apeace

As I mentioned in another thread, this is where MobileCoin excels. I encourage people to give it a try.

The only problem right now is buying the MobileCoin in the first place. I live in the U.S. and the process was, uh, sketchy at best.

But if the payer in the transaction already has MobileCoin, it's a breeze from there. If your mom can do Venmo, she can do it. It's instant, fees are basically zero, it shows you the dollar amount, and it comes with the same strong privacy as Signal itself.

From what I have seen, MobileCoin is positioned to be the winner on all fronts. It's the only cryptocurrency I've ever seen that actually feels usable -- and I'm including back when Bitcoin was $10 and you could actually send transactions on the network.

There are basically two compelling reasons to use a privacy coin:

- You are doing something illegal and don't want to get caught.

- Powerful actors in the economy are abusing their power, and you want to avoid/prevent that abuse.

Most people are not criminals, so let's focus on the second use-case.

If the government created a 1000% tax on all person-to-person transactions, you can bet nearly everyone would switch off of Venmo or Cash App and onto something like Monero. Or if Apple/Google said "we are now going to monitor your bank accounts, and we will be taking a share of all purchases made from your phone," you can bet people would switch.

Another type of abuse might be political. "We will be compiling a list of everyone who donates to the opposing party."

One might argue that those abuses of power already exist, and are already actively harming the average consumer. For example, Experian's multiple data breaches[0]. But the thing is, the average person doesn't feel very affected. If you came after their Venmo or their bank account, they'd feel it.

In a way, I think privacy coins are already benefiting all of us. The "powers that be" know that it's possible for us to switch, and that we will switch if they push us too hard. So they don't push us as hard as they could.

I also want to point out: MobileCoin. Your premise seems to be that privacy-focused coins aren't in wide use, but I don't think that's a certainty. Signal has deployed MobileCoin to potentially hundreds of millions of people. But they are secretive about their numbers, so we don't know how widely it's really used. I've tried MobileCoin with friends who use Signal and it works great. They will surely beat out Monero and others, simply due to the ease-of-use they've created, and the integration with an already-widely-used private messenger.

[0] https://en.wikipedia.org/wiki/Experian#2015_data_breach

It doesn't mean that at all. When we need one feature we write it, rather than exposing the 1000 features of an open-source library to the internet when we only need one feature.

We won't write it ourselves if we aren't sure we can do it well, i.e. we're not going to roll our own encryption. Those are the types of dependencies we do use, and upgrade once a month like clockwork.

The point is not "don't use someone else's encryption library," the point is "don't use someone else's LeftPad() function that takes 3 lines to write". That gives us fewer dependencies, which makes it easier to upgrade all dependencies regularly, which is good for security.

I have a very simple solution, in three parts:

1) We use very few dependencies. We err on the side of writing our own function, library, or UI component rather than installing a new dependency, even if a "better" open-source version might theoretically be available.

2) We use a monorepo. We have two Go backends sharing the same go.mod, and three Typescript/React frontends sharing the same package.json, all in the same repo. An upgrade for one is an upgrade for all.

3) Every first Friday, I update all dependencies to the latest version. Including major versions. Yes this is a pain sometimes (like when I realized we were on Webpack 4 and the latest was Webpack 5), but if you do it consistently, it's usually not that much trouble. 1-2 hours per month on average.

In terms of security, I think this is a good middle ground. The approach has other benefits than security, too.

Right. It's not the paper or stone tablets that ever made any changes. It was the people willing to do it in the real world. So the point is that blockchains don't open up any new possibilities that weren't there before. People always could've done whatever they were willing to do. Blockchains may have some benefits, but it's not as if people starting independent states was impossible before them.

The woman's reaction to feeling patronized is a valid one. But at the same time, I think we probably want to make room for this kind of content online.

The internet is so full of hatred and vitriol. I had to leave Instagram because I couldn't stand the constant political diatribes, gotcha-style quotes and clips, etc. It just brought so much negativity into my life, and I'm much happier without seeing it anymore.

I do see the point[0] that this video is more of a virtue display than a random act of kindness. But, I think the real point of the video is to make viewers happy when they watch it, and I think that's a good thing, even if the creator has some sort of profit motive behind it.

