implying

The site isn't really about dogs, it tracks a few dozen different topics that people consider difficult.

It's not so much about any longstanding personal policy, but if your dog of 10+ years had just died recently, and you sat down to watch a movie to relax, you might not want the movie to feature a prominent animal death, for example.

I use the site mentioned in the article almost every time I want to watch a movie. Its easy to dismiss it in terms of "pampering" or being too soft, but there are people who have lived and seen horrible things and do not want to be reminded of them.

It's also great as a nutrition label for media of sorts; "is this movie appropriate for a small get together?" is a question that's often hard to answer without a service like this.

Putting fundamental features of the language behind a price barrier at all will keep students and people who want to experiment with the language out of the ecosystem. This isn't a papercut, it's an intentional omission that has backfired and can only be fixed by tooling. If the only way to access an often necessary feature is proprietary, why not make the whole language proprietary at that point?

They've fixed the import / modules situation to a point where it's usable and much improved, and generics have been added.

However, the issue this brings up about structs / types not explicitly declaring which interfaces they implement is a real and unaddressed problem, especially in large codebases. The only tool that I'm aware of that finds implementations is GoLand, at steep JetBrains prices.

Figuring out what type an API is asking for should not require reading every line of code in the package, and slows down every developer of large Go projects

Firefox is not based on the chromium codebase, it is older.

Isn't it sad that he has to type out his only messages to the world letter by letter, and he spends his time typing out the names of mega-brands?

"...‘(son’s name) moechtest du mit mir disneys die hexe und der zauberer anschauen auf amazon’ – ‘would you like to watch Disney’s witch and wizard with me on amazon’ on day 461"

I essentially paid my way through college by turning SMB's spreadsheets into CRUD webapps + some tiny reporting. There is a huge, huge market for this if you wanted to trade some of the time you would spend writing code with marketing, cold calls, chasing down clients for invoicing, and other non-tech stuff.

Perhaps off-topic, but .su is the TLD of the Soviet Union.

You should expect any software to not have ads.

As useless and pithy it is to say "just restore from backup", having your livelihood (or a significant time investment) depend on a system far outside of your control, where you have no service guarantees or even a billable relationship, is a fairly shaky ground to stand on. Ultimately if you spend your time producing digital assets, you should have taken action to ensure you had ownership and control over them somewhere.

I always backup my TOTP secrets to a file on my computer. Android apps like Aegis can automate this, by having an encrypted export to a file anytime you add or change a secret. You can use {Nextcloud, syncthing, etc.} to maintain that export file current with your computer.

If your phone is stolen, you can generate codes manually using a TOTP utility, or by restoring the backup to a new/old phone.

This reminds me of Huawei camera app detecting pictures of the moon and superimposing a clear stock photo into your picture: https://www.androidauthority.com/huawei-p30-pro-moon-mode-co...

Digitalocean will automatically lock any account I create, because of an (admitted!) false positive in their fraud software. Literally any IP, any credit card, any email address I use- seconds after taking out a test deposit on the card, the account is locked.

Every time I've messaged support for an account lock, 24 hours later I'm informed it was a false positive and the account is unlocked. Needless to say, this does not inspire confidence that my resources are going to be kept up and running past Kafkaesque fraud monitoring systems

(2019)

These types of programs have gone through a few iterations since the secure enclave was released, but they all share a fatal flaw, probably from the SE itself:

You can only store keys that use the NIST P curves, which are not recommended for SSH, or any serious crypto. There are serious supicions that they were tampered with during design by NSA, and are listed in djb's https://safecurves.cr.yp.to/ as unsafe. Using this program would force you to configure your server to accept keys using unsafe curves.

This is a bizarre analysis. Public legal risk is absolutely the last imaginable threat to us-east-1, short of aliens abducting it. The U.S. security apparatus depends on AWS and would never allow it, Wall Street would never allow it, never mind the fact that Amazon itself would leverage every tool at it's disposal to protect its reputation for reliability. The politicians involved in this scenario might seek to remove Amazon's competitive advantages, or fine them, but the people who understand what AWS even is would never consider a move to shut down a datacenter.

Both the "enemy action" and "operation failure" scenarios are much bigger risks than this article makes out to be. Every non-aligned nation-state offensive cyber team has a knockout of us-east-1 at the top of their desired capabilities. I'm sure efforts range from recruiting Amazon employees to preparing physical sabotage to hoarding 0days in the infrastructure. There's no reason to think one of them wouldnt rock the boat if geopolitics dictated.

Operational failure is probably the most likely. AWS might have a decade of experience building resilience, but some events happen on longer timescales. A bug that silently corrupts data before checksums and duplication and doesn't get noticed until almost every customer is borked, a vendor gives bad ECC ram that fails after 6 months in the field and is already deployed to 10,000 servers, etc. Networking is hard and an extended outage on the order of a week isn't completely impossible. How many customer systems can survive a week of downtime? How many customer businesses can?

Took a little while to find the magic words in there: https://github.com/wimpysworld/quickemu/blob/af26f41440d63a0...

Strange how this implies that the end-all-be-all of VPNs is IPsec. I would've loved to hear their opinion on wireguard and this generation of mesh VPNs

I agree. Isn't a VPN a usecase where you'd like to authenticate yourself as little as possible?

For comparison, mullvad accounts have no separate identification and authentication. Each account is a 16 digit number, and knowledge of that number allows you to administer the entire account. Usernames and passwords don't exist

I run it using docker, paired with a watchtower container that automatically updates it. For accessing it, I use tailscale so that I don't have to open ports or have any kind of exposure to the internet. This obviously won't work if you want to do public linking from your instance. In that case, just run it from a subdomain. Make sure your www folder is mounted read only

Did you not even read the url, let alone the article? This is Edward Snowden's blog.

A new aspect of this is that because this is self-reported, and the end goal is to involve the criminal justice system, there is now (essentially) an API call that causes law enforcement to raid your home.

What would be the result of 'curl'ing back a few random hashes as positives from the database? Do I expect to be handcuffed and searched until it's sorted out? What if my app decides to do this to users? A malicious CSRF request even?

For frustrated HN users, I have managed to remove the ads by uninstalling all updates to android home, disabling "TV core services" and "Google Play Services". You'll also need to disable automatic updates in the play store.

This won't let you sign into Google apps anymore, but most major apps work fine after a reboot.

Ultimately, if the data isn't on your hardware, parsable by open source software, there's always a chance a corporate move could imperil it.

You can find a quite bit more than are on this list if you don't mind shady torrent sites

I've deployed it to my larger-than-average home network with great success. A device can roam outside of the network and still access intranet sites and services, and I can remotely access family devices for helpdesk tasks.

My only complaint is that there is no good alternative to authentication other than using Google for small deployments like this. I don't want to pay an auth provider, and none of them offer a simplified plan for 3-4 users.

Partly telling that we're in a frameworks-for-frameworks stage of webdev.

Its deeper than that. Calling the fused location api contacts google's servers with location data. It is the only API that's well supported and documented. Using GPS sensors directly uses tons of battery, takes minutes to get a fix on most phones, and doesn't have access to some of the google-provided features like geofencing and wakeups on events.

A "g-free" phone can get location, but it's purposely hampered.

v2 domains were just the maximum length that you could reasonably memorize them, perfect for privacy. There's no chance for memorizing a v3 domain, so you'll have to write them down or persist them in some way. Having a post-it of a whistleblowing site's URL is never great.