HNHacker News
TopNewBestAskShowJobs

y0ghur7_xxx

2,612 karma · joined May 15, 2008

submissionscomments
y0ghur7_xxx··on Why we chose Vue.js
I am more and more of the opinion that you should NOT use a js framework for long term projects (that span more than a few years), but just use vanilla js with some libraries that you can easily switch when something better comes out. Vue.js is here today, and it is nice, but tomorrow gintzx.js comes out, and the community will be flabbergasted and everyone will use it and vue.js will slowly die. Making big complex webapps with just some libs is absolutely possible. Just choose them wisely and make a good directory structure.
y0ghur7_xxx··on Angular 1.x Banned from Firefox Addons
The vulnerability described by op applies to chrome just the same. Once the addon has `pageCapture` permission, an angular 1 exploit would work just the same.
y0ghur7_xxx··on Let 'localhost' be localhost
> What happens as soon as two different organizations want to connect their networks together and they both turn otu to be using the same hijacked TLD?

Why "hijacked" TLD? It would be a standard TLD.

If two orgs merge, and they both happen to use the same hostnames for some things, like say git.internal, they just refactor those hosts, or merge them since they merge.

y0ghur7_xxx··on Let 'localhost' be localhost
I agree with you. There should exist a standardized tld for internal networks that we can use and be sure that no one else has control over. Buying a domain and use a subdomain of that one is not a good workaround. .internal would be nice and is not used by now. I may go write an rfc now :)

related discussion:

http://serverfault.com/questions/17255/top-level-domain-doma...

y0ghur7_xxx··on Let 'localhost' be localhost
> There are several "localhost.<tld>" domains in the wild today. What happens to those?

nothing. the rfc talks only about the localhost tld.

y0ghur7_xxx··on Adblock Plus now sells ads
The OSI definition of "open source" is not the only definition. I would argue that most people see "open source" as software where the source is "visible" (no data to back that up).

Then you have a gazillion of "Open source licenses", that can be less "free" to more "free", like BSD, GNU, MIT, Apache, the free source license, ...

y0ghur7_xxx··on A very simple desktop app that can send raw http requests
because it's nice to have requests remembered so that you don't have to write all the json by hand every time.
y0ghur7_xxx··on The DNSSEC master key securing DNS is about to change
I like it too. The cons just don't exist in my pow:

one downside was that it didn't work on things like airport access points, but those break regular tls too.

an other downside was the fact that google didn't want to integrate it in chrome because the notaries would have to be always up. now they run transparency logs that have to be always up anyway. so.. what's the difference?

The Perspectives Project piked up the idea, and it seems less dead that Convergence: https://perspectives-project.org/

y0ghur7_xxx··on Essential Electron
Electron is really awesome. I wrote a rest client¹ a few weeks ago for my personal use, and it worked out really well. I saw that even the auto update² use case is taken care of.

Really awesome to make a quick app for someone who is already good in making webapps and needs the power/access/network rights of a desktop app.

¹https://github.com/S2-/http-client

²https://github.com/electron/electron/blob/master/docs/api/au...

y0ghur7_xxx··on A very simple desktop app that can send raw http requests
I was not happy with the current REST clients, that are all either to complicated (soap-ui), integrated inside some other tool (HttpRequester, vscode-restclient, ...) or are to basic (can not save/recall previous requests) so I made my own.

Wanted to share this, maybe someone else finds it useful. And it's really easy to hack: just one html file and one js file.

y0ghur7_xxx··on Ask HN: How have you left Google's services?
I have left all google services apart from search.

email: I run my own server. After the initial "reputation building" for my domain, it now works reliably well.

calendar/files/photos/contacts: nextcloud on my home server. It's not really on par with the google offerings, but it works well enough for me. And when I need more storage I just get a 2TB usb disk off amazon.

play store: f-droid. It has everything I need. I understand that not everyone might be happy with just the apps on f-droid, but I was bored with downloading crappy games and uninstalling them after 2 minutes anyway. f-droid apps are all well done, and I trust them not to invade my privacy.

y0ghur7_xxx··on FreeBSD Core statement on recent freebsd-update and related vulnerabilities
"The Security Advisory did not contain information on the theoretical implications of the vulnerability. A more explicit paragraph in the 'Impact' statement may have been warranted."