The creator was wrong to lie to the woman about being filmed. He forced her into a situation where she felt patronized and dehumanized. He could've deleted the video and done it to the next person he saw, who maybe wouldn't have felt the same way and would've wanted to participate.

But that doesn't mean that this type of content is vile and disgusting as a category, just because it's not a "true random act of kindness." A lot of us want to see content that just, well, feels nice.

[0] https://news.ycombinator.com/item?id=32095418

Anyone have advice for creating easy-to-use-yet-secure login solutions for users who are less tech-literate?

My company is an ISP, and most of our customers are not very "good" at using technology. Any yet, they do sometimes want to log into our dashboard for one reason or another, and it tends to be a lot of trouble.

We've found that:

- Many people do not have an email. Some people don't have a phone number. Many people have only one or the other, but not both.

- People typo their emails... a LOT. I initially had some very simple validation for email addresses, until I started getting droves of emails that were one character off. I'm at this very moment working on a feature to alert users if they type "gmail.co", "gmail.con" or "gnail.com", which are all very common (and two of which are completely valid domain names by the way!).

- Some people get confused by "creating a new account" or dealing with multiple accounts in general. They'll say "my email login didn't work." Well, to me it's obvious that they have a different password for different accounts, but to them it's not.

- Building on that, they are not great at password resets. The "send a password reset to email" thing is confusing to them, because from their perspective their email is the account. Am I resetting my email password?? They don't like it so they don't want to do it.

- Since we are an ISP providing customers with WiFi, there is also confusion between the WiFi password and the dashboard password. I've had people successfully reset their dashboard password, expecting it to also set their WiFi password.

- Literacy can also be less than ideal. I once reset a customer's WiFi password over the phone, and the new password contained an exclamation point. She didn't know what an exclamation point was. I got her to do SHIFT-1 eventually, but it took a while. (I found out later that nobody else sees an exclamation point as an "upside-down i", which is what I've always seen it as. The proper way to describe it to someone who doesn't know is "line with a dot underneath".) Now my password generator only uses A-Za-z0-9 (but not 0 or O).

So, I have been learning the hard way that not every person in the world is an avid Hacker News reader who knows what accounts and password hashes are and how everything works. And yet, these people deserve to be empowered by technology just like the rest of us.

The thing is, many of these folks are able to use software just fine, it's just that they have trouble getting logged in. It really is the logging in that trips everything up.

So I've been thinking lately that I want to fix this for my company, but I'm unsure what to try.

I had the thought of trying Webauthn, but that seems unusable for me as per this comment I wrote a few weeks ago[0]. If I could solve the problem in that comment, I think a lot of my customers would use "Login with TouchID", "Login with FaceID", etc.

Anyway, my point is that no, I do not think magic links are outdated. We use a lot of magic links. Need to update your credit card? We'll text you a link. Want to reschedule your install? We'll text you a link. This is the best way we've found to actually get our software into the users' hands.

[0] https://news.ycombinator.com/item?id=31850471

I have been doing things the same way for a while. In my RPC API everything is POST (even for "getting" something), and everything returns 200.

I don't like the design of REST. I don't think status codes should have meaning to an application. Why? Because there is not a defined status code for every type of problem.

One thing I have often run into is: what status code are you supposed to use when business rules aren't followed? Let's say the resource exists, so it's not a 404, and the request is properly formatted as JSON and all the fields have valid values, so it's not a 400. But the user is trying to do an invalid action, like booking an appointment slot that is already full. What status code are you going to use?

For this reason, I've seen two types of code bases that use status codes. The first one is error handling soup:

    if (res.statusCode == 404) {
        // Display a "not found" error to user
    } else if (res.statusCode == 400) {
        // There will probably be some validation errors in the body, so display those
    } else if (res.statusCode == 403) {
        // show a "forbidden" error to user
    } else if (res.body.error) {
        // Aha! We have some error that doesn't have a defined status code.
        // This block will contain a completely different type of error handling,
        // based on information found in the body.
    }

And it's just a mess. The second one is a bit better, where they only care about 200 or not-200, and pass error information through the body:

    if (res.statusCode != 200) {
        // Error handling reading information from res.body
    }

But why put in the work to use correct status codes on the server side if it essentially comes down to a boolean value?

