I just logged in to check out this site, and Dan was there, chatting live with folks. So cool. Go Dan Go! You got a customer in me... and I'll be back tomorrow with an order.
How I Made $350 In Two Days With Three Pages and Some Payment Code
41–50 of 90 posts
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#42You may want to check out the MTurk command line tools to help automate order processing: http://aws.amazon.com/developertools/694 Never used MTurk personally, there may be better things available.
Thanks! Believe there are MTurk API bindings for Ruby (the site is built in Rails.) Appreciate the comment!
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#43I just logged in to check out this site, and Dan was there, chatting live with folks. So cool. Go Dan Go! You got a customer in me... and I'll be back tomorrow with an order.
Thanks Oren!! I really, really appreciate your business.
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#44Earlier quoted context omitted.
Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!
Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)
I think that, assuming the proper content of the page is loaded, the communication with Stripe is done over SSL. The problem is that someone could do a MITM and give you different content that, say, sends your credit card to their server instead. And that would be a much easier MITM than if he were using SSL because they wouldn't even have to provide a fake certificate.
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#45Earlier quoted context omitted.
Feedback Army uses Mechanical Turk. Indeed, they say on their pages that the questions a user submits must comply with MechTurk guidelines.
Question for anyone: would you bother checking every question manually to make sure not to cause any trouble with Amazon? Or would you automate it, hope that the users comply and if they don't, deal with the problem then?
Or you could simply post the questions the user entered as a HIT and ask turkers "Does this text comply with mechanical turk?".
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#46That was a great read! I hate to nitpick, but this part caught my eye: I needed to fix about the site – SSL (even though all of the payments are secured through Stripe) . If the checkout page isn't loaded over SSL, my credit card number isn't secure since the page is still vulnerable to a MITM attack completely removing the Stripe code.
Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!
It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#47I just logged in to check out this site, and Dan was there, chatting live with folks. So cool. Go Dan Go! You got a customer in me... and I'll be back tomorrow with an order.
This was the same thing that caught my eye as well. I said congrats on the launch, and Dan was right there with a quick friendly comment. This alone convinced me to try it as I was on the fence.
The signup/interview through checkout process took about 30 seconds. Curiously awaiting the results. Thanks again Dan.
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#48You may want to check out the MTurk command line tools to help automate order processing: http://aws.amazon.com/developertools/694 Never used MTurk personally, there may be better things available.
Thanks! Believe there are MTurk API bindings for Ruby (the site is built in Rails.) Appreciate the comment!
The API is actually very nice to use, you create a template for your HIT (which I'm assuming you already have done for what you're making), and then you just make a single REST call with a list of questions!
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#49I'm curious how you got into the stripe beta? Had you used them before with other projects?
Re: How I Made $350 In Two Days With Three Pages and Some Payment Code
#50Earlier quoted context omitted.
Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!
Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)
How that exactly works is a bit too long a topic for a comment here (try google - "public key encryption", "X.509" and "certificate authority" are some relevant search terms if you're interested).
However what I'd like to point out is that 'simple eavesdropping' effectively is a Man-In-The-Middle attack, be it a passive one (the man in the middle is just keeping his mouth shut and only listening).
And eavesdropping on someones internet connection is, contrary to popular believe, not that simple.
The eavesdropper needs at least one of:
a) effectively have a (virtual) presence on either one of the endpoints of the connection b) unfettered access to exactly the correct pieces of equipment that are part of the internet's infrastructure. c) some way of persuading your traffic to take a de-tour from a remote location
Option a) is the easiest I guess - just drop a piece of malware on someones PC (takes care of that whole pesky SSL issue as well). Although certainly doable - I would not describe it as trivial. Most 'cyberattacks' targeted at the masses are not exactly efficient - their success largely depends on the large numbers of targets - targeting a specific person is quite a bit of work.
Option b) is, depending on who you are either relatively easy or nearly impossible. If it's easy for you, you've probably signed a piece of paper promising you a large bank account withdrawal and/or all kinds of 'benefits' in a state-sponsored facility if you abuse your powers. That won't stop everybody and there are parties for who it is actually their job to do this kind of things, but for the most part you can forget about option b) unless you happened to have attracted the interest of aforementioned parties. In which case I wish you good luck.
The feasibility of option c) depends even more on local circumstances of the victim than option a) but is a real possibility, but certainly not trivial. Something like dns-cache poisoning comes to mind.
So - eavesdropping is certainly possible, but I would by no means call it simple.
Rgds, Jeroen