noodlesUK

One thing I think is really lacking from the PDF ecosystem is good open-source tools around signing. PDF signatures are something that is legally important in a lot of the world with regulations like eIDAS. Unfortunately it's extremely difficult to cryptographically sign PDF documents with tools other than Adobe's and some other (often more sketchy) proprietary tools. Even if you figure out how to use stuff like LibreOffice or poppler to sign, you'll struggle to obtain certs that will validate without spending an arm and a leg.

I really hope that someone will decide to step in and become the Let's Encrypt of PDF and S/MIME certs, because that will improve public trust significantly.

Yes, consumer rights in Europe are great for buying various goods and services!

For example, the EU regs for flight delays are a great example of consumer protection that is actually beneficial. You get paid cash compensation (which often exceeds the face value of the ticket) if you’re delayed more than a certain amount.

It has already happened on android in the case of Epic. They require that you side load their launcher/store in order to play games such as Fortnite. There was a big lawsuit about google’s fees which precipitated this.

https://www.fortnite.com/mobile/android/new-device?lang=en-U...

You can be unaffiliated (or a member of the confusingly named Independent Party) but you’re right, you then can’t vote in any primary elections.

Around 500 million people living in the EU have that privilege. It’s pretty common for people to exercise it and in no way makes you part of the jet set.

Party affiliation, which is mandatory in some U.S. states for voters (e.g. Oregon) is available to anyone who wants to access the registration dataset from the Secretary of State.

Until such time as a big player like Epic or Facebook decides that the only way you’re getting their apps is by using a store they control and can bypass all permission controls on. When that happens it’s going to become 2000’s browser toolbars all over again

Then surely all the good actors have to do KYC, and all the bad actors can just pretend to be American entities.

I don't agree with this on principle, but even just from a practical perspective it seems like they are leaving the door completely open by doing that. What's even the point?

I hear a couple of different arguments from people regarding their fears of AI.

1. They fear that a superintelligent AI is coming, and that it will result in an apocalyptic event.

2. They fear that the capabilities of various AI technologies that exist today, or will likely exist in the near-future will result in people's lives worsening in different ways, such as jobs being lost.

3. They fear that misinformation will become very common and democracies around the world are at risk.

It's very difficult to quantify the risk of argument 1 occurring because we don't know whether the current state of the art will ever advance to superintelligence.

Argument 2 will probably happen to some extent, but what extent remains to be seen - you can already see that AI generated garbage is killing search, and with it a lot of the open internet as we knew it.

Argument 3 I find difficult to understand. Misinformation has existed for a long time, and AI is just one more way of making it (perhaps at scale). You've always been able to claim that your political opponent was a puppy murderer with no basis in reality - the way I see things, AI is just a way of laundering that kind of claim.

It’s certainly interesting seeing the thread get attacked so obviously - that’s a first as far as I’ve seen on HN.

In terms of the actual story I think that we should be careful not to introduce insane KYC for contractors just to avoid the NK boogeyman.

If such measures were introduced, that would seriously restrict the ability to work with people from around the world. I also fear that scammy companies such as id.me will lobby for such measures in order to extract profit from companies who want to contract abroad, all the while not actually stopping sophisticated threat actors.

I completely agree with this. If something seems at first blush to enforce a security control, but does not in reality, it should somehow be made very clear that it is just disabling a footgun rather than actually enforcing a security control. Either the setting in the config file needs to be named something silly like disable_alter_system_not_a_security_feature, or it needs to be overridable with something like "WITH FORCE", to make it really clear that all it is is a stumbling block rather than a control.

Then surely the answer should be that there should be a config setting that disables it, with the option to do something like "WITH FORCE" which would force enable it in the environment even with that config setting enabled. This gives the best of both worlds, in that it stops people from copying blindly from Stack Overflow, but doesn't give the sense of security that it initially seems to imply.

I don’t understand the purpose of this. If what’s being said is true, alter system being disabled wouldn’t prevent the super user from doing all the same things as alter system but in a less convenient way. It will just give people a false sense of security, because they can abuse COPY to overwrite the config.

Legally I can’t imagine that it’s any different, but it is certainly more difficult on a practical level.

At my university, almost all of our marking was pseudonymised. We were assigned a random candidate number at the beginning of each year, and that is what went on our important papers/exams. The less important coursework often didn’t bother with this, and used our student numbers instead, but the general idea was the same.

We didn’t put our names on any of our work other than our dissertation (and a few trivial assignments that didn’t impact overall marks). It wasn’t that hard to de-anonymise, but it meant that the system had a bit more integrity.

It’s a really straightforward system to implement and I don’t know why it isn’t done more frequently.

I also think that our VLE sorted assignments by time of submission rather than any identifier.

I think understanding what services specifically you’re paying for would be a good start.

