Hacker News Reader

_wlduon Key senators have voted for the anti-encryption EARN IT act

I believe that strong E2E encryption is critical to individual privacy, but I also believe that it doesn't really matter when most every nation state can compromise any phone at any time simply by knowing the phone number and sending a zero click SMS or MMS message to that phone.

Until laws are implemented that forbid this and/or security improves to do so, it doesn't matter how good the encryption is if it's running on a fundamentally insecure device.

_wlduon Ask HN: What is your “I don't care if this succeeds” project?

A signature cannot be reused. It's only good for 60 seconds and once used may never be re-used because I do not allow that. Register for an account and try to submit the same signature more than once.

I understand replay attacks. I don't allow that to happen.

_wlduon Ask HN: What is your “I don't care if this succeeds” project?

No, but it would be trivial to implement that into existing ones. But since it's not a password, it doesn't seem like a good fit.

_wlduon Ask HN: What is your “I don't care if this succeeds” project?

https://gen.go350.com/login

https://github.com/62726164/ed25519-login

I built a website that uses public Ed25519 keys for user authentication (rather than passwords). Users sign the current Unix Epoch time (with the private Ed25519 key) and paste that base64 encoded signature into the login form.

I don't care if the idea succeeds or not, I use it for myself. I like simple, secure things and I feel webauthn is too complex.

_wlduon Ask HN: What is your preferred “full-stack in a box” solution and why?

Go + Go + Sqlite

_wlduon Unmasking Insubordination

I think the focus is on accomplishing things. Even small things like you mentioned. If you make your bed first thing each morning and have a bad day, you will still come home to a well made bed (an accomplishment) that you can enjoy.

Every little accomplishment in life is important and motivating. They keep you going onto the next thing.

_wlduon A distributed peer to peer list of bad actor IP addresses and phone numbers

From the Github page, "I started this because I wanted to do C network programming"

I think this is a poor choice (from a security perspective). It should be written in Go or rust. C programs (exposed to the network) are dangerous even when written by experienced developers.

Really, in 2022, everything Internet facing should be written in a memory safe language, running as a normal user (no root) and have a strong MAC policy applied. Anything else is too risky.

_wlduon A distributed peer to peer list of bad actor IP addresses and phone numbers

Exactly, sometimes these systems are purposely used to deny legitimate users. Sort of like OS account lockouts (too many failed attempts). What if their goal is to lock the users out?

_wlduon Signal users can give a recurring monthly contribution

Yes. Without an email or phone number there would be no way to do an account recovery, but perhaps some other clever solutions (allow some of your contacts to reset for you, or sign a message with your key, etc.) may be an option.

_wlduon Signal users can give a recurring monthly contribution

Yep. Me too. The network meta-data is always present (IP, src, dst, date, time, etc.). Law enforcement could use that to find criminal actors committing crimes on the app.

But having such an app would allow law abiding individuals to communicate privately and securely without disclosing their personally identifying data to anyone.

_wlduon Signal users can give a recurring monthly contribution

Is there a market for a secure messaging app (similar to Signal) that does not rely on personally identifying information (phone numbers and emails) or is that too fringe?

_wlduon Starlink adds another 100Gbps connection to the SeattleIX

I hope they ship soon. I preordered Starlink and put down the deposit in Feb 2021. Still nothing.

_wlduon Adblocking people and non-adblocking people experience a different web

A friend (who does not use an ad blocker) showed me something on a website a few weeks ago and I was shocked by the invasiveness and aggressive nature of the ads. I asked him how he was able to use the web like this and he said it was annoying and that he was interrupted a lot, but he had sort of gotten use to it.

There's no way I would use a browser without an ad blocker. Doing so is counter-productive and also a major security risk.

_wlduon GoSTL: Algorithm and datastructure library for Go similar to C++ STL

unordered_map is hash based. It's as fast as any other hash backed data structure. Hash performance is well defined and widely understood.

_wlduon In the end, you're treated like a spy, says MIT scientist

We cannot marginalize segments of our population based on race, nationality, religion, sex, etc. and expect to remain competitive. This is a basic truth of economics. And it's also wrong to do that to people in the first place.

Americans are Americans and we all should be treated equally by our government.

_wlduon Poll: Is the leetcode grind necessary to land a high paying remote job?

If you want to work as a computer scientist, then you have to understand algorithms. Leetcode is just algorithms. Most SW devs do not need to understand this.

So long as SW devs realize simple things such as maps are faster for lookups (rather than looping over a list) and use them when needed, that's about all they need to know to get the job done.

