HNHacker News
TopNewBestAskShowJobs

aclelland

383 karma · joined September 8, 2015

Hi!
submissionscomments
aclelland··on I was just subjected to the most credible phishing attempt I’ve experienced
To send money over £250, RBS still use hardware card readers for their MFA flow. You put your debit/credit card in the device, entry your normal pin and then a code that is displayed on the website. It's a little inconvenient of you don't have the device with you when you need to send large amounts of money but in general it's great to have rather than SMS.

Of course, I expect that eventually they'll move to SMS too since it's easier for them and more on line with the rest of the industry.

aclelland··on France Set to Roll Out Nationwide Facial Recognition ID Program
The lack of iOS support may be due to the way Apple restricts the use of NFC on iOS devices[1]. This seems to be changing in iOS 13 though.

[1] https://gototags.com/blog/apple-expands-nfc-on-iphone-in-ios...

aclelland··on Airbnb host ordered to pay £100k of unlawful profits after letting council flat
A "council flat" would be an apartment which is owned by the local government. The person who the council thought was living there was essentially sub-leasing it to people through Airbnb which is against the lease rules.
aclelland··on Cloudflare Network Performance Issues
Yeah, you'll want to keep your domain registered through a different registrar and if CF goes down you can update your DNS Name Servers point from CF to something like AWS Route 53.

This has a few drawbacks like making sure your Route53 configuration is identical to your CF config, ensuring your origin servers can cope with the additional load if CF caching isn't available and the DNS propagation time required for the Name Servers to update.

During the last outage, we were able to get into the CF dashboard and simply disable the proxy which allowed our clients to access our origin servers directly but this time we can't even get into the Dashboard.

aclelland··on Sign In with Apple [video]
I'd love if someone could explain if the 'fake email' address that the developer gets from Apple will be the same across all apps from the same developer? Or is there some way for the developer to link a login on one app to the same user on another app from the same developer?

I'm all in favour of increasing user privacy and the general direction that Apple is moving but we've got multiple Apps which allow users to log in via Game Centre, Facebook or Twitch to the same account. This allows them to access their friends, messages and support tickets from any of our Apps. We're able to do this because each of those providers gives us a unique identifier for each user (we only store that id and don't ever store the email address from them). I fear that Apple are going to make this impossible for us to do this going forward which would be a negative experience for our users.

aclelland··on The Death of External Storage: Where's Google?
Yeah, I had almost stopped using the free version because of the user-hostile UX they kept pushing but they had a sale a few years ago and I picked it up then.

It's like a completely different app, all the cruft like ads and pushing other apps is completely gone. You're just left with all the good stuff and those features generally all work well.

aclelland··on The Death of External Storage: Where's Google?
So does this mean the end of apps like ES File Explorer?[1] I use that app all the time to manage downloaded files and to transfer local files to my NAS / S3 buckets it'd be a very sad day when that sort of functionality becomes impossible.

[1]https://play.google.com/store/apps/details?id=com.estrongs.a...

aclelland··on First .dev Domains Go Live
Not normally but they do ban your entire account if their bots believe you've been very naughty.

https://www.bbc.co.uk/news/technology-47278362

Despite the ban being due to a violation of YT terms of service they lost their entire Google account. > "But because my Google account was terminated as well I didn't have access to my email so I couldn't see what happened."

aclelland··on Introducing Cloudflare’s IPFS Gateway
This looks great and will hopefully help IPFS grow!

I do wonder if there are any limits which CF are going to impose on these files? A few years ago there was an image hosting site [1] who was told by CF that they were using too much bandwidth on the free plan. With this gateway, can't anyone start doing exactly the same and not even have to be a CF customer?

[1] https://news.ycombinator.com/item?id=12825719

aclelland··on Paris Rolls Out Sidewalk Urinals to Tame "Wild Peeing"
https://www.bbc.co.uk/news/uk-45009337

A timely piece from the BBC about the reduction in toilet provision in the UK over the last few years. The tldr is that public spending on toilets is discretionary and councils have cut spending there since it's an easy target when needing to cut their budgets.

aclelland··on Design Thinking: B2 APIs and the Hidden Costs of S3 Compatibility
I run a service which writes around 50-80 million small documents into S3 per month and, like you, we spend more on PUTs than storage and retrieval. So reducing PUT costs is something we've looked into a few times.

We do make heavy use of the S3 versioning API to let us roll back files, lifecycle rules for past revisions and have never been able to find any service which offers the same amount of functionality with reasonable pricing.

One thing we have done which has saved us quite a lot is adding a buffer between our service and S3 which delays file writing by up to an hour in case an updated version of a file is uploaded. This lets us limit our PUT requests but still gives us hourly revisions of files if we need to roll back. Without this system we'd be looking at over a billion writes a month. Certainly not a strategy suitable for everyone though.

aclelland··on Riot Games Approach to Anti-Cheat
Great write-up. I'm my job we spend a lot of time dealing with hackers and cheats for our mobile and PC games.

We tend to see similar exploits across all our games (memory hacking, fake IAPs, etc) which lets us build an armoury of anti-cheat tools.

What I find most interesting is where hackers don't focus their attention. It took almost 4 years for them realise the encryption key for our assets was easily accessible using the 'strings' tool in Linux - once they found it we had a busy few days stopping modders from impacting legitimate players.

aclelland··on The British Are Building a Spaceport
As someone with two young children and who lives only a few hours away from the proposed site, I'm really excited at the possibility of taking them to see some launches.