With things like session replay or distributed tracing, you might find that the best thing is to simply do without.

If your issue is paying for big-3 cloud companies, you could migrate to running on a cheaper provider like digital ocean, linode or hetzner, and not use expensive value add products. You could use a single DB or compute cluster for multiple projects and so on.

In terms of organization, you don’t need to necessarily run multiple businesses. You could run one business with multiple product lines. It might be easier to keep on top of things by approaching it that way.

Real landlines are a rarity these days, most stuff is VoIP. In any case, I was talking about getting an emergency call to the person wearing a pager (as in the case of doctors or other on call people), not the reliability of calling 911/999/112/whatever. Any mobile device is going to be more useful than a landline in that situation because the doctor could easily be out at the shops or having lunch. Pagers were invented for that particular scenario.

I’m sad that radio pagers are going away. They’re a much more reliable way of getting an emergency call out than a multifunction mobile phone. Their battery life is much longer and you won’t put it on do not disturb or silent mode.

Being on a separate radio network also means that in a real emergency when mobile signal is degraded, the pagers still work.

The other thing that’s convenient is that you can hand them off physically, so people know who is responsible for them at any time.

It doesn’t need to be this way. Essentially all UK universities are “public” and none operate this way. There aren’t special police forces that roam their campuses (Oxford had this for a time, but I think it was the only one). Violation of university rules is no more serious from a legal perspective than violating any other private rules.

I think campus police are an insane idea. There should obviously be a good relationship between any university and the police in their area, but the idea that they should report to the university leadership is nonsensical.

> What else do you propose is going to happen though?

Not parent but I don’t think that we should be holding anyone pending trial when what they’re accused of is so minor, child or otherwise.

Furthermore any decisions about pre-trial detention shouldn’t hinge on remorse or contrition, they should hinge on the alleged offenders risk of flight and their potential risk to the community.

I think there was a point in time when hydrogen looked like it might be a realistic option for personal cars. I think that time has now passed. Electricity is just so much more ubiquitous, which makes battery electric cars much much more attractive.

However, I think hydrogen makes a lot of sense for fleets of vehicles that need to go long distances between fixed depots where infrastructure can be built. I think hydrogen buses and trucks are a natural choice, because you can build fuelling stations at their depots, and then you don't have to lug a battery around. Whether that ends up being more cost effective than battery electric, I don't know.

I agree. It has only been a few months since the split. I have noticed more and more uptake of OpenTofu amongst colleagues, and I've personally switched. The thing that makes the difference is what is running on people's laptops, because that's what people will eventually put into prod.

At least a few in the UK that I’m aware of (I'd say which ones but I don't really want to dox myself).

What's the solution here? Can we practically expect employees at retail stores to not be permitted to change a person's phone over? What if the person who needs the swap has said their phone is lost/stolen?

I think ideally there would be some kind of verification that the customer was indeed present and that their ID had been verified, but I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID. I also think you should be able to get a phone number without ID at all, which would preclude verification in those cases.

The issue is that people's phones are essentially the roots of trust for our digital lives. Passkeys being built into the OS are good because they push that problem away from carriers, but the fundamental issue still remains. Bootstrapping trust is hard.

Maybe my model of how AC works is wrong, but my understanding is that neutral wires exist and are necessary in addition to safety earth, even though neutral and ground are eventually tied.

I would say getting a development environment up and running and running the test suite would usually be a great start. You’ll see pain points almost immediately if you just do those things.

Just FYI, if you’re going to have a cookie banner, you need the option to reject optional and 3rd party cookies. If you aren’t going to allow people to reject cookies as easily as you allow them to accept cookies, you are not complying with the ePrivacy directive. If you’re not bothered with complying, or you’re saying that all your cookies are strictly necessary (which they aren’t), you might as well do away with the banner. If you’re interested in reading further, see the ICO’s page on the subject.

https://ico.org.uk/for-organisations/direct-marketing-and-pr...

See also another daring act of guerrilla building: a homeless guy who built an underground bunker in Hampstead Heath, a park in London. No embezzlement was required for that one, and it lasted for years.

https://www.theguardian.com/news/2020/mar/05/invisible-city-...

I'm sure that lots of HNers including myself have encountered security vulns in different proprietary pieces of software that we encounter.

I can think of at least two or three occasions where I discovered an exploitable vuln, didn't have a contact to report it to, decided I didn't want to have the back-and-forth of some non tech company threatening me with a lawsuit, and took no further action (typically for lower severity vulns in less important services).

With open source software you can hop on GitHub and dig deeper into a vuln or other bug and actually report it somewhere.

As a namecheap customer I completely support the greenfield approach to what it means to be a registrar. However, what I want from a registrar is to be the best registrar. I don’t want hosting, email, or other services, I want a great DNS interface with an API that I can scope permissions on, and cheap and predictable name registration. That is it.