So my solution is to always have a boolean value called "ok", and if "ok" is not true there's always a human-readable error you can show to the user.

    if (!res.body.ok) {
        // Show res.body.error to the user
    }

There's a bit more to it since I also account for passing back field-by-field validation errors, but the point is that I'm always returning 200 and I am always reading error information out of the body. If some resource doesn't exist, the error message will say that. If the user is forbidden from doing something, the error message will say that. If the appointment slot is full, the error will say that.

There are only two places where I use status codes.

If some unexpected error happens (like the database is down), I return 500. If my frontend ever sees 500 it sends the error to my error reporting system.

If the user is not authenticated I return 401. If the frontend ever sees 401 it automatically redirects the user to the login screen.

Importantly, both of these things are hidden away in a library I wrote, so my application code never thinks about them. It just thinks about !ok.

Status codes work for things that are generic from the point of view of the client, in the sense that the client doesn't care if my database is down or if I misconfigured something or if I ran out of memory. It only cares if "something bad happened that needs to be reported to the devs", which is 500, or "this user is no longer logged in so they need to log in", which is 401.

For everything else, the client does care about the specifics of what the error means, so I need to pass it that information. Status codes don't work for that.

One of my favorite games ever was Journey, and what I loved most about it was how communication worked.

The game was online-multiplayer, where two players would work their way through a series of puzzle-like rooms together. But they would match you with a random person and you would have no idea who they were, not even a screen name.

Then, the only way you could communicate was by making a little chirping noise. Tap the button and you make a little chirp. Hold it down and release for a big chirp. If you weren't looking at the other player you would see a faint glow in their direction when they chirped, so they could grab your attention. And that was it.

There were times when I would miss something and start to continue forward, so the other player would chirp-chirp-chirp-chirp to say "Wait, look over here!" I had no idea if they were pissed at me or being friendly about it, but given how cute the whole thing was I would assume the latter. It just felt nice, like I was meeting a new friend every time.

I've gone back to that game several times over the years, but sadly nobody seems to be playing it anymore. My first time playing feels like a once-in-a-lifetime experience that can never be replicated. Really great game.

I upvoted you because I appreciate the point you're trying to make. But also: if you're fighting code for an hour without reading the error message, you need to train yourself to start reading those messages right away! This is one of the first things I always work on when pair-programming with junior engineers. Test run fails in the console, they switch back to VS Code, start adding a console.log somewhere, and I say, "What did the error say?" Their debugging time drops by a lot, quickly.

But I think your example still works, because this is something you learn to do through training and experience, not something that you inherently know to do.

Yes. The biggest problem for me is getting people to read the contents of my emails. There's nothing more infuriating than trying to get an answer to a nuanced question, only to be met with a response which doesn't actually pertain to what you were asking. Or worse: when you answer someone's question completely, and they respond with the same question again.

GP is partially right:

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

According to Reuters sources, Apple abandoned plans to offer iCloud backup encryption, out of fear of government retaliation or even spawning new anti-encryption legislation.

On the other hand, GP is responding to:

> Nobody who is at risk for this is doing iCloud backups. That's something you can already turn off.

And indeed, if you turn off iCloud backups, there is no "backdoor" into iMessage. You can also set up your phone to do encrypted backups locally to your laptop, if you want that instead.

I think there is a stroke of brilliance in this.

I don’t know about asking a coding question in-person, but I think it would work well for “take home” interview questions.

If you’re really interested in a company, but they insist you do a take-home problem, perhaps you could insist that they do a take-home of your design, as a fair trade. This would actually be a great way to see what the coding practices are like at the company, assuming they don’t take the request as an insult.

It’s probably worded that way because traffic cones confused a Waymo self-driving car, and then things got worse.

Or, Coinbase's statement that it "sources its information from public sources" is misleading. After all, the blockchain does not provide geolocation data. So what public source would that come from? That's why this article was written: because it looks like a company selling its users' geolocation data but claiming not to. Publicizing that fact may lead to an outcome where we know for sure, one way or the other.

If Bob is found standing over a bleeding corpse with a smoking gun in his hand, would it be a misleading headline to say "Bob found standing over bleeding corpse with smoking gun in his hand"?