I may be overreacting on this, but this sounds like "you who found bugs in our code: document them better next time". I think the reporter does not owe freebsd anything. If someone owes someone else something, freebsd developers should thank the reporter for finding those vulnerabilities, and not ask for even more of him.

y0ghur7_xxx··on Your battery status may be used to track you online
why is this even available to websites?

    navigator.getBattery().then(function(a) {console.log(a);})
https://developer.mozilla.org/en/docs/Web/API/Battery_Status...
y0ghur7_xxx··on Do nice guys come second?
If you cripple your browser some websites will break. Don't expect site owners to make them work just for you.

Fail gracefully was over the moment the "disable javascript" checkbox was removed from the options menu in every major browser.

y0ghur7_xxx··on Show HN: Certificate Transparency Log Monitor
This is really nice. I have been using the atom feed provided by https://crt.sh/ and an ifttt recipe to send me an email when a new cert is logged¹, but this service looks really nice and made exactly for this purpose.

¹https://www.linickx.com/monitor-for-fake-certificates-with-c...

edit: my ifttt recipe: https://ifttt.com/recipes/444453-get-notified-when-a-certifi...

y0ghur7_xxx··on The Road to CouchDB 2.0
> Seems like you're confusing Couchbase Mobile and Couchbase Server.

Probably. But is that really my fault?

There is CouchDB, CouchIO, CouchOne, Couchbase, Couchbase Server, Couchbase Mobile, Couchbase Lite, CouchApps, BigCouch, Touchbase, Membase, Memcached, MemcacheDB... all different and yet related in a way not at all obvious from the names alone.

First there was CouchDB, a database created by Damien Katz, a former IBM developer. Its official name was changed to Apache CouchDB after it became an Apache project.

A company named CouchIO was founded to work on Apache CouchDB and later changed its name to CouchOne (by "its name" I mean the company name - not the database name).

CouchOne (formerly CouchIO) merged with Membase (formerly NorthScale) to form a new company called Couchbase. Membase (the company) developed Membase (a product of the same name). Membase was created by several leaders of the Memcached project and it used the Memcached protocol. After the merger of CouchOne and Membase, Couchbase continued the development of the Membase software and later changed its name to Couchbase Server.

Today I think most people believe that Couchbase Server is a new version of CouchDB but it is in fact a new version of Membase. It still uses the Memcached protocol and not the RESTful API of CouchDB. Meanwhile CouchDB is still CouchDB, actively maintained and enhanced as an Apache project.

http://stackoverflow.com/a/15184612/512324

y0ghur7_xxx··on The Road to CouchDB 2.0
Managing rights for users on document level granularity was pretty easy in 1.6. A simple js function (it's called a "design document") to handle the logic and you are done. Just an example:

    function(newDoc, oldDoc, userCtx) {
        if (userCtx.roles.indexOf('can-write-sessions') !== -1 || userCtx.roles.indexOf('admin') !== -1) {
            return;
        } else {
            throw ({
                forbidden: 'can-write-sessions role missing'
            });
        }
    }
Why do you think that the Couchbase Sync Gateway is better?
y0ghur7_xxx··on The Road to CouchDB 2.0
CouchDB is awesome. We evaluated it some time ago¹ and we all thought that the way it worked, the performance, the management are light years ahead of everything else in this space. We ended up not using it because it looked like it was dead. I am so happy that it is not, and I hope this 2.0 release will bring in some more community love. It absolutely deserves it!

¹https://news.ycombinator.com/item?id=11757015

(couchbase sales people came answering, even if couchbase is a completely different product that covers different usecases)

y0ghur7_xxx··on Making your own web debugging proxy
If you just want a quick proxy to inspect traffic, apache with mod_dumpio¹ always seemed the quickest and easiest way to do it: just proxypass your traffic and

     LogLevel dumpio:trace7
     DumpIOInput On
     DumpIOOutput On
and all your traffic is in the log files.

