firloop

It’s also still a violation of Apple’s terms. Enterprise certs aren’t meant for consumer software distribution. Full stop.

I'm happiest when I'm working hard on meaningful problems that I care about.

I also understand that everyone doesn't feel that way. I think that's okay too. I don't understand why this needs to turn into a debate or perpetual flame war.

>Third, we knew we had an unprecedented number of new products to ramp during the quarter and predicted that supply constraints would gate our sales of certain products during Q1.

> ... AirPods and MacBook Air were also constrained.

(emphasis mine) Interesting that Apple still can't manage to make AirPods, a 2 year old product, fast enough. I wonder why that is.

dupe of https://news.ycombinator.com/item?id=18206868

I would say so; it's more than a third smaller than the figure quoted in the OP's title.

Keep in mind that the size of the app listed on the App Store is not actually the size of the app on device. Apple automatically removes unneeded assets [0] from the bundles based on the device that's downloading it. I just downloaded Facebook on my iPhone X and the app size came out to 314.5mb [1].

[0]: "App thinning" https://developer.apple.com/library/archive/qa/qa1795/_index...

[1]: https://imgur.com/a/lTJhMbx

I'm much more okay with Safari's implementation, because it's significantly more discoverable. Safari also makes it much simpler to disable this behavior altogether, with it earning a place in the settings ... rather than being behind some "flag" that may disappear in some future release.

I know, but I imagine Mozilla has the same policy everywhere they use Google Analytics and that was the best source I could find for it.

However, Mozilla has a special agreement with Google Analytics that ensures all data is anonymized.

Some discussion which mentions that here: https://github.com/mozilla/addons-frontend/issues/2785

I wouldn't be surprised if Twilio gets into this soon as well, since Apple is opening up the iMessage platform.

https://www.apple.com/ios/business-chat/

Essentially, convincing a mobile operator to transfer someone’s phone account to a SIM card an attacker controls.

Worked on StyleURL over the past couple of weeks with my friends Jarred (most of the code) and Lucy Guo (design). The goal is to make it super simple for designers & front-end devs to make changes to CSS on websites and export those changes into a gist[0].

We made an open file format called “Stylefile”[1] that the extension parses to apply shared changes to sites. Eventually, we want to support stylefiles on other platforms than just GitHub.

It was definitely inspired by something that we wanted for ourselves, as well as a reaction to the scummy behavior of Stylish....

It was really fun building this, especially writing the stylesheet diffing module, which diffs two stylesheets and prints the difference as valid CSS. It's open source[1], as well as the rest of the extension[2].

We're not really sure what to build next, or if this is even useful. Please share any feedback, especially what you might use it for.

[0]: https://gist.github.com/Jarred-Sumner/4197f93e0fc62d7cf235d4...

[1]: https://github.com/Jarred-Sumner/styleurl-extension#stylefil...

[2]: https://github.com/lukemiles/stylesheet-differ

[3]: https://github.com/Jarred-Sumner/styleurl-extension

Very tired discussion, see "Are paywalls ok?" https://news.ycombinator.com/newsfaq.html

I think the internet just got a lot bigger.

No affiliation but all of my email exchanges with the creator have been surprisingly helpful and pleasant.

A repo critical of the acquisition was removed from the Github “trending” page.

https://news.ycombinator.com/item?id=17251255

This doesn’t bother me that much, as the repo itself was unaffected and I expect a trending page to have some sort of bias/editorship.

Your link is correct -- Apple recently added the ability to programmatically modify the contents of push notifications which would allow one to build E2E on top of APNS. Android has always processed notifications through intents, so it's always had this capability. Google is just providing a pre built solution that works for some use cases but this method was technically possible before.

Not sure what Signal does here particularly, but their FAQ claims it's not a problem. https://support.signal.org/hc/en-us/articles/217524107-Can-G...

By default, both Google and Apple can read the content of messages over their respective push services.

This allows a service to send push messages to its users without Google being privvy to the content of the messages. I guess it's not ready for P2P use yet (aka encrypting the messages with a key unknown to $Service) but could still be useful for telling a user that "Jane sent you a message" without leaking the fact that John is communicating with Jane.

effective dupe of https://news.ycombinator.com/item?id=17063109

Love the landing page. Just a heads up, navigating to the page breaks my browser's back button. Otherwise, looks fantastic!

HBO has done this for a long time on their streaming service as well, which is maybe why Amazon thinks they can get away with it. Super annoying.

I wonder how many more would abandon Facebook after seeing the targeting options in the Ads creator.

Prior art in this area by Shopify: https://news.ycombinator.com/item?id=14159994

It almost feels like that's there so it ranks in the search results for "Chromecast"

The thing that isn’t clear to me is how Trustico even had the private keys to begin with. It’s been a while since I’ve purchased a SSL certificate, but I remember generating the private key locally and providing a certificate signing request, which isn’t the private key. What am I misunderstanding here?

I vote the URL be changed to https://www.wired.com/story/tinder-lack-of-encryption-lets-s... which has a better write up and doesn't have infuriating scroll behavior

In fact, it's against the App Store guidelines to refuse to work without a permission (unless it's central to the app).

What makes Let's Encrypt less secure than a paid certificate? Or do you mean EV certs for the "magical green box"?

Just curious: why Slack vs e.g. Discord for these types of communities? I've seen both used but I'm interested to know from a community organizer standpoint where each platform makes more sense.