detaro »

jasonlaramburu wrote: post #152
aarontcheung wrote: post #125

I'm one of the founders of Homejoy. I'm still very passionate about the home service space. After leaving Homejoy, I started FlyMaids, where we're exploring a few different angles on the space. We recently acquired the customer and service provider data from Homejoy. We're a small team that has been focused on moving quickly while bootstraping. We tried to quickly test different approaches, but we realize now that we…

Aaron, I was a homejoy customer. I am frustrated and concerned that my credit card # was sold to another company without my consent. How can users opt-out of having their data sold to flymaids (or any future ventures)? The fact that flymaids' site is a poorly-built clone of a competitor's site also makes me scared that my data is not being protected.

If they keep data in Stripe, you should contact Stripe about it. I'd be interested in what they have to say.

Re: Didn’t Homejoy Shut Down?

#194

Post by icey »

crabasa wrote: post #156

I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twic…

Something that smells bad to me: Homejoy was facing multiple lawsuits at the time they shut down (http://www.forbes.com/sites/ellenhuet/2015/07/17/cleaning-st...). Is this some kind of end-run around that?

Re: Didn’t Homejoy Shut Down?

#195

Post by colinbartlett »

crabasa wrote: post #156

I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twic…

I don't think it's fair to judge people based on a lack of social media presence. Plenty of successful, competent, qualified people don't tweet.

Re: Didn’t Homejoy Shut Down?

#196

Post by 91bananas »

colinbartlett wrote: post #195
crabasa wrote: post #156

I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twic…

I don't think it's fair to judge people based on a lack of social media presence. Plenty of successful, competent, qualified people don't tweet.

Just, thank you.

Re: Didn’t Homejoy Shut Down?

#197

Post by codezero »

chris_wot wrote: post #191
codezero wrote: post #188

Earlier quoted context omitted.

I'm not entirely missing the point, but I don't know enough about the PCI-DSS to be too much of a contrarian here :) Processes for secure deletion of data when no longer needed Is "needed" defined anywhere? As far as I can tell this requires companies to create a plan – that plan could be very different between companies. I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Str…

Is "needed" defined anywhere? Speechless! I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right? No, Stripe would then be violating PCI-DSS themselves.

How could Stripe know if one of their users is out of business and should delete their data? I'm a bit confused (as you already know!)

Stripe has API calls to get the last four digits and expiration date.

Also, it's not clear that the /payments page isn't secure, the screenshot is of the Profile page.

*edit: see my reply to your other comment, didn't realize you were OP, so I will now assume you did check the payment form for security and it was not there, which is definitely even more shocking.

Re: Didn’t Homejoy Shut Down?

#198

Post by volaski »

jrochkind1 wrote: post #177
wpietri wrote: post #171

Earlier quoted context omitted.

It's jargon, but people definitely are like that. There are a horde of people who just want to do Bitcoin or VR or video games, for example. They're less concerned with the specific company than something about the tech, the users, or the market.

Oh, I understand being passionate about video games, or VR, or Bitcoin, or even, maybe, although it's a stretch, helping people keep their houses clean. And wanting to work in that area. When you say you're passionate about a "space" though, I think you reveal that all you're really saying is you think you can make a lot of money in that "space". Which isn't passion at all. Well, maybe passionate about making money.…

While I think this is a stupid move on the founder's end and there's no debate about that, I disagree with your understanding of what "passion" is. People seem to think most passionate people are born with some sort of pre-assigned passion, but it's something that arises out of your experience and action. Just like Thomas Edison was "passionate" about what he built (but he was super greedy and an asshole too), this guy probably became obsessed with this "space" after having worked on it for such a long time, even though 5 years ago he probably didn't care about home cleaning at all.

Re: Didn’t Homejoy Shut Down?

#199

Post by gonehome »

aarontcheung wrote: post #125

I'm one of the founders of Homejoy. I'm still very passionate about the home service space. After leaving Homejoy, I started FlyMaids, where we're exploring a few different angles on the space. We recently acquired the customer and service provider data from Homejoy. We're a small team that has been focused on moving quickly while bootstraping. We tried to quickly test different approaches, but we realize now that we…

PR is difficult - especially on Hacker News. Sometimes people respond excessively harshly (which I think unfortunately makes people less likely to engage the community at all).

Bad press sucks and can be hard, it'll pass though - good to be cautious with this kind of thing in the future (which you probably will be).

I was a Homejoy customer too and don't think this is that big a deal all things considered.

Re: Didn’t Homejoy Shut Down?

#200

Post by oneJob »

colinbartlett wrote: post #195
crabasa wrote: post #156

I think it goes without saying that there is nothing remotely legitimate happening here. The fact that Aaron posted this comment and expected anybody to believe it is remarkable. That being said, I spent 5 minutes researching Aaron Cheung and I was astonished by what I found. He has a Twitter account, but has posted exactly 0 times [1]. He has an HN account, but has posted exactly 0 times [2], and only commented twic…

I don't think it's fair to judge people based on a lack of social media presence. Plenty of successful, competent, qualified people don't tweet.

Hear, hear!
Post reply on HN