Are you amazed that the people who use the software you build use it without understanding the underlying data model? Probably not, because you understand that the reason you make software for them is so they can use it, instead of manually doing all the underlying steps your program does for them.

Just because a tool is intended for engineers doesn’t mean it isn’t “hard” if it requires way more learning than any other tool in that engineer’s tool chain. Git is hard, even if you happen to have mastered it by now.

Is there a way to tell, from Javascript, what kind of authentication the user is going to be doing?

Do I have to tell my users "Login with webauthn" (which none of them will ever do), or can I say "Login with FaceID" by detecting that they are on an iPhone with FaceID?

I tested on webauthn.io using a Macbook with TouchID. On Safari it uses TouchID, whereas on Firefox it prompts me to insert a security key. My users think security keys are expensive and scary, but they really like TouchID. How do I only show the option on Safari when there is TouchID, but not Firefox which only supports security keys? Am I back to UA sniffing and building my own lookup tables of available features like back in 2005?

If you're having this problem, your first step is to get the recruiter out of the process. Start screening all resumes yourself.

I've had some bad experiences with recruiters, both in-house and otherwise, and I feel they usually get screenings wrong. But there's an even more important reason for you to take over this process now: you don't know where your dropoff is.

You need to get familiar with what's going on. Are you not getting any good resumes? If so, then the problem is your outreach. Are you getting lots of great resumes but they drop off after the first call? Then the problem is your sales pitch on the call.

If it's your responsibility to fill this position, then it's time to get your hands dirty in the data and figure out where the problem is.

Without more data on where you have dropoff, these are my takes on your process:

- The other commenters in this thread are right: the 4-hour assignment is likely a huge issue. I'd be shocked if you didn't have a huge dropoff there. There's no incentive for senior engineers to do this type of thing, because so many companies want to hire them. It's better to take your chances on someone who seems good, and be prepared to fire them if it turns out you're wrong.

- You should put a salary range in the job posting. You said "benefits and salary are good", but literally the only reason to not list these things in a posting is if they're not actually that good. You may need to pay more for someone very senior. They may be expecting more -- even substantially more -- than the person who just retired.

I see what you’re going for, but I agree the article snippets are a poor design choice. I keep losing context while trying to read the article. The article blocks feel like section breaks, but they’re not.

There are already links in the paragraph text, and those links are highlighted a different color. I can click on them to see the other article if I’m interested.

Maybe I am getting this wrong, but I think the reason you're being redirected through so many sites is because they're not using third-party cookies. They have to redirect you through each domain so that they can all set their own first-party cookies.

Kind of off-topic but... I clicked the "Random sample text" button and was given this:

> OOPSIE WOOPSIE! Uwu. We made a fucky wucky! A wittle fucko boingo!

I was a bit taken aback because I'd never seen this meme before. So I looked it up and I found the origins of it pretty funny: https://knowyourmeme.com/memes/oopsie-woopsie

Also, hearing the voice of Spongebob saying that really brightened my day. Bravo, MIT.

I want Twitter to embrace its true identity as a platform for rich people / companies to broadcast their brand to the masses.

If you have > 2,000 followers, you pay $0.01 per 10,000 followers per tweet. At current follower counts, Elon Musk pays $97/tweet. CNN pays $58. McDonalds pays $4.50.

Pay the same amount to reply to a tweet/thread of an account with that many followers.

Bot problem solved. No need for an ad platform, ad targeting, etc. The whole thing is just paid ads.

I tried a before-and-after on the EFF Cover Your Tracks tool[0].

Before: One in 69970.67 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.09 bits of identifying information.

After: One in 104957.5 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.68 bits of identifying information.

So according to that, my browser is more fingerprintable after enabling the setting!

I didn't expect this experimental feature to be a silver bullet, but I certainly didn't expect it to make me more unique. I'm not sure what to think of that.

[0] https://coveryourtracks.eff.org/

I'm a current player, and I think it's absolutely worth it to get started.

Other comments have covered many aspects of the game, so I'll just point one thing out: the players are super friendly!

