ghughes

"Computing in a straitjacket" - this is wonderfully pithy.

Probably? The author limited their audit to the top 1,000 packages + dependencies. I would not be surprised if both of the following things are true: 1) a lot of damage can still be done outside of that scope; 2) there are domains that NPM/GitHub have not attempted to send mails to since expiration, and those accounts have therefore not yet been flagged for manual intervention by the support team.

I don't like GitHub's security screener dismissing this report because of the "social engineering" aspect. There is a real problem here; it's easy to imagine this disclosure leading to another major OSS supply chain incident. I hope GitHub security folks are taking this more seriously than indicated by the response to the researcher.

> Their response seemed to indicate that the account was flagged due to previous issues sending emails, which would be expected with the domain having expired.

It's entirely possible that the domain could have been re-registered long before their next attempt to send an email to it.

I wonder if it's safer (and plausible) to run a daily whois audit job for all maintainer email domains and block anything that enters the redemptionPeriod status?

Congrats! It's impressive to go from learning to code, to shipping a product with this level of polish, in less than two years.

I tried to build essentially the same thing on top of Matrix (and got rejected from YC in the process) - I haven't tried the app yet but I have some initial thoughts and questions. I really hope you succeed with this; forgive me if I come across as a skeptic.

#1 question: every notable social app had some clever strategy and/or shenanigans to attract a critical mass. What's your plan to tackle the network effect problem? Maybe 10% of the value of a social app is the UX, the other 90% is that the people I care about are there.

Are posts end-to-end encrypted, or encrypted at rest? Your video says E2EE but your landing page says encrypted at rest. There's no wiggle room for confused messaging on this. Your blog says you're using Matrix but one of your comments here suggests you abandoned that idea? If so, I'm curious to hear why. Are/were you sharing content directly in Matrix rooms, or storing encrypted content in an object store and using Matrix as a key sharing mechanism, or something else? Can you say more about the problems you encountered?

The landing page design is slick, but there's too much motion pulling my attention all over the place, and too many red flags. The animation for "Automatic Contacts" evokes a feeling that you're going to swallow up my address book and send unsolicited requests to my friends as soon as I sign up. The alarm bell with red dot is an anti-pattern. It feels weird to see all the other social networks I can integrate into my profile, considering this is squarely aimed at people who have rejected those other apps.

Your video says there are no ads, there never will be, and users are not the product. How, then, are you going to thrive in such an intensely competitive space?

Better yet, hire developers who enjoy and excel at selecting and utilizing emerging technologies that will be a better long-term fit for the problem at hand. This is of course more difficult, but makes for a better team and product. I want my competitors to be afraid of technology and to de-prioritize hiring generalists.

I've been noticing something similar happening with GitHub issue threads. Spam sites like githubmemory.com are frequently ranking higher than GitHub itself, and sometimes GitHub doesn't even show up at all, even with a specific search term that appears in an issue thread for a popular repo.

The cynic in me can see good reasons for both Google and Microsoft to be okay with this.

> ensure security, install the software you need, keep it updated and secure etc

These things are now trivial enough that it doesn't make sense to pay 10x the cost of bare metal for a cloud provider to solve them for you unless you have a crazy amount of runway or absolutely no idea what you're doing.

Picking up major WeWork vibes from this.

> But players said they see the moves as a blatant cash grab.

It seems ironic to call out a "blatant cash grab" with a piece on a controversial topic that is primarily sourced with the musings of "thousands of fans on Twitter and Reddit".

No, you can't do that. Once you've been a member of an iMessage group, iOS will not allow participants who have iMessage enabled to switch to MMS with that same group of users, even if everyone deletes and re-creates the thread.

This only works for 1:1 conversations. If you were in any iMessage groups and then deregister, iOS will silently drop you from future messages, and it isn't possible for the same group composition to be re-established over MMS.

Your analogy doesn't really carry over. If McDonalds or Chipotle were called "Food" then imo it would be a dick move to sue a smaller restaurant chain named GregFood. (As to whether they would prevail, I have no idea.)

> Google Maps doesn't seem to be substantially improving anymore.

Google Search is even going in the other direction. (Recent discussion: https://news.ycombinator.com/item?id=29392702)

I wouldn't bet against Apple if they were incentivized to compete in this space. Their whole shtick is using feats of engineering to dominate lazy competitors.