I would also say that everyone ought to be able to come up with the brute force (slow) solution to the algorithm problems (at the very least) and then offer another solution that's still correct and somewhat faster. If you can do that, then most places will hire you (even if you can't think of the ideal solution in 20 minutes).

_wlduon Searching for Susy Thunder

Courts in the US give people 2nd, 3rd and sometimes 4th chances. This is especially true for younger people. They are still learning the ropes.

_wlduon Guide to Using YubiKey for GPG and SSH

You should avoid ecdsa and use ed25519 instead.

https://www.schneier.com/blog/archives/2007/11/the_strange_s...

_wlduon Store SQLite in Cloudflare Durable Objects

If you setup Sqlite properly (Remote Clients <-> RESTful API <-> DB) and use WAL mode, you can run a DB backed website fairly cheap. It will be performant, reliable and simple to maintain as well.

_wlduon Ask HN: Gmail account security

They want us to be compliant, not secure:

https://www.go350.com/posts/they-want-us-to-be-compliant-not...

_wlduon Discovering a security vulnerability in a major grocery delivery platform

Building applications is a complex problem. If you want a secure system, then security details have to be carefully considered at every layer (DB, API, front-end). Doing that requires expert security employees/consultants, time and money. On the other hand, profits are driven by new features, first to market and sales.

Companies can build insecure systems (that are profitable) much faster and much cheaper than they can build systems that are profitable and secure.

It has been my experience that security is seen as a necessary evil. It's not seen as a benefit or feature that customers want. Security employees/consultants are often seen as road-blocks or obstructionists. I think this is largely why technical security has been replaced by compliance. Just check the box mentality. When they get hacked they can say, "but we were compliant and we'll do better next time".

IMPO, that basic conflict explains why systems are repeatedly compromised and why companies nor customers really care about good technical security.

_wlduon Expose server behind NAT with Tor

If you use Tor, you should stop. I believe that it is mostly used by criminals and that it is largely ran by law enforcement agencies. I cannot prove this but I believe it is true. Simply using it makes you suspect.

Also, if you have a need to use Tor for work purposes, get written permission from your senior management and describe exactly what you will do while using Tor (scan our hosts externally, test our firewall rules, find exposed services or mis-configured systems, etc.).

If your goal is to be anonymous while surfing the Internet, find some other way, but stop using Tor for that.

_wlduon Cyberattack hits Ukrainian government websites amid Russia tensions

I think the poster was joking about the effectiveness of the current IT security community (or ineffectiveness).

"The Traffic Light Protocol (TLP) was created in order to facilitate greater sharing of information".

More info here: https://www.cisa.gov/tlp

_wlduon Modern War Institute: We Ignore the Human Domain at Our Own Peril

The military in the US is a great opportunity for young people (just out of high school) who can't afford college. They identify and promote talent. I know several ex Army guys who served and they are top notch people to work with. The Army paid for them to get masters and phd degrees. They also turned them into great managers who get things done. If you are young and poor but have ambition and drive, the US Army is a great choice.

I also admire the overall benefits program. Great health care, pensions and perks such as USAA memberships are really valuable. So it's difficult to put a number on their total compensation. It's much more than it seems and passes down (somewhat) to future generations. For example, my children can be USAA members because my father was in the Army in Vietnam (50 years ago).

_wlduon Ask HN: New Programming Language?

Thanks for the links everyone. I wasn't aware of Crystal. I'll check it out.

_wlduon Ask HN: New Programming Language?

If someone would combine the syntax of Ruby (it's fun to read and write) with the performance and static binaries of Go, I think it would be very popular.

I would like to enjoy writing Go as much as I enjoy writing Ruby. But Ruby apps are slow and hard to deploy. Combining their strengths would be great IMHO.

_wlduon Ask HN: Career change for elderly UK ex-convict?

Large corporate and government jobs are probably not available to you now. But, you can work for yourself as a consultant or contractor. There are pros and cons to being self-employed. Many people find it freeing, but maybe a bit less stable.

Criminal convictions just limit your job options. They are not a life sentence. If you have paid your debt to society and follow the law now, you can still have a great life. And, I hope you do.

Edit: I would also encourage you to never lie if asked about the conviction. If you lie, people will know and they won't trust you. Never lie about it.

_wlduon LastPass users warned their master passwords are compromised

Blog post about the design flaws of password managers:

https://www.go350.com/posts/the-design-flaws-of-password-man...

_wlduon Sherver: Bash lightweight web server

Interesting. I don't hear anything when I use the -a flag.

_wlduon Sherver: Bash lightweight web server

Here's my small webserver:

    #!/bin/bash

    while : ; do cat conference.txt | nc -l 80; done

Here's the story behind it:

https://www.go350.com/posts/finding-a-hacked-server/