Hacker News Reader

y0ghur7_xxxon Telegram has now 100M Monthly Active Users

> clients are wildly varying in quality.

Yeah that's true. But psi+ on desktop and conversations on Android work pretty good.

> multi-device support sucks. You need message carbons (extension, 'solved'), but you also need MAM for history

I am running a prosody server, and those extensions work very well with the mentioned clients.

y0ghur7_xxxon Telegram has now 100M Monthly Active Users

xmpp is the solution.

use your own server, or use one of the many public ones. has clients for all major platforms, crypto is the best around (otr, gpg), does not require phone numbers or sim cards, is open and a public standard.

y0ghur7_xxxon Microsoft silently adds Amazon root certificates to its CTL

Yes it is, and we all know it, but we are apparently unable to fix it.

y0ghur7_xxxon Judge: Drinking tea, shopping at garden store probable cause for SWAT raid

"A state trooper had been positioned in the store parking lot to collect the license plate numbers of customers, compile them into a spreadsheet, then send the spreadsheets to local sheriff’s departments for further investigation."

this sound a lot like a stasi operation.

https://media.ccc.de/v/32c3-7209-what_does_big_brother_see_w...

y0ghur7_xxxon Let's Encrypt Stats

why? the signed cert is on your disk in 2 seconds. just request it on the fly. what's your use case for wildcard certs?

y0ghur7_xxxon Let's Encrypt Stats

Thanks to the ISRG and to all the sponsors (Except facebook. I don't like them :)) for making Let's Encrypt.

This does not fix the CA problem, but it does a whole lot to make the internet a safer place as it is now.

y0ghur7_xxxon How Tracking Protection Works in Firefox

> The new feature uses a whitelist provided by Mozilla to determine if a given site is allowed to load an asset from a given external hostname.

It's not a whitelist, but a blacklist of known tracking sites. Your cookieless domain for assets is not in there.

y0ghur7_xxxon How Tracking Protection Works in Firefox

no. how do you come to that conclusion?

y0ghur7_xxxon Gmail Will Soon Warn Users When Emails Arrive Over Unencrypted Connections

This Thunderbird addon does the same, if you prefer a local client: https://addons.mozilla.org/en-us/thunderbird/addon/paranoia/

y0ghur7_xxxon Trying out Let's Encrypt (beta)

Something I miss on all these howto posts about Let's Encrypt is the revocation of the old certificate on renewal.

Say I have a cert that is valid until 2015-12-31, but I want to renew it now.

   ./letsencrypt-auto --agree-dev-preview --server \
      https://acme-v01.api.letsencrypt.org/directory certonly

will get a new certificate, but the old one, as far as I can see, is still valid and could be used for the domain until it expires.

letsencrypt-auto has a revoke function, but there is no easy way to tell it to revoke the last valid cert, or it should do it with a `renew` function.

y0ghur7_xxxon Android 6.0 Marshmallow Reviewed

"Another change to the Android permission system is that every app automatically gets access to the Internet now, and users have no way of turning this off."

google still does not get the fact that some apps do not need, and should not be able to transmit or receive data from the network. We still need root and install AFWall+ to secure our phones.

y0ghur7_xxxon Someone bought 'Google.com' from Google for one minute

no, because that one requires registration to read.

y0ghur7_xxxon Facebook Ads Are All-Knowing, Unblockable, and in Everyone’s Phone

Why adaway + ublock? Are those not redundant if you don't have the FB app?

y0ghur7_xxxon Flash-Free Clipboard for the Web

KDE has this out of the box, so I think you may refer to windows. I am using this with great pleasure http://www.outertech.com/en/clipboard-history :)

y0ghur7_xxxon Remove anti-privacy, anti-security, and general nuisance “features” from Win 10

> but never in a million years will i download some random .bat file to just click and run.

I think that in this particular case you can trust the random bat file more than Microsofts official binary blob OS.

y0ghur7_xxxon PostgreSQL 9.5 New Features with Examples [pdf]

INSERT ON CONFLICT and Row Level Security are awesome new additions.

If you don't know about RLS I recommend you read up on them[1], as they would allow you to handle select/update/delete rights on rows directly on the data itself.

[1]http://michael.otacoo.com/postgresql-2/postgres-9-5-feature-...

y0ghur7_xxxon Ask HN: Which JavaScript frameworks do you use?

I use plain vailla JS with some libraries I like for the functionality I need. I can easly replace any lib when something better or some new functionality that the old lib does not implement comes out:

- form2object for form serialization

- pnotify for notifications

- routie or page.js for routing

- jqplot for graphs

- jquery for dom manipulation and ajax calls

- moment.js for date math

- socket.io for websockets

- ejs for templating

- bootstrap for the layout

and not much more really.

