Can you elaborate on the word "manipulate"? In my opinion all we did is let our beta users know that we are on PH that day. The whole article is about how PH block products from going infront of new audiences

> In my opinion all we did is let our beta users know that we are on PH that day.

...with the explicit goal of getting people to upvote your submission.

Well of course that is the goal. Without upvotes your product is never seen by your potential users. If you solely rely on luck of people finding you buried in the Newest section than 99% of the time you won't reach the front page. I dare to say very few product ever made it to the top without the support of their initial beta / power users.

if one viral application can break the ecosystem, then it probably needs to evolve

I normally go with: "If you could do it from scratch how would you implement the infrastructure of X"

X being a currently widely known service (I'm usually going with Spotify). There is no "right answer" to this question but this shows you how the candidate thinks and how well they can protect their opinion if challenged

I think this is a good question, but that it falls prey to the same conceit that befalls those who claim they could "build Twitter in a weekend". A picture-perfect sketch of a system can illustrate one's knowledge of patterns and off-the-shelf solutions, but it won't cover the things that get in the way of a team building their way towards product/market fit.

You could lead with this question and then jump in with hypothetical roadblocks to see how the candidate reacts.

Ex:

- "A network of microservices _would_ be a clean way to implement this. How would you foresee the operational burden of this impacting a small team?" - "Imagine that you build this and it works well, but the product it powers ends up not resonating with customers. The team now wants to pivot to X. What changes would you make to the system to address this new problem space?"

> it falls prey to the same conceit that befalls those who claim they could "build Twitter in a weekend"

A good answer would account for the fact that our initial approach to big projects tends to differ quite a bit from what the the end result is. Agility of architectural design is generally underrated in my experience.

Do you first ask them if they have personally used the service X first or you assume they know and have used it because it is "widely known"?

I like questions like this, but I always give an explanation what the service is, in case the person freezes up in an interview situation.

A great "how would you architect X" is Uber. Lot's of hidden complexity.

This sounds like a fun question, and seems interesting and engaging for both the interviewer and the interviewee.

One of the fun things about these questions as an interviewer is all the answers end up a little different, so you end up learning something. While that's not the prime goal, it is nice if a candidate uses it to teach you something :)

This is a very good one, my default is usually Instagram

What would be a good answer for this type of question?

I would think that a good answer showcases your knowledge. E.g. if you knew a lot about relational databases, this is a time to apply the knowledge.

It's also good if you show the ability to see trade-offs where they exist. E.g. the trade-offs for a relational database vs. something else might be familiarity / time to implement, vs. ease solving some type of situational performance problem.

Nice job! One suggestion from a person who developed widgets used on lots of sites: You are appending general styles (like styling the a tag, ".container" which is a popular class name) to the containing document's body. This is bad practice, since it will alter all the links on the containing page. Consider using namespaced classes (like .github-widget-link) or build your own iframe and apply the styling there

very nice. one thing i'm missing tho is a callback functionality.

for example i did a quick scraper for tesco.com

  {
    page(url:"http://www.tesco.com/groceries/product/browse/default.aspx?N=4294793330&Ne=4294793660") {
      items: query(selector:"li.product") {
        title: text(selector:"span[data-title=true]")
        price: text(selector:"span.linePrice")
        url: attr(selector:"a:eq(0)", name:"href")
      }
    }
  }

now the url field on the page is relative. it would be nice to have a callback param where i could execute a function on the result and prefix the url with "http://www.tesco.com"

trying to make a pull request now

"...but there are hundreds if not thousands more startups that will make their founders and investors rich."

I think the correct word here would be "richer". For VCs 5x return on an investment while desirable, it's not the ideal outcome.

Consider a VC invests in 100 companies during X years, $1 million each. Ballparking here but 80 of these will be a total failure. 19 of them will make 5x return. That is -$100 million spent and $95 million gained. So if the last one is "only" a 5x return the VC gets their money back (-inflation, time spent, etc). Thats why they are looking mostly for Ubers and AirBnbs imho

> Ballparking here but 80 of these will be a total failure

Would those 80 still have failed if the mindset was "get 5x returns" rather than the current "get 100x - 1000x returns"?

