Comment by theden | Hacker News Reader

Comment by theden | Hacker News Reader

Would be interested in also seeing a "things that used to be easy but are now hard list". Feels like basic stuff is harder now:

* Privacy online

* Google search for niche or exact matches

* Browsing without captchas and blockers, especially if you don't adhere to big tech's rules for the internet

* Sending emails without worrying about spam filters being way too aggressive

* SEO before it got hacked to hell

* Barrier to entry for creatives to build things on the web (for all the flaws flash had, it bridged the gap)

* Finding real discussion and information. The growth of bots posting, misinformation, blogspam, and toxic echo chamber partisan discussion online (maybe it was always like this, i.e, eternal September?)

* MacBooks being easier to upgrade before when things weren't soldered on

* In general anti right to repair hardware

* Not having to worry about dongles, i.e. connecting USB devices to your machine

* Ransomware wasn't a thing. Nothing like a non-technical user needing to learn BTC or XMR to maybe get their data back

* Being able to buy software once vs a subscription, e.g., photoshop

* Work was easier to disambiguate from life before chat apps like Slack made employees always reachable

* CGNAT not being as common

* OAuth is still annoying to implement

* Blocking ads was easier

* Getting a job was easier for a lot of people prior to whiteboarding, leetcode tests, assignments, multi-day interviews and trials, etc. becoming more common

* GDPR making infra+dev work harder because big tech companies don't understand consent and couldn't behave, also leading to performative/annoying cookie banners we see everywhere

* Needing an internet connection for software+tools that used to be able to run locally on your OS

* Website responsiveness was easier before all the devices and monitors with different viewports

* Archival (or scraping) was easier before the majority of human generated content was placed behind login walls (fb) and rendered content needing headless browsers

Edit: Call me cynical if you want—yeah some of those programmer things listed are easier now, but improvements on the core regressions I listed would help programmers (and non-programmers!) all across the world and in developing countries more than some niche highly paid SV engineers using terraform to orchestrate infra on GCP.

I agree with all of those. More things that are harder now:

* Finding honest product impressions/reviews.

* When looking for a configuration setting or tip to use any piece of software, find a one minute article with clear bullet points instead of an 11 minute YouTube video with a personal backstory and a VPN sponsorship.

* Finding a cooking recipe that isn’t padded with SEO nonsense.

* When finding an online discussion or blog article in a search result, being able to read it straight in the (mobile) browser without hostile prompts to make an account and/or download an app.

* (Europeans only.) Publish a simple website without worrying that the hosting provider you choose doesn’t perfectly conform to privacy laws that even lawyers won’t explain to you and you’re personally liable for ridiculous damages.

* Run software developed by hobby programmers on machines you own.

* Connect devices like speakers, keyboards and mice to computers. (Edit: You mention that.)

And, completely disagreeing with the article on this one point, this is also harder:

* Writing cross-platform UIs. As someone with a lot of hate for Java from back in the day, this is painful to write, but: Java Swing might not have produced the nicest GUIs, but the stack was so much simpler than Electron+Node+Express+Webpack+React+TypeScript (substitute Svelte, Vite or whatever you want), it’s not even funny.

> * (Europeans only.) Publish a simple website without worrying that the hosting provider you choose doesn’t perfectly conform to privacy laws that even lawyers won’t explain to you and you’re personally liable for ridiculous damages.

I'm sorry but that's just FUD. GDPR fines are only for serious infractions with intent, most violators get off with a warning. Furthermore, access logs are OK because they're a legitimate purpose, as long as there's rotation.

Yes, I’m specifically in fear, uncertainty and doubt. To be clear, I’m fully onboard with the intent of the GDPR, but I have no idea how to follow it. And “you’ll be okay, the fines are probably small” is exactly the kind if statement that causes anxiety.

I’ve recently tried to figure out if it’s okay to use something like Cloudflare Pages to host a blog. That’s not an esoteric question, but I was unable to get an answer. They’re not based in Europe, the log retention policy is a bit unclear, regulators seem to be disagreeing on whether even their CDN is okay (and Pages is built on top of the CDN). And in Germany, the real danger isn’t a regulator fining you, it’s a private lawyer sending you an “Abmahnung”. Which they will do for any trivial infraction, often using automated platforms.

Are you located in Germany? If so - welcome to the boat.

From experience I personally would not host on CF pages. But, depending on the content and intended audience CF pages could clearly be argued under legitimate interest. You would/should probably have a TIA in place and state that in the privacy part of the site.

