WordSkill

MarkMonitor supports UF2, Cloudflare does not.

U2F allows you to secure your account with hardware tokens, such as Yubikeys.

Cloudflare does support "soft 2FA", which is two-factor authentication using apps, which is good, but could be vulnerable if a remote hacker gets hold of your 2FA secret by, for instance, compromising your password manager.

If you are keeping it only in the app but lose or break your phone, you will have to go through a verification process to regain access to your account. This process is, itself, a huge target for hackers.

For protecting domains that are important to your business - and, indeed, protecting your Cloudflare settings - nothing beats having two hardware tokens associated with your account, each located in a separate, secure location. They are inexpensive, do not need to be recharged, are almost impossible to break, are easily hidden and, if you lose one, you can use the other until your replacement arrives.

I presumed most existing co.uk owners simply moved to the far simpler, more memorable .uk TLD, ditching their old domains along the way. I know I did.

As a big company, they pay their processor(s) far less than you or I pay Stripe or Ayden.

For the marketing dynamite of being the only $8.03 "at-cost" registrar, they are going to take a payment processing hit of around ten to fifteen cents per domain. They could shift that cost to the price, but then they would lose those invaluable bragging rights.

The point is not that customers save a few cents, but the absolute transparency of paying exactly the registry cost + the ICANN tax. The simple math of $7.85 + 18 cents implicitly suggests that you are dealing with an utterly fair company: not a penny more, not a penny less. $8.03 will gain the attention of the big companies they want to attract in a way that $8.13, $8.18 or $8.20 never could. In this context, $8.03 is actually a far more powerful price than $8.

There are plenty of other costs associated with running a registrar, not just payment processing fees, but the whole thing is intended as a loss-leader to attract new users and coax their existing, non-paying users into a paying relationship. From there, with a credit card on file, it becomes far easier to sell them higher-margin services.

It will also deepen their relationship with their existing paying users, making it a lot harder for competitors (present or future) to lure them away.

When you consider the cost of customer acquisition through normal marketing channels, positioning themselves as the only "at-cost" registrar is a stroke of genius. Reminiscent of Apple disrupting the phone business, Cloudflare have chosen to disrupt a particularly messy, flaky industry that no customer loves. If they manage to pull this off at the $8.03 price, it will catapult Cloudflare to a whole new level.

Not wholesale, Porkbun are adding 10%.

Zack, please DON'T waste time on email, focus on security.

The category of customer who consider the flaky email solutions provided by registrars to be worth using, and who are unaware of how to hook their domains up to free forwarding at services such as Mailgun, are unlikely to ever buy your higher-margin services.

Your introduction of at-cost domain registration will already blow everyone away, you do not need email for that, but high-value domain owners will worry that the service will not be sufficiently-resourced to protect their domains. Those are precisely the domain owners you want because they are more likely to end up paying for your other services.

So, try to finally get U2F support in place before you spread your legs for mass domain registration. Real, proper U2F support that encourages users to associate TWO different hardware tokens with their account will save you from the tsunami of domain jacking attempts you are about to experience.

The point of having two different hardware tokens, kept in separate locations, is that it becomes far more unlikely that your support will ever have to deal with them. As long as they can continue to access their account with one, they will have time to buy and associate a replacement.

Meanwhile, any hacker attempting to socially engineer your support would be left with the tough job of having to explain how they managed to lose both tokens at the same time - they won't bother, they will move on to some other registrar that is too dumb to implement U2F.

You save your staff a world of hassle, you protect your reputation from a potential PR nightmare, and the high-value domain owners will be more than happy to bear the $95 cost of two Yubikeys. You just have to make it possible and gently encourage users in that direction.

457 upvotes and 212 comments in less than 20 hours would suggest there is legitimate interest in this announcement.

You are correct that their CTO has submitted 16 posts this week (not all of them from their own blog), but I don't see the harm in that: less than half of them attract any comments at all and quickly slip beneath the waves.

Also, to be fair, it has been an unusually busy week, as they had a "Crypto Week" during which they announced something genuinely interesting each day, and their 8th birthday was a fair excuse for a navel-gazing post.

No, Transferwise provide balances as part of their "Borderless banking" accounts: https://transferwise.com/gb/borderless/

I second the request for the .UK TLDs.

Yeah, very surprising. Perhaps companies lose the ability to get this stuff done as they grow larger.

An even more shocking example is Transferwise, supposedly a cutting-edge star of the "fintech" scene. They use SMS-based codes, a wildly insecure form of OTP. Over a thousand employees and they cannot even implement some sort of app-based TOTP (such as Google Authenticator) to protect their clients' money.

Price: $8.03 vs $14.99

I have used dozens of different registrars over the past two decades and found Fabulous.com to be by far the best on price and technology. Unfortunately, they now have no plans to support the new CDS and CDNSKEY protocols which would be handy for anyone managing a large number of domains.

