Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I hacked Github again

homakov.blogspot.com

Post reply on HN
Print view View original

181–190 of 202 posts

Re: How I hacked Github again

#181

Post by Kudos »

igorhvr wrote: post #155
Kudos wrote: post #106

Earlier quoted context omitted.

In his earlier work at least, he's seemed like a loose cannon.

I don't think that is a fair assessment of him, even then. At any case, I hired him fairly recently for a security audit and he worked quickly, and was very effective (he found several important vulnerabilities and reported them in a crystal clear manner). He was also a pleasure to deal with (no bullshit stance, something I find enjoyable). The 4000 USD for ~20 hours of work were definitely well spent!

The parent was asking why Github haven't hired him, not why nobody has hired him. If you remember, Github actually banned him for hacking the Rails account in his pentesting.

Re: How I hacked Github again

#182

Post by jmnicolas »

erichocean wrote: post #153
rdl wrote: post #145

Earlier quoted context omitted.

It's actually a good strategy to price high hourly but over-deliver (doing lots of free work behind the scenes, or speculative unpaid work, etc.) -- rather than the market-clearing rate of ~100-150/hr, at least when you're trying to build a brand. At $400, he's clearly a specialist, and will get more interesting work; at $100/hr, you could hire him and just treat him like another developer, have him do cookie-cutter…

Personally, I think he'd make more money at $400-600/hr if he could also get some kind of manager to handle the interactions with clients; it doesn't seem to be what he enjoys, or is particularly good at. Completely agree. I'm not doing security, but my hourly is similar, and it was a game changer for me to have someone in a manager-like role working with me. Client relations are a huge time suck, but are also absolu…

It seems your manager is more an agent than a manager.

Re: How I hacked Github again

#183

Post by rdl »

jmnicolas wrote: post #182
erichocean wrote: post #153

Earlier quoted context omitted.

Personally, I think he'd make more money at $400-600/hr if he could also get some kind of manager to handle the interactions with clients; it doesn't seem to be what he enjoys, or is particularly good at. Completely agree. I'm not doing security, but my hourly is similar, and it was a game changer for me to have someone in a manager-like role working with me. Client relations are a huge time suck, but are also absolu…

It seems your manager is more an agent than a manager.

I meant manager in the sense of a band's manager. It's more than just introducing you to deals; it's handling the communications back and forth with the client on an ongoing basis; not merely the negotiation to set up the deal but the actual work-product communications as well.

Re: How I hacked Github again

#185

Post by homakov »

Tobu wrote: post #172

WTF is up with Firefox and Chrome not fixing their /// bug. They're prioritising neither user security nor standards-compliance.

Oh, there are tons of other silly wontfixes. I gave up. They really don't care about web apps. E.g. instead of /../ i could have used /%2e%2e/!

Re: How I hacked Github again

#186

Post by homakov »

nakovet wrote: post #158

One thing that I didn't get from the post: > Oh my, another OAuth anti-pattern! Clients should never reveal actual access_token to the user agent. From what I understood by reading the OAuth RFC is that front-end intensive applications (a.k.a. public client) should have short lifespan access tokens (~ 2 hours) and the back-end takes care of reissuing a new access token when expired. Can someone clarify on how to make…

But gist is not a front end app. Gist has web frontend and Rails backend, which is supposed to store the token safely.

Re: How I hacked Github again

#187

Post by erichocean »

rdl wrote: post #183
jmnicolas wrote: post #182

Earlier quoted context omitted.

It seems your manager is more an agent than a manager.

I meant manager in the sense of a band's manager. It's more than just introducing you to deals; it's handling the communications back and forth with the client on an ongoing basis; not merely the negotiation to set up the deal but the actual work-product communications as well.

Yup, that's exactly what I meant too.

Re: How I hacked Github again

#189

Post by latch »

abcd_f wrote: post #178
ojr wrote: post #161

Earlier quoted context omitted.

he gets paid $400/hr doing consulting for YC Companies and other startups and companies, he is from Russia, and now lives in Bangkok, when he becomes rich he wants to live in Hong Kong, pretty nice for a 20 year old, I don't see any glaring reasons to work for Github http://egorhomakov.com/

$400/hr is meaningless if comes from an one-off gig.

That's about $13000 THB / hour. Considering that it isn't uncommon for junior programmers in Bangkok to make (and live on) 20-30K / MONTH....

Re: How I hacked Github again

#190

Post by ersii »

chimeracoder wrote: post #76
eik3_de wrote: post #67

Earlier quoted context omitted.

Completely agree, GitHub private repos are a huge target. Even if you use 2FA, after login it's just a cookie that separates the good from the bad. How could GH improve that? Client-side SSL Certs?

If you're talking about for company projects, the enterprise version of Github is self-hosted (e.g. on a VPN): https://enterprise.github.com/

There's plenty of companies/enterprises that use regular Github private repositories though.
Post reply on HN