¹http://httpd.apache.org/docs/current/mod/mod_dumpio.html

y0ghur7_xxx··on Europe Is Going After Google Hard, and Google May Not Win
I'm serious. I have a gmail account for spam signups, and i log in sometimes, but I didn't find anything that it gives me over my setup.

The only thing I can think of is the initial setup I had to do to get everything done, but that's a few hours of work and it's here now. Using it for years without having to do anything. Some friends of mine use it, and my family, and nobody complains. Ever.

y0ghur7_xxx··on Europe Is Going After Google Hard, and Google May Not Win
What could gmail possibly give me that a server with postfix, dovecot and roundcube can not?
y0ghur7_xxx··on Europe Is Going After Google Hard, and Google May Not Win
> Are Europeans not upset that they're being forced into sub-standard foreign technology

Personally I am really happy that we have someone watching over our privacy, and that the use of our personal data is regulated.

y0ghur7_xxx··on The State of Mobile XMPP in 2016
https://tools.ietf.org/html/rfc6121#section-5.2.1

because the message can be sent to different devices (resources) the user is connected with. This is not accidental complexity like you make it out to be. It is needed and wanted.

Or are you advocating a binary protocol? Personally I really like the messages exchanged with xmpp: they are easy to understand and easy to craft. I think the success of http too, lies a little bit in the fact that it is human readable.

y0ghur7_xxx··on The State of Mobile XMPP in 2016
> I tried to find XMPP/Jabber clients for S40 phones for YEARS, and every single one I found would immediately crash with OOM errors.

> It's easy to blow off complaints like mine, because everyone on hackernews has a Samsung Universe S2000 or an iPhone 128 Plus, but these are real concerns that real people have in the real world.

I am using Conversations with my family and friends on a prosody server I put on a kimsufi server. It works like a charm, and we don't have all super awesome android phones (but I have to agree, nobody has an S40. Do they even exist anymore?).

I think your experience is outdated and not correct anymore.

y0ghur7_xxx··on Show HN: SSL certificate dashboard
> Rotating certs is like restoring backups, if you only do it when shit hits the fan (server crashed or cert expired), you're doing it wrong.

you restore backups even if the server is still ok? why?!

y0ghur7_xxx··on Gchat Was the Future of Messaging, but Google Didn’t Know
conversations is really nice. thanks for making it. one problem i have with it, that gchat solves really well, is how it behaves when you have a desktop client and conversations open at the same time.

when someone using conversations writes to me, what i expect is that i get the message on my desktop, as well as on my mobile client. but conversations will ALWAYS ask the user where he wants to send the message, if on my phone or on my desktop client. this should not happen. it should just send it without the resource set, and let the xmpp server figure it out.

y0ghur7_xxx··on Scaling to 100M: MySQL Is a Better NoSQL
We evaluated solr for a project just a week ago. It does not have authn & authz that mongo has, and that was a feature we needed. Other that that, if all you need is a kv store, solr is great.
y0ghur7_xxx··on Git-secret – store private data in a Git repo
This should really work with ssh public/private keys¹. Public keys are probably already on the box the git server runs on, and users already have them generated to access git - no need to generate separate gpg keys.

If you have a github account the script could also get the pubkey directly from the github api...

¹http://superuser.com/questions/576506/how-to-use-ssh-rsa-pub...

y0ghur7_xxx··on StartSSL domain validation vulnerability
I agree. What certificates have been issued until now fraudulently like this? Does SartSSL submit certificates to Certificate Transparency? And if it does, who knows if there is a bug in that code too, and certs have not been submitted?

Mozilla, Google, Apple and Microsoft should remove this CA ASAP. If it breaks some sites, even better. Maybe it will make some noise and fix all this CA bullshit for good.

y0ghur7_xxx··on Telegram has now 100M Monthly Active Users
I run 0.9, and the documentation says

   0.9  Works
and indeed it does (I am using it with the default storage backend).
← PreviousPage 6 of 17Next →