I know people arguing legitimate interest when using Webflow. Also clearly PD being transmitted towards a non EU country there.

As said. Personally I would go with something like uberspace.de as I just like their offering and the fact that I always have a human replying and being helpful when something breaks because I fatfingered it.

Yeah, Cloudflare Pages is out, same as Github/Gitlab Pages, Netlify and all the other free offerings Hosted by a US Company.

Social Login Buttons are probably a problem too, if they automatically redirect. Could be considered a transmission of IP.

Game Servers that connect to Steam on client connect are probably a problem too.

I like the idea behind GDPR but the implementation is a fucking shitshow.

Agreed. To add to that I would say that publishing a website (if you yourself don't do tracking, advertising, affiliate and all that) is in no way impacted. A simple web site without cookies and not transferring user data elsewhere but the hosting webserver is not impacted at all.

At least when hosting with an European host.

One needs an imprint and data privacy page. But both is easy (except in specific cases like for MDs that need to add just a little bit of information in the imprint).

I support small businesses with their web activities. It did not get overly complicated through GDPR.

> One needs an imprint and data privacy page.

Really? I have a small personal website with no tracking; I guess my hosting provider collects server logs, but do I really need a privacy page for that?

An imprint is something I've only seen on German websites (I recall reading somewhere that those are required by law there).

In Germany every site that collects, stores and/or processes personal data (PD) is required to have a data privacy explanation that is easily reachable from every page and explains to the user what data is being received, stored, processed and also explain the user's rights (for example the right to be informed, to correct data and so on).

At first glance, a "private" page does not directly process personal data and would therefore not require a privacy policy.

So if you don't use contact forms, advertising banners, social media plugins, etc., you should be on the safe side.

What most don't see: The server on which pages are located (hosted) collects personal data in the background in the form of server log files. These log files contain IP addresses, these addresses are personal data.

So yes. Even if the server doesn't log the IP to logfiles as it still receives the IP every site needs a privacy page.

There are good privacy page generators, though. Free of cost.

> In Germany

Well, I'm not in Germany... you didn't mention in your original comment that it only applies to German websites!

Germany is the only country I can speak of from experience. Not sure about the other EU countries, but would expect similar regulations.

Everybody else. Officially if you target European audiences you would need to adhere to the same regulations, but practically nobody could reasonably enforce it.

Well, as I mentioned, I've only ever seen an imprint on websites from Germany, so I think you're conflating EU and national regulations.

What if I run something like a good old phpbb just as a hobby. What would I put on that privacy page? You enter your email address on sign-up. It's visible in your profile. You get notifications to it if you subscribe to topics. Isn't it kinda obvious it is stored? What if phpbb logs IP addresses for every post? I know it did in the past and don't remember there being an option to have that purged after a given amount of time. Can I do that? Do I need to put an imprint on the page, or is a contact form enough? Maybe I don't wanna put my name and address openly on the web. So I guess I'm just way to afraid to host a forum in Germany for my local sports club, because I don't wanna get hassled by lawyers who made this their business model. Better open a Facebook group, this is certainly much more privacy friendly.

Oh boy you have no idea how horrible it is. Check out the latest rulings in that regard. Google Fonts is a big no now. Everything that "transmits PII (including your IP address)" is problematic. Its just a matter of time until all those free static site hosters (github/gitlab pages, netlify, etc) are targeted, cloudflare probably too. Our legal council already told us to "at least add some notification that people are leaving the site" if they click on the social login buttons ... because it could be considered transmission of the IP because of the redirect.

Ain't it Google specific?

"cross platform" isn't well defined these days, since it may or maynot include mobile and/or browser platforms. That said, Qt is much better to use than Swing ever was, and really no more complex until you want to do things you could not do in Swing anyway. Gtkmm too, from my personal (21+ years) experience.

Recipes: finding a recipe that doesn't start with 1000 words on why this dish makes the author cry because it reminds them of their dearly departed Nana, followed by anecdotes about Nana.

Logging into an online account on a computer you don't normally use when you don't have your phone. This can range from "had to jump through a bunch of extra hoops" to impossible if you haven't saved backup codes ahead of time (Google).

My wife lost her phone when we were on vacation and it was literally impossible for us to login into her Google account in order to use find my Android.

We were trying to login on a relative's PC to use find my phone, but it was a catch 22 because we need a phone to login to Google on a relative's PC.

