Hacker Newsnew | past | comments | ask | show | jobs | submit | robotrobot's commentslogin

Talis, Birmingham, UK.

EdTech 100% employee owned, SaaS software already in use in 50% of UK Universities, plus growing Oz, NZ, Malaysia, China and Norway.

Post-revenue and pre-profit (not for long). Every position comes with equity share via options scheme.

Various roles including dev, microservices architecture Node.JS, Java, AngularJS

Check out our ethos: http://careers.talis.com/


Hmm. Another one for your security audit. I was able to change the registered email address on our account

1) Without re-entering my creds following login 2) With no notification to the old email address that this had been done.


Me again.

"he was only able to reach less than 1% (our estimate is 5,000 users)"

So you have 500k registered customers then? Surely not.


http://www.browserstack.com/growth

"475,000 registered developers"


The Last-Modified header for the image is from 18 July 2014 so they could certainly have passed 500K over the last few months.


Another thing to mention here - we've received no direct contact from BS at all following this - if we hadn't been following this on HN (and we were a little naive) we might still not know this email was not genuine. The blog post mortem is great, but I think it's a poor show not to reach out to affected customers directly.


I just got an email from them containing the text of this blog post, you'll presumably get one too, it's just that it takes time to email hundreds of thousands of people.


They have reached out. We received our emails a little before you wrote this, but they send in batches so yours probably came or will come later.


Is anyone from BrowserStack monitoring this thread? We received the email so we can assume our account was accessed by the hacker. Passwords crypted and salted (ok - changed) but what about the BrowserStack automate username and token, generated by BS themselves, that we are unable to edit or regen?


that is in a different table which was not compromised.


OK, I want to make sure though. How can these creds be regenerated? What happens if we had leaked them accidentally, there seems no way to regen them?



Thanks (can't reply direct to the reply for some reason)


There's some kind of algorithm that prevents two users ping ponging comments too quickly. Not sure exactly how it works, but I've had experienced that before.


We've been doing this for a while in our angular apps using response interceptors: http://engineering.talis.com/articles/elegant-api-auth-angul...


This is a great write-up.


This guy is crazy if he thinks an organisation with annual /revenues/ of $110M will spend $10M+ on a domain name.


Well its not just any organization... the organization's sole purpose is promotion (or at least that's what I gather from the name, National Fluid Milk Processor Promotion Program) - and the internet happens to be a damn good place to promote, especially on a memorable domain like milk.com. And $110M a year revenue over 10 years is $1.1B revenue, and I think milk.com would probably still be relavent and valuable 10 years out. So $10M of $1.1B doesn't seem so bad at all.


Assuming, of course, that their business model predicts that over the course of those 10 years $10M extra profit will be made from having the domain milk.com.

I have no idea about the milk business, especially not its promotion. But I would imagine that few people would not spend as much money on milk because this organisation does not own the domain 'milk.com'.

It's more likely to be bought by a corporate wanting a pretty memorable domain.


Perhaps the domain holder is from the Magrathean School of Business Administration, so his strategy is to go into hibernation until his customers can afford the product...


He doesn't say they will, he doesn't even say they should. He's just saying that he's not selling for less, which can be understood as he's not selling, period.


Or maybe he's not interested in selling. But to make him interested in selling, he's got a number that might get his interest. It's a supply and demand thing. He's not supplying, but if you demand at a high enough price, he just might. Maybe. Because he likes his domain.


I think those numbers are years.... :)


Try hitting reload - I managed to get in after a few attempts


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: