Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I didn't get paid, so I open-sourced my client’s project

github.com

Post reply on HN
Print view View original

251–260 of 272 posts

Re: I didn't get paid, so I open-sourced my client’s project

#251

Post by klez »

oefrha wrote: post #243
jwr wrote: post #230

Earlier quoted context omitted.

If you used any IMAP accounts (not from Google), you would need to enter the password. And Spark will quietly send it to "the cloud" and keep it there, with servers accessing your mail whenever they please. This is kind-of mentioned in the Privacy Policy, but in a way that wasn't clear to me at all. I found this unacceptable, so I can't use Spark, which I regret. I also lost trust for Readdle, so now, even though the…

Storing the IMAP password is basically the same as storing the Gmail OAuth token in terms of access control, not sure why you think storing one is more evil or scarier than the other. AFAIK Spark’s push notification service relies on checking for mail server-side (so that they don’t drain your battery with constant background refreshes, I suppose?), so I wouldn’t consider it sneaky.

Not sure, but I guess you can revoke an OAuth token and nothing changes for other apps (and you) on the Gmail/Google account side. On the other hand, if you have to change password...

Re: I didn't get paid, so I open-sourced my client’s project

#252

Post by dingwallr »

rrix2 wrote: post #182
jwr wrote: post #179

Earlier quoted context omitted.

Well of course I won't use anything like that! I find it mind-boggling that people even consider giving a third party their bank account login+password. It's like saying "yes, I want to be robbed of all my money, please take these credentials and spread them forth to whichever leaked data pile they might end up in". My bank considers transactions done using login credentials to be final. There is no recourse if someo…

Which bank implements OAuth?

Monzo bank in the UK uses OAuth 2.0 for its API: https://docs.monzo.com/#authentication

(disclaimer: I work here)

Re: I didn't get paid, so I open-sourced my client’s project

#253

Post by jeremija »

webninja wrote: post #224
qafy wrote: post #123

Earlier quoted context omitted.

If you aren't comfortable with that you better not use any fintech apps like Cash App, Venmo, Wealthfront, Robinhood, any Intuit products, etc. These services use Plaid (like this app does) or similar APIs like Quovo, Yodlee, etc. Even financial institutions themselves like Citi Bank, American Express, Chime, PayPal, etc use these APIs to link your accounts. And to be clear, the app itself never has access to your cr…

1) Robinhood only has my routing number and account number. 2) The Cash app only has my routing number and account number. 3) PayPal only has my routing number and account number. 4) My credit card only has my bank’s routing and account number. Despite these restrictions, the world keeps on spinning round and round.

I don't understand why TransferWise requires me to enter my bank username and password to verify my account. I believe it also uses Plaid behind the scenes, but I used to be able to select "other" bank and enter my routing and account number manually. But as soon as I do that it recognizes my bank and switches to the login screen and I have to abort because I don't want to give it to them. I contacted support and they were not helpful at all.

Re: I didn't get paid, so I open-sourced my client’s project

#254

Post by tekknik »

jwr wrote: post #179
qafy wrote: post #123

Earlier quoted context omitted.

If you aren't comfortable with that you better not use any fintech apps like Cash App, Venmo, Wealthfront, Robinhood, any Intuit products, etc. These services use Plaid (like this app does) or similar APIs like Quovo, Yodlee, etc. Even financial institutions themselves like Citi Bank, American Express, Chime, PayPal, etc use these APIs to link your accounts. And to be clear, the app itself never has access to your cr…

Well of course I won't use anything like that! I find it mind-boggling that people even consider giving a third party their bank account login+password. It's like saying "yes, I want to be robbed of all my money, please take these credentials and spread them forth to whichever leaked data pile they might end up in". My bank considers transactions done using login credentials to be final. There is no recourse if someo…

Plaid doesn’t let you transfer any money through their API, just read data. If Plaid gets compromised and your username and pass get leaked and used then most (all?) will detect the location change and confirm via SMS.

Re: I didn't get paid, so I open-sourced my client’s project

#256

Post by cosmodisk »

nostrademons wrote: post #19
vzaliva wrote: post #2

INAL but even if you did not get paid does not automatically means the result of work for hire belongs to you. If you are a contractor this is a smart thing to explicitly stipulate in the contract.

Also NAL, but my understanding is that if no "consideration" (something of value) changes hands, the contract is null and void. This is why people sell things for $1 instead of giving them away, or why executives take $1 salaries instead of working for free. Thus, if he really never received anything of value for the work, it's as if the contract never happened, and ownership of the IP remains with the person who cre…

Not necessarily the case- contract law is much more complex than this.

Re: I didn't get paid, so I open-sourced my client’s project

#257

Post by eecc »

ygra wrote: post #59
eecc wrote: post #48

Earlier quoted context omitted.

German online payment system called Sofort wants the same... ( https://www.klarna.com/sofort/ ) The instructions asked me to provide account, card number and OTP login code... then it’s just a matter of scraping all my past 10 years transactions and keep the session alive to snoop on exactly how many condoms I buy... Criminals

The idea behind the thing seems to be to initiate a wire transfer (which cannot be refunded as easily as direct withdrawal) and provides the merchant with an immediate confirmation of the same. I've never used Sofort for pretty much that reason that they want your online banking credentials and then automate stuff behind your back. I've sometimes used giropay, though, which does the same, only directly through your b…

The Netherlands mostly uses a system called iDEAL; I don’t know the details but it reminds me of Kerberos or Oauth2. Both parties establish trust with the intermediate server that guarantees confidential handover of transaction secrets without requiring more access than necessary.

There is no defensible need for anything else

Re: I didn't get paid, so I open-sourced my client’s project

#258

Post by eecc »

merb wrote: post #212
gmueckl wrote: post #92

Earlier quoted context omitted.

German law at least forces them to declare that they do so if they were doing that. Otherwise they would break a lot of laws. IANAL, but I believe that might actually get some people in jail. I remeber that banks were very much opposed to that service when they started out, warning people off (against the banks ToS, grounds for sccount termination etc.) and trying to block Sofort from their servers. I honestly don't…

> I honestly don't know how the banks were placated in the end. because after many years into sofort, they still couldn't provide a modern authentiation flow for external services. like openid.

They could/should just license iDeal from NL.

Dutch banks are behind in many things, but this is not one.

Re: I didn't get paid, so I open-sourced my client’s project

#259

Post by giancarlostoro »

m-p-3 wrote: post #45
giancarlostoro wrote: post #23

Earlier quoted context omitted.

> b) The client can use the AGPLv3 version gratis too, even if they modify it, as it will be on their own server anyway. The AGPL covers using code in servers. They would have to provide code for any server side changes.

Considering the initial unethical behavior of the client, I doubt they'll respect the AGPL license.

They could be taken to court and found guilty (I doubt they'd have the time to build up a fake clone with an entirely different codebase that produces the same results). It would become quite apparent to the contractor they're using their software. The contractors terms could include them paying for money lost in the whole process AND lawyer fees covered.

Re: I didn't get paid, so I open-sourced my client’s project

#260

Post by anon12345690 »

codingdave wrote: post #22
tyingq wrote: post #18

Earlier quoted context omitted.

I don't see any context where it's necessarily a new, inexperienced coder.

Fine, what a terrible thing to do to an experienced coder. As an industry, we work so hard to build a culture of constructive critique via code reviews, of mentoring up new developers, of constantly improving our skills. We strive not to judge people for their code any more than we would want to be judged for our own. Naming and shaming coders because they wrote bad code is just uncool, as it fights against the aspec…

delivering bad code when youre paid for a good product is a terrible thing to do
Post reply on HN