jtdowney

5 ms·

1.
by jtdowney 2y ago
It was posted after your comment, but https://news.ycombinator.com/item?id=40938025 indicates that a human was in the loop.
2.
by jtdowney 4y ago
> - Both async/await and the question mark operator feel like rushed implementations, neither seem like the best long term solutions for Rust and are not in line with the otherwise solid foundation of the language. I'd disagree
3.
by jtdowney 7y ago
Looks like it has been available since September 2017: https://github.com/braintree/braintree-web/commit/b79008a51c...
4.
by jtdowney 7y ago
PayPal was very early in the 2FA movement, hardware security keys were available starting in ~2008 ( https://systembash.com/using-the-paypal-verisign-security-ke... ). If you're referring to app based TOTP that is a rela
5.
by jtdowney 9y ago
Isn't it more like https://www.freebsd.org/cgi/man.cgi?if_bridge(4) ?
6.
by jtdowney 10y ago
Dan went into a little more of the backstory last year during the first awarding of the Levchin prizes. If I recall correctly, he and Max had been long time acquaintances and Dan even advised Max while he was working on some of the early Pa
7.
by jtdowney 10y ago
I've spent time with lawyers on specifically this topic. It is about who is distributing the crypto code. There is also an exemption for open source crypto code. On iOS you definitely do not need to register your app if it is just usin
8.
by jtdowney 11y ago
I'm the Security Lead at Braintree. I am not sure what you're hearing in these circles. If someone could send details to security@braintreepayments.com we'd be happy to take a look.
9.
by jtdowney 11y ago
Both Stripe and Braintree require you to use SSL (really TLS) on your checkout pages. They also both require you maintain PCI compliance (although you likely qualify for a reduce set of requirements).
10.
by jtdowney 11y ago
To be fair, Cloudflare has no concept of how much reputation you have on HN.
11.
CVE-2015-3900 Request Hijacking Vulnerability in RubyGems 2.4.6 and Earlier(blog.rubygems.org)
1 points by jtdowney 11y ago|0 comments
12.
by jtdowney 11y ago
I agree! I submitted it as separate item because this conversation was about rewriting iframes. Although hosted fields doesn't directly address the rewriting for now, we're looking at it closely.
13.
Introducing Braintree Hosted Fields(braintreepayments.com)
2 points by jtdowney 11y ago|0 comments
14.
by jtdowney 11y ago
At Braintree, we have been working on the approach you mentioned. We’ll soon update our iframe products to allow a merchant to opt-in to only ever receiving cardholder data via the Braintree iframe. With this change, we could actively block
15.
by jtdowney 11y ago
Visa is slow at updating their site. MasterCard is much faster, you can find their list at http://www.mastercard.com/us/company/en/docs/SP_Post_List.pd... .
16.
Sony considering a digital release of the Interview(money.cnn.com)
2 points by jtdowney 12y ago|0 comments
17.
Chrome canary bug causing valid TLS certificates to be blocked(code.google.com)
2 points by jtdowney 12y ago|0 comments
18.
by jtdowney 12y ago
It is far worse in the sense that it can lead to remote code execution. However, the number of vulnerable sites is far far fewer. Like Heartblead this one will likely have a very long tail of systems remaining vulnerable. My guess is we wil
19.
by jtdowney 12y ago
Ruby already has the ability to spin up a quick webserver for the current directory. This is supported through the un file in Ruby's stdlib: http://ruby-doc.org/stdlib-2.0.0/libdoc/un/rdoc/Object.htm
20.
by jtdowney 13y ago
It wouldn't even need to be a poorly written component. There is a good chance they would log the card number along side the transaction in their database.
21.
by jtdowney 13y ago
The site currently negotiates for DHE-RSA-AES256-SHA, which is forward secure.
22.
by jtdowney 13y ago
They specifically allow accounts to be created for whitehat purposes at https://www.facebook.com/whitehat/accounts/
23.
by jtdowney 13y ago
Debian Wheezy (current stable) ships with Ruby 1.9.3-p194 + various patches [1]. [1] http://packages.debian.org/wheezy/ruby1.9.1
24.
Braintree offers new pricing plan to Australian merchants(lifehacker.com.au)
2 points by jtdowney 13y ago|0 comments
25.
by jtdowney 13y ago
It actually depends on the merchant category code (MCC) of your merchant account when it is setup. Only certain category codes, such as hotels and gas stations, are allowed to capture for more than they authorize.
26.
by jtdowney 13y ago
The purpose of client-side encryption in Braintree.js is to reduce the PCI scope for the merchant and is not the only way the data is protected. Every encrypted value is still sent over HTTPS to to the merchant's server and again over HTTPS
27.
by jtdowney 13y ago
Apple's guidelines only cover purchasing digital content. You may use outside payment methods to purchase physical goods or services used outside of your application. For example this is how Uber, Hailo, Airbnb, Hotel Tonight, and Task Rabb
28.
by jtdowney 13y ago
The cert chain is valid for me
29.
by jtdowney 14y ago
To be fair, they had to upgrade to a development release (1.5) of HAProxy to configure it in this way. When we introduced the broxy at Braintree that feature did not exist. (Disclosure - I work at Braintree)
30.
by jtdowney 14y ago
One thing the article mentions that is not correct is that "there's no need to be PCI Compliant as Stripe handles this whole process for you." While it is true that Stripe bundles the merchant account, you do still need to be PCI compliant.

More ›