antran22

why wouldn't you want to see your htop output on a moebius strip

I'm just wondering if there is any real modern pocket cyberdeck with the form factor of those old phones, with a slide out physical keyboard.

in that case, they should make it optional. What some might find as eye candy, other finds as nuisance (case in point, animation).

I checked this out and I gotta say it is still in a very early stage. The features they are presenting seem nice, but not very usable, with a lot of rough edges.

Then I found this issue, where essentially they left a huge backdoor open with Remote Debugger: https://github.com/zen-browser/desktop/pull/927. The guy claims that it was due to ignorance, but seeing this really shakes up my paranoia. Luckily I haven't typed any credential into the app. From a security-minded user's perspective, this is not a good sign. I hope that they would really put privacy & security forward, get some 3rd party security audits.

I sincerely hope that Apple don't pull a Recall move, because at that moment I'll be forced to migrate off the ecosystem (maybe I'll install Asahi Linux on my M-series machine).

So thank you, Apple, for not running in this arm race. Not every race is worth participating.

In the case of a serious attack, the blacklist should be every token. You can still handle this quite nicely with JWT by rotating the previous verification key. Depends on systems and configuration, this can be as easy as changing the HMAC private key or push a new RSA key to every verifier.

JWT doesn't encrypt (by default) the payload. The header & payload is passed through base64 and appended with a hash to produce a JWT. JWT verifying doesn't require making API call, and is essentially a hash check. Any verifier with a public verification key can determine if the JWT is bogus by a quick hash check and reject the request right away.

Comparing to session IDs, you have no way to know if an unique id is bogus or not. You have to check from a list, be it a cache or a database. This limits the scalability of the solution. I'm not an expert, but AFAIK JWT verifier can be stationed on the edge of the application network, and I have not checked this but I suspect they can even make a hardware solution for those kind of activity. That's definitely a big reduction of attack surface in terms of DDOS.

IMO JWT doesn't have that many moving parts. Encryption parameters are handled by libraries according to tested standards. The only real thing you need to do is to keep your private key safe.

I worked with some platforms that does. However, those usually position themselves as a code generator more than a full application builder.

- Amplication: Last I checked, they allow defining data structure & endpoints etc. before exporting to Nest.js Boilerplate with niceties. They sync to a separate branch on GitHub, so you can use it alongside writing actual logic into the boilerplate, and merge new changes from Amplication to the main branch. - Draftbit (React Native based Mobile App builder). The builder is not very great, they lack a bunch of features. They make up for this by allowing the developer to add custom JS code very easily. You can write your own Custom React element inside the editor, and with a little massaging things can fall into place. I'm not saying this approach should be abused, though. The team told us once that some of their big clients are mobile dev agencies that mostly just use the platform to Storyboard & bootstrap some UI before doing the actual logic in their own code. - FlutterFlow (Mobile App builder). I'm biased because I'm still in the progress of helping a client fixing their mess on FlutterFlow. FlutterFlow's code output is really spaghetti. The developer UX on the builder is horrible, so in the end I still opt to eject and deal with the spaghetti code.

Thanks for building Windmill. I spin up a test instance and was blown away by the well-designed-ness.

I'm looking to investigate using Windmill as a website builder for some small internal system. Few questions: - Is it possible to setup custom path for flows (to hack it into a REST API) - How can we go and make authenticated flow

You are saying "gross omission" like this is some Python script, like they are skipping the else clause for a condition. Imagine trying to land a plane that is flying at Mach 2, with no direct control, only a video feed with 4 seconds resolution, a bunch of sensors and a tank of fuel for retrograde burn to slow you down. Can you even fathom the number of scenarios that can happen. Your application may have 1 happy path and 2 sad path. Here you get only 1 happy path, a few not so happy path where your probe land sideway or just roll down a crater; and the rest of them are every other combinations of your probe's orientation and speed vector and collision location.

Hell, you can run a few thousand simulators for every scenario you can think of during descent, including lost of burner, propellant leak, etc, and then during the actual descent a chip get burnt because of a stray cosmic ray. There will still be somebody on HN call you out for cutting corner.

It's a piece of example code to demo a concept. You are asking people to error check a something akin to a curl call in a bash command.

Honestly, BBC is writing a very clickbaity title. They have only been on NASDAQ one day. Vinfast is not going to topple Tesla or Ford or GM in the next few days.

Context: I'm a Vietnamese and worked on one of the Vinfast subproject at one point. I like how Vinfast is going in Vietnam, trying to spearhead EV adoption in our country. I honestly hope they grow to be bigger than Tesla. But the product is not there yet.