I pity the fool who loses their phone in the age of 2FA.

> I pity the fool who loses their phone in the age of 2FA.

This keeps me awake at night. Especially as it is no longer possible to contact humans at a lot of sites to prove who you are. I went to jail for eight years, when I got out I could only access two of the thousands of accounts I had made over the previous 20 years.

> My wife lost her phone when we were on vacation and it was literally impossible for us to login into her Google account in order to use find my Android.

This is a really frustrating situation.

That's why you always copy the secret recovery codes for the 2FA(which may not be helpful if you left your notebook in your home country during vacantions).

That's why Google often prompt you for backup information - backup phone number, email address, which can be used to recover an account if you've lost your phone.

There are ways to provide backup factors without tying them to more personal information, however.

There's always a tradeoff though. With more secure backup factors, the more likely it is that you could end up locked out with no recourse.

I try to be disciplined about having critical information printed out, especially when traveling internationally. I expect more so than most people. And I do still carry a separate (small) wallet. But we're pretty much all increasingly dependent on our phones for more and more things.

ADDED: And thank you for mentioning that. I just realized I never transferred my Google authenticator setting to the new phone I got last year.

I can't really see this as the negative you imply it to be. This seems like complaining that you might get locked out of your house if you lose your keys. There are certainly better and worse forms of 2FA, but I would like more pervasive (well-implemented) account security, not less.

The main key is the password, and we didn't lose the password. What we lost is the secondary, rarely-used-key that you only need when logging in on a new device or at new location. So if you don't leave home much, it's easy to forget that your online account access is totally screwed without your phone anywhere else. My wife's Google account doesn't require TOTP to login, so she never needs her phone when logging in at home, yet the phone is mandatory when logging in for the first time on a new device or at a new place. This creates catch-22 situations for people unaware of this behavior like it did for us ("we need to login to find the phone but we need the phone to login").

We learned our lesson, but I'm sure there are tons of other people that haven't learned this the hard way yet (but will eventually). I could see this becoming an easy way to sabotage/get revenge on people - steal their phone while they are on a business trip/vacation and then they are locked out of all their online accounts with no way in unless they had the foresight to keep physical copies of backup codes in their wallet/purse.

A better analogy would be the locksmith refusing to let you in because you can’t produce the deed, which itself is in the house.

I agree. My SO is nowadays so frustrated by all the security hoops and pseudo-security hoops like Gmail regularly stopping to work with her Thunderbird (she regularly needs to setup a new app specific PW). Other spps/sites sending SMS, others forcing you to use their app for verification and not one standard to get used to.

I am used to this from work but even there MS pesters me to install MS authenticator while I clearly always just use my regular 2fa solution.

And because I think the state of 2fa is not user friendly my own solution is not very secure by using Authy with a client on every device. So there is no second factor. I just copy paste from the app on my computer and don't need to grab my phone.

My phone screen suffered a bad accident, to the level of unusable. 4 weeks for a repair.

I needed 2FA to access company services. Email, chat, VPN etc. Which of course, was on my phone.

I emailed IT Support from my personal email to request a temp token. My ticket was closed, with a message saying "Email tickets are no longer accepted, use the service portal."

I needed 2FA to access the service portal.

Luckily I had a co-worker on a non-company chat service, so they opened a ticket on my behalf...

> * Privacy online

Privacy is a lost cause, the younger generations don't care.

I remember when people were warned about sharing their real information online. over 50% of people I knew were just nicknames on the internet. I had zero clue about their gender, where they lived or what they did for a living. Didn't affect our conversations the least bit.

Now everyone is plastering their faces everywhere they go. Every picture they take has their face next to it. Usually along with their name, the location and the exact time they were in there and who they were with.

>over 50% of people I knew were just nicknames on the internet.

Depends on the circles.

On the other hand, I accessed Usenet from a company computer which had my real name and company email. And the local forum on my BBS, most people used their real names and we even got together in person from time to time.

I’d say the non-technically inclined groups of people do not care. Instead of privacy being dead there will always be a corner of the population that does not care. That is okay, let them be the fuel for the corpo machine.

Really? On almost all Discord servers I've visited, everyone has a nickname and doesn't share photos of themselves.

On Instagram, I've also noticed a lot of young people who share e.g. art have a completely anonymous profile (and I guess probably another, non-anonymous profile for their friends only).