Have a look at Pushpin: https://pushpin.org/docs/about/

This has been useful: https://github.com/rakeeb-hossain/functools

It contains generic implementations of

    Any
    All
    Count
    Filter
    ForEach
    Map
    Reduce
    ReduceRight
    Sum
    Chunk

It could be interesting to bootstrap a PoS network using the wallet keys for all existing public blockchains, by allowing users to initialize their PoS wallet with the fiat value of their PoW keys held at some agreed moment in time. I toyed with this idea for a while, but I don't know how you could keep the network secure until a significant proportion of the total value has been claimed.

Anyway, I'd also be interested to know if there's existing or active research along these lines.

My anecdotal story: I bought my Dad a 15" MBP which recently failed due to this. This is in the UK where there's strict consumer protection laws mandating free repairs within 6 years, as long as the consumer can show that the problem existed when the computer shipped.

He took it to the store and they wanted £600. I called and insisted they should fix it for free. I got hold of a supervisor who eventually gave in and agreed to do it, hooray! Not so fast. We got disconnected and I called back, getting another supervisor who said the first guy was mistaken and shouldn't have told me that. He explained that Apple's interpretation of UK consumer law is to deny any claim that falls outside of an approved repair program, unless you can somehow prove that the problem existed when the computer shipped, which he admitted is impossible due to the way these computers are built. He said that forum posts and YouTube videos are not considered evidence that it's a widespread issue.

It's especially painful in my case because I worked there as an engineer when I bought it for my Dad under Apple's employee purchase program. I was proud to do so at the time - he would never buy such an expensive computer for himself. I explained this to the AppleCare supervisor and he, of course, did not give a shit; probably didn't even believe me. So, if any Apple folks are reading, be warned that buying hardware for family members under EPP might seem like a good thing, but you may well be sticking them with an expensive repair bill in the not-too-distant future.

My Dad uses a Chromebook now and our family no longer buys Apple stuff, which sucks to say after working there for 8 years and shipping software that runs on that MBP.

The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice.

This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2]

Forbes ran the story with the headline "The ‘Worst Hack In Years’ Hits Apple Computers", and that's bullshit.

1. https://www.forbes.com/sites/thomasbrewster/2021/04/26/updat...

2. https://www.vice.com/en/article/wx5855/massive-mac-apple-sec...

Cool for the web, not so cool for the growth of Apple Arcade.

He landed code that nobody seems to understand the purpose of. That looks like success to me.

Ethics of the research aside, it has succeeded in showing that it is far too easy to sneak malicious code into the kernel.

It sucks that the maintainers have to play cleanup, but at least it will hopefully lead to a positive outcome.

The article doesn’t even come close to establishing that.

> That’s when Yu started having second thoughts. Even after spending $200,000 on rent, an architect, a lawyer, equipment and fees, he’d still need to pay at least $120,000 in construction on his space. And he knew he’d have to hold his grand opening in the middle of a pandemic when capacity is still limited.

The article tries hard to pin the failure of this project on SF’s tedious permitting process, but it sounds like the real reason was poor timing and an unrealistic budget.

ICYMI, this analysis is written by the principal engineer behind Intelligent Tracking Prevention in Safari. John knows what he’s talking about.

They should look at the way the wind is blowing and enable this by default for all domains.

edit: in a previous version of this comment I said that Cloudflare should use this mechanism to "kill FLoC in the crib", which is quoted in southerntofu's reply.

Not developing features that pretend secure remote computation is a real thing.

Signal's increasing reliance on SGX is the elephant in the room. They keep announcing new features that require sending your cryptographic keys to someone else's "super trustworthy" computer.

Cloudflare and Fastly should step up and add this header for all domains by default. That would probably be enough to kill this idiotic mal-feature.

This is common, it essentially means “don’t cache this”.

That thread between FB & Apple is fascinating. The potential solutions being discussed have significant implications:

1. Apple: "not support eTLDs in PCM and only support TLDs" - so no more ad attribution for multi-tenant domains.

2. Facebook: "some sort of vetting process to determine who is using subdomains in a way that is aligned with the intended purpose of the PSL" - so Apple takes over the PSL inclusion process and institutes strict vetting to prevent abuse of PCM, which would presumably take months to implement.

This looks like a serious design problem with no solution that could be implemented before ATT drops.