wesleyac

Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well.

I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. That's unfortunate — I'll probably try to move the stripe stuff to a subdomain to avoid it — but I don't see it as a big problem.

The HTTP security model is pretty awful, so there may be something I'm missing, but I did think quite carefully about this, and allowing people to use arbitrary HTML and JS was an intentional choice.

Is there a particular threat model you see here?

Just FYI - in many interviews, you can just say "Sorry, I'm having a panic attack. Could we do this tomorrow?". One of my friends had a panic attack during her Google interview, left came back the next day, and got the job.

So, YMMV, but people are often able to be accommodating for things like this :)

The original pens are, AFAICT, somewhat hard to come by, but we modded the pen carousel and have a 3d printed holder to put more modern pens in. With this mod, the TCO doesn't seem to high, although I didn't initially purchase/set it up, and I haven't had to do serious maintenance yet.

Not mentioned in the post, but I worked with Dan on this and I'm pretty sure he's talking about the iPad pro.

Just looked at the website, and had a very "small world" feeling:

They're located in my town O.o

Wearing bright lights next to your face with the intent of quickly flashing them in the darkness seems like a Bad Idea.

Just sayin'

Whenever people talk about new tlds, I always think mostly about names like google.con or googl.ecom. Yeah, yeah, it's cool that you can get some awesome tld, but I don't see the point. What's wrong with .com/org/net?