I just hope that bureaucracy, Brexit or political interference don't end up with Scotland missing out on this opportunity

aclelland··on [dead]
I use a few EC2 scaling features and always find them needing a little more TLC from Amazon. There are some simple quality of life things that would make my setup simpler. Recently I've been moving some of our less frequently used services to Heroku as their billing model suites infrequent usage really well.

Of course, you have to take the suggestions and examples on this page with a pinch of salt since they're selling their own products.

off topic: it's difficulty to read this post on mobile because the social sharing widget covers up the first few rows of letters on each line.

aclelland··on ‘You can't use Brotli for dynamic content’ and other misconceptions
Cloudflare now supports Brotli compression through their Dashboard (it's in the Performance tab). We've been using it for at least a month and haven't had any issues with it.

We didn't do any before/after testing to see how much data it saved our users but the small tests we've done in the office showed around a 2-5% size reduction for our static assets which was great to see for all the effort of toggling a switch.

aclelland··on The case for electric scooters
I believe it's the same law [1] that also meant the Hoverboards from a few years ago were also illegal to ride on public pavements and roads[2].

[1] http://www.legislation.gov.uk/ukpga/Will4/5-6/50/section/72

[2] https://www.theguardian.com/uk-news/2015/oct/12/uk-hoverboar...

aclelland··on Show HN: RImind – Get AWS Reserved Instance Reminders
Hello, developer of RImind here,

I manage 4 AWS accounts for a few clients and keeping tabs on expiring RIs has been a frustrating issue for a while (not just for me it seems [0][1]).

I originally wrote RImind for my own use but over the last few months I've been improving it and making it ready for others to use.

Hope you find it as useful as I do, I'd love to hear any feedback or questions.

[0] https://forums.aws.amazon.com/thread.jspa?threadID=53873 [1] https://forums.aws.amazon.com/thread.jspa?threadID=217131

aclelland··on OVH CEO: Unlike Amazon, Google, “we will never be in competition with you”
I love OVH and have used them for a few years now but I'll echo your sentiments about a confusing jumble of dashboards and settings.

It does seem to have got a little better over the last year although their Openstack cloud service is made a little more difficult to manage because of their pre-paid servers discount being tied to a specific instance, it makes auto scaling difficult.

aclelland··on Object Storage: AWS vs Google Cloud Storage vs Azure Storage vs DigitalOcean
S3 will sometimes return a "503 temporary error" response if you start writing lots of files per second. From my understanding, if they see that your bucket has a constant high write rate they'll make some configuration changes in the background to accommodate the higher write rate.

That being said, last month I wrote over 60 million files to S3 and the number of failed writes were tiny (solved by simply retrying the write)

I've not used DOs spaces yet, I'd love to know if they guarantee read after write consistency. I know S3 has some issues with that depending on use case. Maybe it's time for another look at spaces.

aclelland··on New Tech Centers Sprout in Europe
Edinburgh is fantastic and definitely a great place to live and work!

I work just a little north in Dundee. A great little city with a growing reputation[1]. If you're ever looking for a job in the games industry there are lots of companies based in the city. They tend to be smaller indy places although there are some larger companies too.

[1] https://www.bloomberg.com/news/features/2018-01-02/where-to-...

aclelland··on How not to run a CA
It looks like Trustico had a feature on their site to generate all of the required public/private keys on their website. If you used that form to generate the keys then they'd also store them on their servers.

From my reading of the available data, it would explain why not all of Trustico clients needed their certificates revoked. Some of them will have generated the keys locally, not using Trustico's onlike tool.

aclelland··on Flight Sim Company Embeds Malware to Steal Pirates’ Passwords
I work at a games company, I get that hackers take up an enormous amount of developer work but reading this article made my jaw hit the floor. This couldn't have been a single developer making the decision. There must have been multiple levels of management involved and no-one saw the legal or moral issues?

To make matters worse, the additional statement at the bottom of the article they outright admit they used the tool and it wasn't a mistake:

>We found through the IP addresses tracked that the particular cracker had used Chrome to contact our servers so we decided to capture his information directly

aclelland··on Cloudflare Workers: Run JavaScript Service Workers at the Edge
Are you able to talk about the pricing structure? Is this going to be per request, total cpu time, etc?

edit. In another reply you said that pricing hasn't been finalised which is understandable. We've got a few use cases which CF Workers would be ideal for but we'd be looking at 10-15k requests per minutes which could get expensive if pricing is per request.

aclelland··on Cloudflare Stream – Combines video encoding, global delivery, and player
The lossless compression example is, I think, taking about image compression.

Other CDNs charge for bandwidth so why would they offer their customers an easy to use 'optimize images' feature, it'll just lose them money. Cloudflare can offer it because making your images smaller saves them money.

This will be an interesting option for anyone who publishes videos but speed, integration complexity and pricing are going to be key.

aclelland··on Google Chrome to stop autoplaying content with sound
It appears that there is already a feature in Chrome for Android which allows this. It will be removed around the same time as this patch to make things more 'consistent'

>Removing the block autoplay setting that is currently available on Chrome for Android

aclelland··on AWS is down
It appeared to mostly resolve itself after 15 minutes but we're still seeing reduced req/m

https://imgur.com/a/JAQ5B

aclelland··on AWS is down
We can't access our AWS EC2 instance which are located in the US from France or Germany. The instances are sitting behind Cloudflare.

The error message from Cloudflare is cf-error-522 :(

← PreviousPage 3 of 3