It's funny because Eve is a game where you can -- and WILL -- get destroyed by anyone, any time. It's dog-eat-dog, it's cut-throat, it's merciless. I remember the first time I lost a 250m ISK Astero to a hunter. The cost was equivalent to hours of gameplay for me at the time. Brutal.

And yet, you know what happened next? The guy who destroyed me sent me a message and asked if I was new (he could tell). He congratulated me on what I did right and gave me tips on what I could've done better. He sent me 200m ISK because that's just not a lot for a seasoned player. He helped me refit my ship so that I could escape future hunters more quickly.

This guy went above and beyond, but that type of friendliness is very common in Eve. I'm sure there are jerks, but I haven't come across one yet.

It's not clickbaity or misleading at all, though. Eve has an official partnership with Microsoft to make an Excel integration, and the fans literally cheered it during the fanfest. I don't understand what's clickbaity or misleading in the slightest.

Tailscale's CEO has been tweeting a series of "rejected headlines" for their fundraising announcement. They're pretty funny. I thought the HN crowd would like this one:

> Tailscale raises $100M to do what any Hacker News reader could have done in a weekend [0]

[0] https://twitter.com/apenwarr/status/1521873453921583105?cxt=...

Does anyone else sense a huge disconnect here, or is it just me?

When the iPhone came out it was completely obvious how great it was. Sure there were naysayers, but they were a vocal minority predicting Apple’s impending bankruptcy while the product sold in droves. It took only a few years for smartphones to be completely ubiquitous. Once people saw it, they wanted it.

VR is not the same. The first Oculus came out in 2016, and it’s been a fringe product ever since.

Can Zuckerberg truly believe he has the Next Big Thing here? Is there some sort of obligation for big companies to tout their Next Big Thing, even if they realistically know it probably won’t take over the world? Am I just wrong and we’ll all be using VR headsets instead of laptops in 5 years?

I’m just continually stunned at how committed they are to this.

This left me wondering: if Trader Joe's were forced to stick by their written price, how would they go about charging you the fraction of a cent? Is that even possible?

Your analogy is fair, but I'm not sure it works in the way you want it to. Cryptocurrency now exhibits a lot of the same issues that the Old West exhibited then (lawlessness, criminality, etc). But the Old West didn't result in some free-market hard-currency utopia. Eventually the powers that be brought in the same regulations, police, courts, etc that governed everything else. So that "Old West" was destroyed. In your analogy, that would be the "status quo financial system" taking over crypto and either outlawing it or changing it beyond all recognition.

> I for one, take this perceived negative bias as a confirmation that Bitcoin is a genuine threat to the existing financial system.

I think you are taking things the wrong way. I, too, dislike our current financial system and want it to radically change. And I, too, hope that cryptocurrency can play a part in that. Your assumption that others feel "threatened" by cryptocurrency just because they point out the negatives isn't a good one. They are just being reasonable and fair.

> Am I just a dumb ass?

No, but be careful of becoming a shill for crypto. Don't slide down the slippery slope of ignoring things that are bad -- or claiming that they aren't -- just because crypto may align with some of your values and beliefs. I'm not saying you are. But the wording of your original post leaves one to wonder whether you value your vision of a utopian financial system above the very real tragedies occurring every day in crypto. You can both love crypto and hate those tragedies.

The reason is because the real things that are happening in the cryptocurrency space are overwhelmingly negative.

People are getting their wallets hacked, losing their savings by investing in pump-and-dump schemes, using "custodial" crypto wallets that defeat the whole purpose of crypto, raising "ICOs" that skirt securities laws, starting underground markets that sell heroin and guns, quitting their jobs to make a living in "play-to-earn" schemes that can't possibly last. It goes on and on.

If you have an article about how crypto is positively affecting people's lives (not just the lucky ones who made some good trades and profited), then please share it on HN!

I read somewhere that a large number of Ukranians are currently holding crypto as they flee the country, as they view it as a good way to transfer funds in the midst of a lot of uncertainty. If so, I view that as a positive (assuming many of them don't end up losing their funds one way or another).

I wouldn't be surprised if most in the HN community thought some form of "blockchains are a really neat idea." It's just that the technology is in its infancy, and so far it has attracted a lot of criminals, fraudsters, and speculators. Not much to write home about.