What Fabulous do have, however, is an "Executive Lock" feature, which is an optional additional layer of verification that the domain owner must go through before a domain can be transferred away from his account. They also support U2F, which allows the use of hardware tokens such as Yubikeys.

Domain protection features such as these are vital if a registrar does not want to be swamped with jacking attempts and the PR disaster of actually losing domains.

I am surprised that Cloudflare has not already followed the fine example of companies such as Dropbox, Github, and Google by supporting U2F. A quick search shows that Cloudflare customers have been publicly asking for this for at least 3 years. When they introduced TOTP 2.5 years ago, they stated that they would support U2F "shortly".

In the context of being a domain registrar, supporting U2F would be even more useful, dramatically reducing the number of domain jacking attempts. Proper support would encourage customers to associate TWO hardware tokens with their account, each stored in a different location. Supporting only one, as AWS have recently done, leaves them wide open to social engineering, with impersonators claiming to have lost their one key.

They are insane.

They should be finding a way to compete with RunCloud's far better product and pricing (unlimited servers), not committing business suicide by charging for every domain you use on your server.

Under their new pricing, the plan that comes close to the features of RunCloud's $10 plan costs $10 per server and $1 per domain per month. They expect their customers to pay more for each domain than they already pay for domain registration every year.

Just to be clear, the RunCloud $10 not only has better features, it also allows unlimited servers and unlimited domains.

The only way ServerPilot works out cheaper is if you are willing to use the more basic $5 plan and will never have more than one server and 9 domains.

It has been down for a couple of hours.

I mentioned that in a comment here and, for reasons I don't understand, was immediately downvoted. I deleted the comment in case there is some sort of HN 404 taboo I'm not aware of.

I'm a big fan of N26 too but I longer go around evangelizing it to my friends and family. I got literally hundreds of people to sign up last year.

I only discovered that support was no longer available in the app when I actually _needed_ support, it was frustrating wasting time trying to find something I was sure I had seen in the app before.

So, I still use my N26 account, and appreciate it in many ways but, if they are capable of making bad decisions like that, there will obviously be more cost-cutting once they have solidified their position in the market. I cannot, in good faith, evangelize a service that may end up being as bad as the traditional banks.

Technically, you _can_ have a savings account, but the paperwork burden for the foreign bank is so high that it breaks that product's financial model, so, they don't make it available to Americans.

Living and working in Asia for many years, I always sympathized with the difficulties my American expat friends had in trying to open any sort of local bank account at all, even a current account. Most banks say no the minute they hear you're a US citizen.

Not being able to open a bank account in the country in which you live has serious knock-on effects in terms of getting paid, or renting a home. I am eternally amazed that American citizens, who supposedly value personal freedom, put up with having one of the world's most aggressive tax regimes.

Not true of all N26 countries.

Terrific, I am now using your Chrome extension.

Please also add the "search by this image" link, which Google also removed.

It was not endorsed in the legal sense, the writer is using that word to justify his claim, in the title, that the plan has the "green light".

Endorsed, in this context, means that it was mentioned in cabinet, and the soldiers present agreed that it sounded like a fine idea. This is no different from all the other times it has been discussed, but nothing has actually been drafted, given the go-ahead or any sort of actual green light. This is just the usual spit-balling and bullshit.

The best way to tell when a Thai expat website is trying to magic up a story out of nothing is that none of the other major expat websites have bothered to mention it. When a real new visa is introduced, such as the current 10-year visa for retirees, you will see it being discussed on all the sites.

Chiang Mai is the nicest city but all of Northern Thailand is affected by terrible air pollution in March and April, you simply get out of town during those months.

The confusion about whether or not it is "as big an issue as some people make it out to people" is because influential members in the various forums and Facebook groups have a vested interest in down-playing it, their business in some way benefits from having a steady stream of nomad newbies arriving throughout the year. They try to shout down any mention of it, and will outright lie when someone asks a question such as yours.

Do real research on particulate pollution and look at the stats. The haze is genuinely bad for your health long before it becomes as visually obvious as it does in those months. A year in which the smoke season is considered to be "not so bad" can actually do more damage, because people are inclined to spend more time outdoors.

My opinion is that, although Chiang Mai is relatively cheap, no-one should move here unless they can also afford to spend those two months elsewhere in Thailand or South East Asia. Most Westerners on tourist visas have to spend stretches of time away from Thailand anyway, so, I treat the smoke season as an opportunity to spend time in Vietnam or The Philippines.

This article is a good example of the primary form of click-bait used by websites catering to the Thai expat / digital nomad market. No new visa has been introduced, and it is unlikely that anything along these lines ever will be, no matter how many times it is suggested in expat forums or Facebook groups for digital nomads. All the expat websites know this, but they keep pumping out these articles because they are, by far, their most reliable source of traffic.

Every foreigner who spends time in Thailand indulges in the fantasy that their bizarre visa system will, somehow, be fixed to allow "good" visitors to spend longer there. It seems obvious that this _should_ happen, that the Thai people would benefit financially, but it would not be in the interests of the Thai elite, and that is the only things that currently matters.

