Very Good Security • Hacker News Board

Re: Very Good Security

#91

Post by GFischer » Wed, Aug 29, 2018, 3:22 PM UTC

miketery wrote: post #70

mahmoudimus wrote: post #21

Earlier quoted context omitted.

(disclaimer: I work at VGS) We offer a variety of various format preserving aliasing algorithms. Only legacy systems tend to choose the SSNs if they have fixed-width columns in their RDBMS that are difficult to change (imagine petabytes of data). The idea behind format preserving aliases is actually based on the NIST SP 800-3G standard[1]. We use FF1 and are actively engaging with the world's leading cryptographers s…

Please provide an example of an RDBMS with petabytes of data. Seems unlikely.

NASDAQ had a 2 Petabyte Microsoft SQL Server.

https://customers.microsoft.com/en-us/story/nasdaq-omx-group...

Re: Very Good Security

#92

Post by GFischer » Wed, Aug 29, 2018, 3:29 PM UTC

xyzzyz wrote: post #62

vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

Whether they actually violate visa laws really depends on particular circumstances. Getting paid Ukrainian salaries actually makes it more likely that what they're doing is completely fine from USCIS point of view. Employees of multinationals such as Google, Microsoft, Facebook, Intel etc. who live and work outside of the US routinely travel to US on B2 visa for various work purposes. It really depends on how long yo…

It does violate the letter of the law. B1 visa is only for training, meetings, conferences, etc, if you work remotely for an U.S. company you're not supposed to work while there, only training and meetings. Not sure if you work for a foreign entity (maybe Facebook Ireland is a separate, foreign entity for B1 visa purposes, and maybe they're being paid by an Ukranian entity in Ukrania). B2 is the tourism visa, so definitely no work, but most people get a dual B1/B2 visa.

Edit: apparently the key part is "no salary/income from a U.S. based source". So maybe they're in the right.

In practice, if they're only staying for a few months I don't know if USCIS will care, unless they get caught red-handed.

I wouldn't want to argue with USCIS about the letter of the law though, they'll deport first, ask questions later.

https://travel.state.gov/content/dam/visas/BusinessVisa%20Pu...

Re: Very Good Security

#93

Post by nomadiccoder » Wed, Aug 29, 2018, 3:38 PM UTC

mixmax wrote: post #72

tptacek wrote: post #46

This doesn't say anything. They invested in a tokenization company. That's not a new or interesting technology. What am I missing? There are interesting data security companies happening right now. For instance, Matthew Green is doing Zeutro, an ABE company. Think of ABE as Shamir's Secret Sharing on Steroids: you can encrypt data and delegate it out to different people based on boolean expressions. That at least add…

your comment reminds me of the commentary on Drew Houston's announcement of a product called dropbox (you might have heard of it...) here on HN 10 years ago. (1) "This is nothing new", "I could build this myself", "you have to install something, nobody does that", etc. etc. The key to a successful company is not being first, not (only) having a great technical solution, and not having tech noone else does. The key is…

Be careful to not use anecdotal evidence as support for an argument

Re: Very Good Security

#94

Post by xyzzyz » Wed, Aug 29, 2018, 8:02 PM UTC

GFischer wrote: post #92

xyzzyz wrote: post #62

Earlier quoted context omitted.

Whether they actually violate visa laws really depends on particular circumstances. Getting paid Ukrainian salaries actually makes it more likely that what they're doing is completely fine from USCIS point of view. Employees of multinationals such as Google, Microsoft, Facebook, Intel etc. who live and work outside of the US routinely travel to US on B2 visa for various work purposes. It really depends on how long yo…

It does violate the letter of the law. B1 visa is only for training, meetings, conferences, etc, if you work remotely for an U.S. company you're not supposed to work while there, only training and meetings. Not sure if you work for a foreign entity (maybe Facebook Ireland is a separate, foreign entity for B1 visa purposes, and maybe they're being paid by an Ukranian entity in Ukrania). B2 is the tourism visa, so defi…

Ah, I meant to write that they routinely travel on _B1_ visa for work purposes -- I confused which one is tourist, and which one is business visa. And yes, the difference here is mostly immaterial, since most people simply get a dual B1/B2 visa.

> I wouldn't want to argue with USCIS about the letter of the law though, they'll deport first, ask questions later.

I don't think that's how it works in practice. It is quite rare that people are deported in cases like this, and much less on a short notice too.