Not sure about Snapchat or TikTok, though.

The problem with Discord and anonymity is the fact that it's really tedious to have multiple Discord accounts.

Let's say you want to keep your work, hobby and private profiles completely separate. You'd need to have one with the official client and the other two with a separate browser each. Also you'd need to be super careful when joining a new server for any category to make doubleplussure you're not joining with the wrong profile.

IME Discord anonymity is more like ‘your friends know it’s you, but strangers can’t find out your real identity’. But I agree, they could do with a profile switcher.

> Not having to worry about dongles, i.e. connecting USB devices to your machine

The dongles. OMG. It's worse than the parallel printer age. I cannot recall another period in history where I needed a dongle so often. USB-C only on Macbooks was such a huge design mistake. Especially in the era of USB-A! Soooooo many things are still USB-A. All for a little more thinness! It's really grating.

USB C and the removal of headphone jacks are an example of how not everything in American society is "market driven" but can easily be imposed on the whole market and consumers by a single big player.

How is that? There are still plenty of devices with USB A/Headphone jack available. Apple devices are far from the "whole market".

Installing Windows without a Microsoft account

That's false. You can still install Windows without a Microsoft account. Granted, it's harder now to see "Use local account", but it's still there.

That's false because it's true? I don't even...

Your comment highlights exactly how the GP fits the “things that used to be easy but are now hard list”

How about win 11?

Yeah, what about Win 11?

https://filestore.community.support.microsoft.com/api/images...

I suggest that "barrier to entry" also includes getting started programming in general. Too much to choose from, large leap in skill level required from text in a terminal to graphics on the screen, etc.

I question if that's really true given all the libraries for languages like Python, online tutorials/projects, and various types of low code environments. Sure, you need to figure out what your options are (or have someone show you) but I question whether it's really more difficult to do something than firing up the BASIC interpreter and typing in code from a magazine.

The worst part is when people somehow think all these things necessarily must follow from the things that are easier rather than suggesting we could have the good things without the worse off things.

The “old web” — the one before the rise of the trillion dollar engagement optimizing platforms — is probably completely foreign and unimaginable to those who haven’t experienced it.

Well, and before "the masses" really had access to it.

I do wonder what they'll think of it when (if) they get to experience it.

* Making sure you're not being spied on

Not sure if this was ever easier, but to me it seems it got harder. With all the possible attack vectors, ranging from chain of supply attacks hard-coded deep down on the cpus, up to malicious dependencies being replaced everyday on npm, how does anyone trust their machine?

The Flash authoring tools still exist, they’ve just been renamed Animate, and they export to HTML5.

I would argue getting a job is easier now. Prior to whiteboarding and take home assignments, if you didn’t go to a top tier target school and have excellent 3.5+ GPA it was really difficult to even get your foot in the door for an interview.

When was this? Maybe If you’re talking exclusively about FAANG.

I’m too young to know from my own experience but from what I’ve heard early 2000s.

I was around in the early 2000s, and you certainly didn’t need a 3.5 GPA from a top tier school for anything but a very small handful of companies.

In the early 2000s, you could get decent work just knowing HTML.

CGNAT will be here for the forseeable future and I wouldn't be surprised if ISPs end up deploying some version of CGNAT on IPv6, assuming they're somehow forced to use IPv6 in the future.

Why would they want to run CGNAT on ipv6?

I can think of couple of reasons for it

- they get money for selling static/public IPv4 addresses right now and they wouldn't want this money going away when IPv6 arrives

- can't imagine how the world will look like with shitty insecure routers everywhere and everyone having a public IPv6 address, ISPs might provide NAT connections to protect non-tech people

If I'm not mistaken, one of the largest ISPs in my country has begun to roll out IPv6 but it was either broken the last time I checked or it had some form of NAT on it.

* email delivery

Connecting your laptop to internet via an Ethernet cable

Makes me wonder how many sites are still useable with Lynx

Our online discourse is already saturated with cynicism and pessimism. Do we need to bring it to this thread as well?

Then again, given the contrarian bias of HN comments, I guess it's natural.

> Getting a job

Though negotiating is way easier with things like levels.fyi and blind.

The points made upthread would seem to apply to a very narrow slice of jobs. In general, finding info about companies, reaching out to people you have connections with, etc. seems easier than newspaper ads, form letters to HR departments, etc. Though then and now, personal networks are probably still the most effective path for many.

Reply on news.ycombinator.com