1. Time needed for Learning the Framework (in Hours): A few months to learn JS really well

2. Overall Development Speed (0-3 Points, greater better): 2

3. Maintainability of the Code (0-3 Points, greater better): 3

4. Why did you choose that Framework?: I didn't want to be locked in to angular when react comes out, or be locked in to react when the next big thing comes out.

y0ghur7_xxxon PostgREST – REST API from any PostgreSQL database

> ...and be locked in for life, joy.

"The argument that you don't want to write any code that locks you to a database is some stunning lack of awareness, as you decide to lock yourself into the tsunami of unpredictability that is web frameworks to ward off the evil of being locked into a 20 year database product built on some pretty sound theoretical foundations."

https://news.ycombinator.com/item?id=9928321

y0ghur7_xxxon PostgREST – REST API from any PostgreSQL database

> I can't think of many apps that don't require custom logic between receiving an API request and persisting something to the database.

I do. Most apps we write (government stuff) are CRUD apps that mostly handle data from the user, and then apply some logic to that data.

You can write custom logic in stored procs no problem. It's even a lot faster than doing it in java/php/ruby/.net or whatever because there are a lot less layers between you and the data, and the procedural language you use inside the the db is explicitly made and optimized for this purpose.

y0ghur7_xxxon Why does Gmail hate my domain?

I know that on HN "me too" comments are not well seen, but I just have to this time, because I am really frustrated by this as well (as said before: https://news.ycombinator.com/item?id=9812157).

This part sums up as I see it as well:

I can only think this is intentional on Google’s part – they have a near monopoly; the vast majority of mail I send these days goes to Google – and if a small company is running their own mail server is too much of a hassle, then maybe they’d buy Google Apps. It’s bad, anti-competitive behavior on Google’s part. Shame on them if its true. I don’t know if it is, I can only guess, but they certainly have an incentive to make it difficult for the little guy.

I’m just a geek that likes running my own servers. My pleas to Google’s impersonal forms fall on deaf ears, and I’m getting tired of telling everyone I e-mail to check their spam folders.

y0ghur7_xxxon Snow – A layer 3 virtual network that uses public keys instead of IP addresses

> Wouldn't it be better if the address was the hash of the public key?

It IS the hash of the public key...

-----[snipsnip]-----

This is a public key hash:

aaaac6rxjmmenb7m5txgpe3nmmrrh4z4ohcr7sxqkrvbk4csbrrorpw7.key

Snow lets you use it like an address...

-----[snipsnip]-----

y0ghur7_xxxon How private is your email? Not very

> email is still federated, I can start my own email system.

I did that with a server on ovh. Every mail I send to a gmail/outlook/yahoo account goes to the spam folder.

It became very difficult to run your own mail server in the last few years (if you want your mail to go to the inbox of the person you send it to).

And yes, I set up spf and dkim records correctly.

y0ghur7_xxxon Facebook’s Blu-Ray Powered Cold Storage Data Center

All our chat history is there

y0ghur7_xxxon Windows Kerberos ticket theft and exploitation on other platforms

> If this is required for the exploit

there is no exploit as far as i can see. the article just describes how to use a kerberos ticket generated on a machine on another machine.

y0ghur7_xxxon Google hacked account

Unfortunately (because their services are quite good) google has no support staff. This is well known, and you should take it into account when using the services they offer.

It is not difficult to do without them.

Asking for help on HN or Reddit works sometimes, but if your business (or personal life for that matter) relies on their services you should really work towards being able to do without them.

y0ghur7_xxxon Own-Mailbox, the first 100% confidential mailbox

I would say that if you lose your key you lose your data, as it should be.

y0ghur7_xxxon Google Is Now Listing SourceForge as a Malicious Site

https://news.ycombinator.com/item?id=9718625

tl;dr: uBlock Origin

y0ghur7_xxxon Ask HN: I have ssh, they have ssh, how can we chat?

> get netcat to only listen on localhost

nc -l 127.0.0.1 5000

y0ghur7_xxxon PCRE Heap Overflow in Regex Processing Lets Users Execute Arbitrary Code

Here the text is formatted better: https://bugs.exim.org/show_bug.cgi?id=1636

y0ghur7_xxxon Firefox 38 released

What happened to opportunistic encryption? I loved that feature but it was disabled because of a bug. I hoped it would be enabled again in the next major release, but no mention of it. Can someone from Mozilla tell me more?