IMO it's not Jira's fault (although I hate Jira with a burning passion). It's the problem of management trying to force their opinionated certainty on a very uncertain process of software development.

One of my past team used another lightweight Jira alternative, and even though the software does it best to keep things light, agile, PMs read the burn up chart as religiously as the Bible, then make their strategic decision based on the most optimistic estimation of the chart.

Agile is great at its core, but business people ruined it. And we have craps like Agile Expert.

I agree with your opinion. The problem is that managers have the notion of software estimation as a "craft". It should not be considered a craft at all, and once you held estimation to the importance of being a "craft", it is going to be a massive burden. It should be just a numerical representation of your gut feeling and past team experience.

Software engineering always has to account for uncertainty. You may try to deal with it before starting the project (waterfall) or in the process (agile). Management seems to think that by pressuring the team they can just do away with uncertainty and make their strategic planning seems more concrete, and make questionable decisions like publishing untested code. It's a power struggle all the way from the top brass to us lowly devs, but management need to understand that this is always going to bite them in the ass on the long run.

I have absolutely no knowledge in mechanical engineering before and I am now really in a youtube-binge about wrench. Not sure it is a good thing that I can get captivated by absolute random topic or a bad thing because how technology just suck up our attention.

Sorry friend, WordPress already beat you to it: https://github.com/WordPress/wordpress-playground

Ah but that's not what I am referring to. If you take a look at Vercel Postgres page [^0], you will see that Vercel is marketing a new way of writing server side rendered code, where you can write SQL code right next to the HTML-ish code for the frontend. So I'm just merely making a (meant to be humorous) comparison with PHP.

> PHP can't run in the browser.

Well actually, WordPress did it [^1] [^2]. They compiled PHP to WASM, so you can run our favorite web framework in your own browser.

I see your point anyway. Systems evolve. Tooling has to follow suit. PHP cannot achieve some of the feat today mega stack can. The problem arises when we apply the latest bleeding edge technology meant for systems that have to serve millions into our little MVP that may have less than 1000 users in your first few years.

[0]: https://vercel.com/storage/postgres [1]: https://developer.wordpress.org/playground/ [2]: https://github.com/WordPress/wordpress-playground

> everything is repeated every six months to two years

Same feeling looking at the new Vercel SQL library. Oh wow now you can write SQL right next to your client-facing code, such convenient. You have just rediscovered PHP.

To be fair, frontend frameworks solve a problem. Application can get too big that you cannot manage all the states imperatively. Declarative UI building really help to keep the UI separated from the logic. But then management get greedy and and try to shove all the features they can think of into one single big app. Like, if you went to a page and click a button, going to another page will let you know that you clicked that button and shows up some nice CTA so you won't forget. Frontend people scramble around trying to create new abstraction to keep their working surface manageable. Then you get workflows where to get the result of an API call you have to dispatch a thunk action so it would update in the global store (my example may be antiquated, I'm away from React & Redux for a little while), instead of just, you know, call it and `.then()` update the UI.

Maybe if you have an app that is twice bigger than a normal app, maybe, I don't know, split it into two apps instead? The problem of web development app right now, I think, is because people are being monolithic where it should be independently modular, and then try to cut up your backend service into pieces when a single monolith works fine.

Is there any rationale behind the decision of publishing this exclusively as an extension? Why is it not possible to just provide a public webform. I want to try it out but it doesn't support Firefox yet.

I mean, that's a very specific example of looking at it. But let me try and rationalize it:

- Books are not purely consumption. Rather, working through a good book is a very good creative exercise, because you are "creating" critical thinking for yourself. You still have to filter the intake of book for your kids, but imo there are very few books that have no value at all, because producing a book is costly to just put out junks on a massive scale.

- On the contrary, we have to agree that nowadays there are things that give your kids unbounded consumption. Very little critical thinking can be had after 2 hours of viewing mindless Youtube video. If you restrict your kids to only good content that provoke thinking, it's alright, but there is just too much crap on Youtube that lulls them to be mindless.

So, our kids are "consuming" at record high rate and "producing" at record low rate.

Even if it is a terrible tool for my purpose, I'd still want my kids to try (under my supervision) and find out the correct way to use it. Then they will be able to judge for themselves the pitfall of those tools.

But yeah, my kid will not have a smartphone/tablet until they are at least 12. It's going to be pen and paper first, then a potato computer (gotta be Linux, they can try installing Wine to play games I guess)

I have a favorite comparison between learning how to use technical devices and learning how to use woodworking tools. You have to start out with the hammer, the chisel, the handsaw for small things first. And then learn to use the lathe, the drill, the bandsaw. Jumping straight to the big tool give you the big risk of losing a few fingers.