The complexity of German taxes and all the other red tape seems to be the main reason why people change their mind about starting up in Berlin but, personally, it was the rudeness that wore me down.

Berliners can be very nice in certain situations, such as the people you work with, but they have a hostile service culture. Not every time, or in every service situation, but you will have enough bad experiences in shops, restaurants and trains to find it annoying, especially if you are accustomed to the more positive service culture in the US, UK and Ireland.

The other problem is that many Berliners regard young foreign workers as being the reason why rents are increasing and this became a political issue a few years ago. I'm not sure what the current situation is but, at that time, you would see graffiti around town, letting you know that you were not welcome, and you would frequently hear the same sentiment expressed in social situations. Ironically, the people who were quickest to let you know that the foreign tech workers were not welcome were the same "anti-fascist" trendies who call everyone else racist.

This hostility wasn't something I experienced when living in other German cities, it seems to be a Berlin-specific phenomenon.

These seem to be terrific new features, I am surprised that Cloudflare announcements get such a muted reaction on HN these days.

To really hit it out of the park, and get people excited again, Cloudflare should introduce a $10 per month Extended Validation SSL cert, to sit alongside the $5 per month dedicated SSL certs they introduced last month.

It may seem trivial but, when recommending Cloudflare to non-technical clients, that green bar would be the perfect starting point to perk up their interest and carry their attention through to the other advantages.

My hunch is that EV certs, priced reasonably, would be the tipping point that persuades an unprecedented number of sites to shift over to Cloudflare and, once onboard as paying customers, it becomes a no-brainer decision for them to pay for other features too.

Info I would find useful in deciding to proceed with Atlas:

1. What are the ongoing costs for a company which, worse case scenario, makes little or no money?

2. What are the costs to close such a company, fulfilling the likely tax and regulatory requirements?

I do understand that Stripe is not a law firm or an accounting firm, and I have read through the publicly available documentation. Even so, I find myself uneasy about the possible downsides of getting tangled up with the US system.

Obviously, if everything goes well nothing will be a real problem: the money coming in can cover all sorts of ridiculous fees, tax demands and ridiculous bank charges. I am sure, however, that many potential owners are, like me, more focused upon the possibility that they might find themselves in a financial and paperwork blizzard that will drag on for years.

I am grateful that Atlas makes it easy to jump in, but how difficult will it be to jump out if necessary?

Related: I get that making the entire Atlas Forum members-only adds to the perceived value of membership, but it is frustrating for potential applicants who are hungry to hear about the experiences of others. Having just one open section would almost certainly encourage more people to go ahead and sign up.

Anyone asking how a malicious submitter might have guessed that his patch would receive no oversight should take a look at the official directory for Joomla extensions, JED, where it has now become next to impossible to work out which extensions are actually good thanks to being overrun with fake reviews and ratings.

These directories are useless if the system can be so easily gamed. The scammy owners of low-quality extensions learned, long ago, that no-one is applying even the most basic checks to reviews, so, anything goes. Fake reviews defraud users and are a serious disincentive to honorable plugin developers, trying to gain momentum through hard work and genuine support. This hurts Joomla.

I know the full-time developer of an extremely good, complex, long-standing Joomla extension who has tried, in vain, to get the Joomla leadership to address this issue, because it is clear that certain extensions are dominating their category with a stream of obviously fake reviews, but they won't even acknowledge the problem.

A similar complaint to the WordPress.org plugin got the fake reviews removed in less that 24 hours. I don't want to get into tribal warfare over the relative merits of these projects - I want all Open Source projects to thrive - but it is worth noting that much of the success that WordPress has enjoyed over the past decade is down to being able to motivate participants to pay attention to the small, unglamorous details such as the integrity of their directory reviews, such things reflect the care and attention being applied to a project as a whole.

"... then it utilizes DnsMasq to proxy all requests to the .dev TLD to sites on your local machine"

This seems a poor choice as local TLD given that .dev is now an actual, real world TLD.

A far better choice, that would have served as a constant reminder of the Valet name, would have been .val

Yup, ignore anyone who understates the problem (some prominent voices in the nomad forums are either in denial or have a vested interest), it is absolutely lethal during March and April. I love Chiang Mai but will be leaving on Friday night, probably returning mid-May.

My London linode has been down for almost 4hrs now.

There was a problem ten days ago too.

Europe is broken.

Kinematic for Mac has a sweet interface but, as far as my testing has been able to discern, it only works with the six recommended images.

All of the WordPress images available via Kitematic's search failed to work, which is a pity because it would have been the most immediately useful application for the greatest number of users. I don't know of many people actually using the much-hyped Ghost blogging platform.

A "product" with no prices listed, just the shady practice of forcing you to contact them and having them work out a "quote" for you.

I really hate it when companies feel they cannot be transparent about pricing, it is such an obvious strategy to work out how much they can squeeze out of each potential customer. How are you meant to trust a company like that?