My gut says the demand for high-returns results in "total failure" in many cases due to insane burn-rates in quest for "hockey-stick growth"

That is a fair question, and a "what if" type so its hard to answer. if you assume an ideal world with sane CEOs than it shouldn't matter what the investors expect. The startup should burn cash at an optimal rate to achieve the highest profit. Of course don't live in an optimal world...

Neat, but don't think its exploitable in reality, but neat indeed.

Did a bit of play around with it and it does seem to work on input fields but fortunately not on password type fields (which is logical, considering the browser is not rendering the actual characters for password fields)

http://lepunk.co.uk/font_face.html

I know of one community website that allows users to use custom third-party CSS and that shows a user's email address in the settings page, so I think you could at least leak email addresses through this (you can target a single input with the fake font, and email addresses aren't random, so the caveat of repeated characters not showing isn't that problematic).

This site doesn't allow password unmasking, but if it did that would also make it quite vulnerable on this front.

> considering the browser is not rendering the actual characters for password fields

Unless you've got a 'show password' checkbox (as recommended by Jakob Nielsen - http://www.nngroup.com/articles/stop-password-masking/).

Any info on whether the new IE/Edge click-to-show password button exposes this vector?

tried, but it doesn't seem to do

I can't make this work on my side, both Chromium and Firefox block the requests for the font resources from l0.cm (because CORS policy):

    Font from origin 'http://l0.cm' has been blocked from loading by Cross-Origin Resource Sharing policy:
    No 'Access-Control-Allow-Origin' header is present on the requested resource.
    Origin 'http://lepunk.co.uk' is therefore not allowed access.

That warning just stops the font from being visible to the victim.

I'm pretty sure the requests still go to the attacker.

> I'm pretty sure the requests still go to the attacker

You are right, they do, it's just that the returned data is not allowed to be seen/used by the page -- the "l0.cm" server still got the information.

i think thats just a matter of adding this header on the server side Access-Control-Allow-Origin:

Except for Edge, which has an "eye" symbol to show password fields content.

idk if that makes edge vulnerable to this on password fields though.

edit : I read below that Edge does not expose the password through this vulnerability.

Yes, we are doing it via images which are hosted on our server securely encrypted.

We offer 3 different sending modes: - tracking only -> the email can't be modified after sending but you get a notification when the recipient opens the mail - attachments only -> you can not modify the emails content but you can modify / remove attachments - full unsend -> you can modify / remove contents of the emails after its been sent / opened + same for attachments

Even this is flawed as gmail caches images so any subsequent edits would not be displayed!

we worked around that and it works quite well

How did you work around that? As far as I know mailchimp aren't able to so if you know how, you might have a product in itself!

very cool. did a search for a Sublime equivalent of this and found https://floobits.com/

Seems to work with IntelliJ IDEA as well. Great success!

Floobits dev is amazing. Highly recommended

floobits is really cool, although I've never really gotten into it myself because the projects I would use it on include some large (10MB+) XML files, where floobits seems to make things slow / sync slowly (at least it did when I last tried some months ago); also, it seems to either require adding all files in a dir and using ignore-files, or starting a fresh folder – I'd rather just say "share this and that file only"

For years I was only living for work. No girlfriend, no hobbies, virtually no sleep, nothing. Gradually I became burnt out, depressed and pretty fat for that matter. My productivity and the quality of my output declined as well

After a while I realized that this is not sustainable and I have to do something. I started to focus on weight loss since the results are easily measurable and I felt if I succeed that will give me positive encouragement to improve other parts of my life. Started off with simple changes. Started walking home from work (about 6km) instead of taking the bus every day. During my walks I listened to my favorite tracks or just walked in silence and thought about stuff that I wouldn't normally spend time thinking about. The change in my day to day mood was measurable even after the first week.

After a while I started doing yoga at home following YouTube videos and started meditating regularly. Yoga, besides having positive health effects (flexibility, weight loss) teaches you about being aware of your body and it's needs. I noticed that after a couple of weeks I started eating way healthier and drinking way more water (these days I do at least 3 liters / day) and way less alcohol.

In six months I lost over 26 kilos, which is obviously really nice but what is even better that I feel happier in general and more confident in myself. My life is not revolving around my work anymore. This new found self awareness also had positive effect on my professional life. I'm thinking more clearly, my code quality is better and I solve problems faster than ever.