Ombu Labs (https://www.ombulabs.com) | Software Engineer | Philadelphia, PA; Buenos Aires (ARG); or REMOTE | Full Time
Ombu Labs, The Lean Software Boutique, is hiring a full-stack software engineer to work on our products and consulting projects.
What we do: We aim to write less software. We take YAGNI to the next level. We apply lean principles to our own products and our client's products.
Why us: You will be our 4th software engineer hire. We are a small/agile company passionate about open source, pair programming, Ruby/Rails, and continuous improvement.
That is pretty embarrassing too and even a bigger vulnerability, but Dropbox released a statement about it.
I believe that owning up to your mistake and being transparent about it can only make your customers trust you more. What worries me is that Mercado Pago is huge and they never released a statement about this issue. I hope that they change this policy soon.
The fact that they allowed such a blatant vulnerability to reach production makes me question their test suite and development process. What else is wrong that we are not seeing?
I expect more transparency and professionalism from a company that processes $7.1 billion in transactions.
I'm still trying to find Mercado Pago's Security section and security vulnerability protocol (e.g. Who do I contact when I find the next security hole?)
Using their authentication mechanism, a user should only get an access token with the right combination of client id and client secret.
For at least 7 hours, anyone could get an access token for any client id, without entering the right client secret. With that access token they could see a lot of information for any account.
I know that on Round 6 they are experimenting with the Lump Sum agreement, making it easier for some startups to get 100% or 50% of the $40k in advance.
I wish they had done that with my round.
I have complained and suggested alternatives for their very slow reimbursement process. I think they are open to constructive criticism, but as any government institution change is slow.
The one thing that I kept saying to myself is that it was equity-free.
I am a round 4 participant and I went from Buenos Aires. I consider BA to have a decent startup ecosystem, but it doesn't have an entity that gathers entrepreneurs and encourages them to meet and share their experiences.
BA doesn't have a "Startup Chile" in its environment. It does have one or two incubators/accelerators but they are very selective in who gets to participate or not.
I believe the kind of synergy and energy that happens in Startup Chile can only happen in other accelerators/incubators like Y Combinator, Tech Stars, et al; or in co-working spaces that encourage meetings/networking.
The other reason to go, and probably the most important one, is that you get $40,000 equity-free.
I really like Google's paper on technical debt: https://ieeexplore.ieee.org/document/10109339
I wrote an article with a summary of the key insights in that paper: https://www.ombulabs.com/blog/tech-debt-maturity-model.html
Hopefully, the more articles like this one, the more non-technical managers will finally give a shit about technical debt?