Hacker News Reader

Comment by tptacek | Hacker News Reader

The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.

View on HN

I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbates phishing. I think U2F probably helps a lot here, but I would really push to move away from web based workflows. It puts a lot of really dangerous UI all in the same window. In a world where people use Outlook (or pine, harhar) they don't type their all powerful email password into the browser because why the hell would the browser ever ask for the email password. But I think that ship has sunk.

First, running things locally opens you to local exploits which, once successful, can capture not only your email password but everything else you do on a computer.

Second, with a password manager, users shouldn't be typing passwords in. I don't even know my Gmail password.

Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.

Maybe the best thing to do is just ban attachments altogether at the domain admin level?

https://support.google.com/a/answer/2364580?hl=en

Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?

Is there a standard workflow for talking to sources?

No, but there certainly is for filing stories and running them through a series of editing desks.

Keep in mind "journalist" is a broad term now. Most blogs or new media mastheads work that way or track changes in Google Docs/G Suite/whatever. In general, I'd assume you're right about traditional papers, who I'd expect to work the way you suggest.

Smart money is following what WaPo is doing in that space with Arc. They've begun to corner that market.

Reply on news.ycombinator.com