fabien-h

This repo has been sent as an exercise to join a crypto project.

The context makes it an obvious scam. But I'm curious to know how this would work. (I guess it sends your keys or some crypto when you open your meta mask)

Here is the intro message:

- Here’s the project: https://bitbucket.org/abga-workspace/mvp_3/src/main/

- The home screen will be displayed with a wallet connect button at the top right when you attempt to open it.

- At the moment, the button links to a Solana wallet. You need to make it look like an Ethereum wallet connecting workflow, for example, Metamask or something else. Also, after the connection is established, it should sign the message "This is a test" and provide the signed hash in the browser console.

- When finished, please, provide a screenshot or a short video as a proof of the wallet connection process.

Please use these

- Node.js v20.16

- NPM v10.8.1

- Python v3.11

[REMOTE] FULLSTACK (BUT MOSTLY BACKEND) DEVELOPPER ; TYPESCRIPT / NEXTJS / MONGODB

We are building a bank application with current & saving accounts, money management, wire transfers, and card management. We are launching on the French market this spring and the next step is to go to Europe for 2022. The draft is here : [https://green-got.com/](https://green-got.com/).

The endgame is to offer a solution that will reduce the carbon footprint of our clients by redirecting their money from carbon-heavy positions to eco-friendly ones AND to provide a better banking experience.

The general stack is a NextJS API and static front end with React native applications. We have developpers working on the static front, the applications and some parts of the backend. Half of the NextJS backend is a proxy to our providers for banking and money management services. We need you to work on that half! With time, you will be able to switch to other parts of the stack.

You have worked for at least a couple of years with TypeScript on the backend. You know how to write clean and well tested code. You want to make all your code dead simple to read. Experience with the banking or payment industry is a plus. You don't need to be a degrowther vegan but you must have a certain sensitivity to climate issues.

You can work from wherever you want, whenever you want, as long as you deliver. We intend to build a long-term relationship with our employees. So, the best candidate would be a french national that we can hire under french law for long term contracts. But we are open to international candidates on a C2C invoicing relationship. Being not too far from Paris time is a plus.

The budget for this position is 4500€ per month, 54000€ per year (this is $65k in USD). The end net salary will depend on the taxes in the country you live in. It may be half this amount.

To apply : https://github.com/green-got/exercise

The trust issue is real and that question is always valid. Like "hey, maybe there is a guy at hotmail that reads my emails and will do something bad with their content".

But when you put your secrets in a single database for convenience, if there is a problem, you know where it comes from. And your secrets manager would suffer the consequences.

That said, a optionnal simple zero-knowledge approach is very possible. You would have an encryption key that you enter locally and in your CI / server and you would never send your actual secrets, but an encrypted version of them.

Is it something that would help you trust the service ?

Oh, I did not see the Pinterest project before. Not related. Thank you for pointing this :)

You are right, there are many secrets management services and they are good. But I address a specific need: be up and running in minutes.

For solutions like the self-hosted version of Hashi Corp Vault (and Pinterest Knox apparently), you need to install it on a server, run it yourself, maintain the thing... This is work, I'm doing it for you. This is time, I'm spending it for you. This is money, you are saving a lot here.

Managed solutions work too, but they are all an order of magnitude too complex, too expensive or both.

There are more than 200 topics complex enough in Hashi Corp Vault to deserve a complete tutorial on their website https://learn.hashicorp.com/vault. And this is not even the full documentation. If we want to make proper secrets management mainstream in small projects, it needs to be much more simple. With Knox, you have one view per project and you need a couple of minutes to learn everything there is to know. It does less, but you probably don't need more.

Look mama, I made this !

Knox is a SaaS (Secrets as a Service) that helps you manage your keys, secrets, and configurations.

I really want to do this too!

But a wife, two daughters and a mortgage… I love them more than my life, but think a lot about your life before you attach a millstone to your feet.

Yes, users acceptation is a really big deal. I'm not sure how to tackle that. I guess that if the users had the option before and don't have it now, they'll complain.

And when I think about the way you login to slack...

"Also, you are not adding any security per se, because you are delegating it to the user's email provider."

I think I do. In my case, I need an email and a way to recover the password. So, if the users email account is compromised, the account on my website is compromised too. Anything I do will only add potential breaches to the ones already existing in the users email provider ; not fix them.

Hi HN. I've been working passwordless recently and I was super proud of my innovation (until I realised that this already existed for a while...). I want to know if there are other users around and if they can give some feedback.

Especially if you work with sessions. I work full stateless for authentication and maybe I'm missing some obvious issues.