But to what end? What more can you do with a printed envelop? ROT13 or Vignère that piece of text? Then write it with the Dancing Men alphabet?

The point is, you can only mitigate so much before it become an exercise in futility. The general counsel, if anybody, is the person that can actually bankrupt your company and get some nice money for himself using some legal tomfoolery. I doubt that if that was his intention, trying to decode a piece of base64 for a private key of the database would be the course of action that he would take.

The author was in a (then) startup. He had a sensitive document. He asked the Legal Counsel to keep hold of it and shred it after 1 days. And then forgot about it and went on and built more measure to defend against hacker, which is the more important threat actor here.

Know your threat model and expend your/your company limited resource on the things that matter.

IMHO, the key thing that we need to do is to teach our kids how to create "things" instead of just "consuming". This is important no matter which era you are in, but the average 15th century kid didn't have that many stuffs laying around for him to just consume. This problem is suddenly in our face now and we are scrambling around to try and keep our children away from the cacophony of information, but the better thing to do is to teach kids to see computers or phones as tools, and they are there for them to wield and command.

What you should actually do varies based on your kids' preferences, your experiences. You can teach them to code, to do graphic design, write stuffs. Hell, if my child feel inclined I will allow them to learn to create TikTok video, but they have to actually *create* a piece of original content, instead of regurgitating other people's ideas.

I would like to first sympathize with you. That is a crappy situation to be in.

I also agree, "deliberate" is a bit too strongly worded.

So in order to lose the domain, there is just a very few modes of failure that has a 3rd party factor. In most case, the domain-owning entity is accountable for losing the access.

You are still not looking at the definition of"domain name" in my context: the ownership context. I totally agree with you on the technical side, in most technical context a root-level domain or subdomain is largely the same thing.

In the ownership context the definition differs. Please if you want to challenge my notion of "subdomain" please only challenge this definition only. You don't own a subdomain as strongly as owning a root-level domain, because in the first case the only attestation is on the database of obl.ong/github.io/etc while in second case your ownership is attested by the ICANN registry, which is how things has been working for the past 20/30 years.

You misunderstood the definition of domain in my context. In terms of ownership, if I tell you I am owning a domain, I am owning something along the format of "${name}.${tld}". I can't say that I own the domain of "example.github.io", because, well, if somebody look up for example.github.io in the ICANN domain (provided it is not redacted), it's not going to be my name in there, it's going to be Github's.

In terms of "string that I can type in the Browser address bar to go to a website", I agree with your definition.

This should be less frequent and IMHO, under many circumstance, you are protected by consumer law (citation needed). You also have more freedom when picking the domain name (fuckmicrosoft.co is less than 2$ on GoDaddy, but good luck trying to get fuckmicrosoft.github.io).

Also one issue that I neglected to raise is this can be very unstable. If some scammer/malware use your service (I know that you have a review process, but you still won't know for sure), Google SafeBrowse may mark your whole domain as harmful. I don't know if you have a contingency for this, but you need one in place.

This is a misleading title. Not to attack the merit of the project (it's can still be used to host stuffs), this is not free domain, this is free subdomain.

The main difference is that I don't own the subdomain, and should the organization decide to forgo the domain, my subdomain is also gone. On the other hand, if I buy a domain, my name is attached to it in the registry to denote that I am the "rightful" owner of the domain, and it is going to be way harder for me to lose access to it (I read a post on HN sometimes ago that some governmental cybersec task force can just terminate access to your domain if they deem you are using it for malicious intent, but otherwise you can only deliberately lose the domain)

This is just like a github.io subdomain. IME the only true free domain service is Freenom.

IMHO serving those malware sample directly on a website is a bit unwise. The thing is, a true bad actor can still publish an encrypted .zip file of a malware under an innocent front and manipulate the users to decrypt the file, unknowingly execute the malware. When it comes to security, we should assume bad faith.

A better way of distributing malware sample for research maybe to serve them in a readonly FTP server. Your website only provide paths to the file, not the link itself. Google (probably?) won't be able to scan this FTP server.

You have to agree that verifying a website is free from a malware is not possible, while verifying that it has a malware is easy. If I play devil's advocate and say that:

1. A bad actor is publishing a malware at example.com/malware-a.zip;

2. The antivirus measure block them;

3. They move it to example.com/malware-b.zip but tell Google that the site is free from all malware, because if Google hit the old url `example.com/malware-a.zip` it is a 404;

Should Google give the bad actor the benefit of the doubt, unblock them/ or keep blocking them?

Again, I'm not downplaying the shittiness of the situation both you are in right now, but again, this is the default behavior we are all expecting from any antivirus measure.