Hacker News Reader

“.. but we encourage using one of the many URL shortening services that are available, instead of git.io, as we will be deprecating the tool in the future.”

beermonsteron My first three months with a Nokia dumb phone as a daily driver

You can always do what I do. Delete 90% of the pre-installed apps from a Smartphone and disable most notifications. Then be really really discerning about what you then install to that base from its App Store. Effectively turning a smartphone into a dum phone/feature phone.

beermonsteron The Eyes Have It (1953)

Philip is Greek for lover of horses i.e. ‘Horselover’. Dick is German for fat. So Horselover Fat = Philip Dick.

beermonsteron Digital board game Pandemic has been delisted from Steam without explanation

Also https://news.ycombinator.com/item?id=29965600

beermonsteron Woob: Web Outside of Browsers

Eons ago there used to be a type of service on the web that allowed you to send a URL to a mail server. It would fetch the content at that URL and email the article to you.

I can't for the life of me remember what that type of service was. It was back in the era of anonymous remailers.. any ideas?

beermonsteron DuckDuckGo Traffic

Anecdotally I’ve noticed the DDG search result relevance/quality improve a lot in that time too.

Well done DDG - I rarely use Google search these days. I’ve found the search operators work more reliably too which is great for locating specific results you know you once saw somewhere and should’ve bookmarked.

beermonsteron The Mac Malware of 2021

One such alternative is from objective-see [1] and it's great.

[1] https://objective-see.com/products/lulu.html

beermonsteron Best Pens for 2022: Gel, Ballpoint, Rollerball, and Fountain Pens

Moleskine paper is horrible which is a shame as the rest of the product is good. Sadly that’s one of the most important parts for me - especially if using a fountain pen or rollerball

beermonsteron Best Pens for 2022: Gel, Ballpoint, Rollerball, and Fountain Pens

I have a Rhodia with a pen loop so might be worth checking again as they may have extended their range

beermonsteron Best Pens for 2022: Gel, Ballpoint, Rollerball, and Fountain Pens

That was about Japan’s Paper Culture but was very well written and liked.

Regarding JetPens, they’re great at mixing valuable information with a superb product line and customer service - very rare in 2022. It’s I used to like going to brick and mortar shops in the first place. I find it’s becoming less and less common to find a salesperson that knows anything about the products they’re selling (outside of niche shops). Which means although I do try to use local shops where possible, to support them, inevitably I end up doing my own research and shopping online/elsewhere.

beermonsteron Best Pens for 2022: Gel, Ballpoint, Rollerball, and Fountain Pens

Jet Pens to the rescue https://www.jetpens.com/blog/The-22-Best-Pencils-for-2021-Wo...

beermonsteron Best Practices for Securing SSH

Can also audit using ssh-audit [1][2]

[1] https://man.archlinux.org/man/community/ssh-audit/ssh-audit....

[2] https://www.ssh-audit.com/

beermonsteron Best Practices for Securing SSH

Since OpenSSH >=8.2 you can use FIDO2 and security keys. See https://www.stavros.io/posts/u2f-fido2-with-ssh/

beermonsteron I Miss RSS

I continue to still use RSS daily.

Feedly and Innoreader are both good and use various apps and or extensions that hook into those two. It’s one of the best ways to quickly scan content from multiple upsteam sources and a decent reader makes for a pleasant reading experience too.

beermonsteron Ask HN: How do you cope with being interupted?

Seconded. I have found the Pomodoro method is a great way to stay focussed. I even use the pomodoro mode in Spacemacs and there are simple apps available for iOS/Android.

For being interrupted by apps I generally invert control E.g. - Disable notifications and decide to check a few times a day instead

- Close apps when I’m focussing.

For being interrupted by humans - Make good use of a calendar and let people know my availability

- Use calendar to block of focussing time for tasks requiring periods of longer concentration

- Not be afraid to say I’m in the middle of something I’ll come find you in a bit unless it’s urgent when prodded physically.

- Changing my status message on instant messaging apps/web meeting apps to let people know I’m not always monitoring them (e.g. “I check for DM’s multiple times a day”) to set a level of expectation.

beermonsteron The Modern Guide to OAuth

Although not directly related I’d like to see a modern guide to tokens and cookies. There are lots of choices and then on top of that the choice of storage location. I think OWASP recommend cookies rather than localStorage but it would be good to see the different risks each protocol or storage location comes with in an authorative guide with the pros and cons of each and which shouldn’t be used and why. I.e. there seems to be lots of footguns on top of the complexity of having to choose the appropriate OAuth flow.

beermonsteron You shouldn't parse the output of ls(1)

The back ticks were supposed to be quotes, I meant to say

echo *

However as per replies, this suffers from the same issues as ls.

beermonsteron You shouldn't parse the output of ls(1)

I use `echo *`

beermonsteron Japan's Paper Culture

Yes I’ve used them for fountain pens. Very good and never had any issues. Great customer service. Highly recommend.

beermonsteron Japan's Paper Culture

Thanks!

beermonsteron Japan's Paper Culture

This is a shame. I got through to payment and I am presented with ‘Due to recent changes in United Kingdom's tax laws, we can only accept orders over $200 USD to the United Kingdom at this time.’

Wonder what recent tax law changes they’re referring to?

beermonsteron Please don't use Discord for FOSS projects

Opening sentence of article begins : “Six years ago, I wrote a post speaking out against the use of Slack for the instant messaging needs of FOSS projects”

beermonsteron Japan's Paper Culture

I should really buy something from jet pens. Not sure how how expensive they are for non-US international orders but I’ll have to check. It could potentially add quite a mark-up to a cheaper item such as the sampler packs someone else mentioned. But those packs look GREAT.

You should check out the rest of their posts/articles. I’ve ended up on them before when trying to find out the difference in the types of inks and types of pens. I have always been really impressed by the quality of their articles. Really want to give them some cash so will wander over there in a bit.

Sadly, my writing has got worse and worse since my life has become more and more digital. I should really have a goal for 2022 to be able to write legibly once again. I can’t even read my own hand writing any more - it must just be the lack of practice and it’s very sad as people used to comment on how beautiful it was (decades ago). Now it looks like a Doctor’s prescription order!

beermonsteron Knock Knock Who's There? – An NSA VM

From the article: “.. a port knocking backdoor with multiple targets such as Solaris, Linux, FreeBSD, HP-UX, JunOS, OS X”

So this was far more reaching than Windows.

To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you.

However, on reading this article my first thoughts are if this method evades detection by not having a listening port that a network scan or locally using ss/netstat can detect then perhaps you would still be able to benefit from egress filtering (only allowing outbound connections to things you need and blocking the rest). On a router most connections are through the router (FORWARD table) as opposed to directly locally originated and outbound (OUTPUT table).

beermonsteron Ask HN: Intercepting HTTPS – How can we trust anything?

Fiddler uses a certificate which you need to trust to intercept traffic. Enterprises also do this type of thing on a larger scale (see products from Bluecoat for e.g.) to monitor employees and for detecting exfiltration of data.

Of course outside of the enterprise phishers will use a variety of other tricks as they are not in control of your CA list you trust (as you mention here) on your device. So they’ll for e.g. use domain names that either look legit or are very close to a real domain.

beermonsteron Ask HN: Intercepting HTTPS – How can we trust anything?

Actually TLS happens client and server side and protects data in transit whilst established. But that means over the network.

If you want to protect the actual contents you should encrypt it within your application and not rely on the TLS layer to protect it as various products, tools and services strip off this layer (for better or worse)

Lots of people think you can protect your data just by using TLS which is false. If you don’t believe that try using mitmproxy or fiddler.