ivanmontillam

I share the same sentiment. I de-Googled myself except for YouTube, but still wouldn't want my Gmail banned.

That's why I've gone to using open models, they are getting there slowly. A bit much of hand-holding but that's fine by me. If a customer of mine decides to use Google's models, I will have them sign a disclaimer that I'm not responsible of them getting insta-banned or similar. I just can't recommend it.

Also because they are Google. Google being Google: unreliable (they could kill a product anytime), too much of a platform risk (all products in a single place, get banned and lose the company), lack of support unless you really pay a big bill (into the 7 figures), among other… things.

With CDNs of today, they are not so much relevant for the clearnet.

Yeah, I'd rather revamp a Steam machine, for which we know exact specs even pre-launch.

What I really love about Onion sites is that if they are big enough, performance engineering really becomes Tor-specific. A few examples:

- Making assets embedded as base64 (img src the header logo as base64, all CSS should be inline, etc.).

- Leveraging CSS as much as possible (if you use animations and transitions, use CSS as much as possible for these, avoid JS for them).

- Make sure your website is mostly rendered on the backend. If you're to have JS, your website should work without it.

- Security becomes REALLY fun, as in, avoid XSS, CSRF, SQL Injection attacks and any other injections as much as possible.

As someone summarizes in another comment[0], keep the chattiness as minimal as possible. By chattiness I understand they mean, pack as much data as you can in the same Keep-Alive connection. Avoid making new HTTP requests as much as possible, as each one might get assigned to a new Onion route making things slow.

If you can ship your website to the browser in a single connection, you've won.

I've always been impressed by performance of these big Onion sites, they really push the limits of software engineering creativity, given these constraints and nature of Tor.

--

[0]: https://news.ycombinator.com/item?id=49872320

EDIT: Formatting of bullet points.

> - Gmail - same

Gmail is not particularly difficult in terms of software engineering. The moat with email servers is IP address reputation.

I could, today, install Postfix SMTP and some IMAP as well, and watch my email all go to spam directly, if delivered at all (ISP might block them).

I'm not being sarcastic. To me, it's a classic signal for the start of the enshittification. These design decision will come top-down from Microsoft.

I am losing karma because of my opinion, but that doesn't make it any less true. After all, you can just observe how the feedback goes against border radius. Hardly it will change back now to edgy corners like it's supposed to be.

This feels like the effective death of VSCode.

The irony went over my head this whole time, now that you mention it! Kudos for the observation.

If only Blizzard servers were seeders, and clients were only leechers, that'd have not been a problem.

> Including people who are violently un-inclusive is just being violently un-inclusive with an extra step.

Respectfully, that doesn't make any sense.

> Its like when a couple of nazis show up at your bar and you dont through them out. Welp, now you're a nazi bar.

That logic doesn't follow, sorry.

You can be inclusive, yet not become the thing you're inclusive to. That's a mental stretch.

Racist, but not fascist. Fascism is a whole different concept.

Well, don't. I follow the HN Telegram channel (not official), and if anything interesting appears, I read it.

If I tried to keep up, I'd be run over. It's too much input for the normal individual I am.

> A hackathon for performance improvement screams to me "you'll be re-interviewing for your own job."

Not necessarily, great engineers do also ship temporary code they didn't have the time to trim.

Our process is of 1) make it work, 2) make it right and 3) make it fast; not necessarily that engineer had time for the 3rd step.

And it wouldn't even be a defamation lawsuit because it's true.

Yes, but it's nowhere near the maturity of Telegram's Bot API.

And unlike Telegram, for a WhatsApp bot you need to apply with a bunch of paperwork. If you're an SMB, you got little chances of ever getting access. They'll tell you to go with their Technology Partners and make a chatbot with these other BigTech companies like Freshworks, etc.

It does, but it's not enabled by default; and that's the point.

(Yes, but it expires at 2035-05-20. If you count years by rounding up to integers, there's not enough time room to renew it an additional year. It would make it 11 years.)

But if you check the domain's expiration date, it's far away in year 2035.

To the best of my knowledge, a domain can only be renewed in advance for up to 10 years.

(that could be the reason for that status).

It has existed for a while, it's called HNS[0].

--

[0]: https://github.com/handshake-org/hsd

Not needing to be at the top of his game anymore makes anyone lose that sharpness. As you just said, he doesn't need to fight New York politicians anymore.

I stopped coding for the past year or so and I'm considering going back because I definitely feel my own sharpness lost.

I do that too, and meditate if YouTube wounded themselves by adding that feature.

View rates must have dipped for a percentage we don't know of, but definitely made a dent.

Though you have a physical copy of the game, I don't discount a future where a console refuses to load a physical copy of the game because DRM impedes it. Much like when short-lived TLS certificates expire on their own, even by being offline.

Physical copies of games have in their EULA that the game is licensed to you, so theoretically they could still disable it.

Precedent? BlackBerry phones refused to connect to WiFi if you didn't pay for your mobile data plan. It became a 2G brick.

I fondly remember Backtrack 2, running as a Live distro. I remember going to university labs where a teacher taught us a couple of techniques or so. Great days.

That's such an unfortunate name for a good, reputable distro.

For JSON serialization, which doesn't support fixed-point precision it does.

Floating-point precision has too many gotchas for being suitable to store Decimal types, especially for the Currency use case.

A string type. As parent says: it completely bypasses the problem. Save the numbers between double quotes and be done with it.

This.

If you want to be a security vendor reseller, just make sure to sell to orgs that have a compliance requirement, either by law or similar.

Do you sell firewalls? sell them to banks or something. Anti-malware endpoints? Insurances too. SIEMs? payment gateways for their PCI DSS environments.

Price it just below what would be the fine for not complying, that way you maximize the invoice.

I stopped playing the security vendor reseller game because it got too boring this way to make money.

This reminds me of these enterprise solutions to prevent data leakage, Data Loss Prevention tools (Safetica, Forcepoint, etc.).

Could this be adapted to inherit DLP policies? I have a sample use case, for example:

- Some DLP customers don't need full name protection but might need to prevent credit card PAN numbers from being leaked, per a PCI DSS compliance standard. Expiration dates don't need protection, and only the first 6 and last 4 numbers of a credit card can be shown; CVV2 is off the table, of course.

By checking out the repo, I know this can be configured manually, but can you make it so that it inherits DLP configuration instead of manual configuration? This could considerably boost enterprise adoption.

Big companies don't want to keep manual maintenance of a separate tool, whereas if they adopt it and "just works" with their existing ecosystem, that's an easy win.

This is easily, easily something you could sell as a business exit to a DLP company, because it's one of the "limbs" of protection they offer.