Hacker News Reader

anfedorovon Dark mode in a website with CSS

I think he means if you're serious about dark mode then design two graphs one light, one dark. Solving "how do I turn a well designed light mode image into a dark mode image" is an AI task that would be a nice research paper, not something a designer can hack together with a bunch of if-then rules.

anfedorovon ProtonMail now offers elliptic curve cryptography

Worth noting, in similar vein — https://protonvpn.com/support/macos-ikev2-vpn-setup/

anfedorovon California Moves to Require 100% Clean Electricity by 2045

Also, what does "Clean Electricity" mean? I signed up for CleanPowerSF which only cost me 2¢/kWh more, if I remember right: https://en.wikipedia.org/wiki/CleanPowerSF

anfedorovon Google: Security Keys Neutralized Employee Phishing

There appear to be two points being conflated — 1/ 2FA via secrets stored on a separate device from your primary device with a PM provide more security than those stored on one device, and 2/ once you use a PM with unique password for every site, much of what OTP helps with for is already mitigated.

Both seem true, and what to do to protect yourself more depends on what kinds of attacks you're interested in stopping and at what costs. Personally, PM + U2F seems the highest-security, fastest-UI, easiest-UX by far — https://cloud.google.com/security-key/

anfedorovon Stripe Issuing – An API for creating physical and virtual cards

That may be a bad idea — you have entered into a contract, one that likely doesn't account for that sort of "cancellation" and so gyms could legally keep charging you, consider the account delinquent for awhile, then close it and sell that debt to a collection agency. On the other hand 24h fitness auto-canceled my membership when I didn't go for a little while, so at least some have some kind of incentive to not have people hate them.

anfedorovon Google: Security Keys Neutralized Employee Phishing

Not quite exactly "equivalently bad", since a user is more likely to notice a 2FA setup change than they are a phishing site's login error and then everything working as usual, but yeah, perhaps it's splitting hairs at that point.

anfedorovon Google: Security Keys Neutralized Employee Phishing

> If you're using a password manager to have unique passwords for every site, what does TOTP 2FA even protect you against?

Sounds a little obvious to write it out, but it protects against someone stealing your password some way that the password manager / unique passwords doesn't protect you against. Using a PM decreases those risks significantly, mostly because how enormous the risks of password reuse and manual password entry are without one, but it certainly doesn't eliminate them entirely.

anfedorovon Grand Jury Indicts Russian Officers for Hacking Related to the 2016 Election

I haven't read all the indictments and so might be wrong, but at this point I think it would be speculation. Time will almost certainly tell for sure. The wikipedia definition of the term seems easy to agree on — https://en.wikipedia.org/wiki/Asset_(intelligence)

anfedorovon Grand Jury Indicts Russian Officers for Hacking Related to the 2016 Election

At least some of that seems in the past. Presently, Schindler has good coverage of the details here [1], which details what a generous reading of mkempe's point is trying to say -- let's not go over-board.

1. http://observer.com/2018/07/putin-conflict-poland-ukraine-na...

anfedorovon Ask HN: Who is hiring? (July 2018)

Sigma (https://sig.ma) | Software Engineers, Director of Engineering | Millbrae, California | full-time | ONSITE / VISA transfers

We're bringing memberships, certificates, licenses, and credentials into the connected era via a platform built on Scala, GraphQL, and React.

More info: https://angel.co/sigma-certified/jobs

to apply, contact eng-apply@sig.ma or andrey@sig.ma with questions

anfedorovon Vendors, Disclosure, and a bit of WebUSB Madness

Could the browser create a tight whitelist of payloads that are definitely not hostile, then expand it slowly to add functionality?

anfedorovon Vendors, Disclosure, and a bit of WebUSB Madness

Why is it an obviously bad idea? In light of the work on NaCL, is there still no way you can imagine it could ever work?

anfedorovon Vendors, Disclosure, and a bit of WebUSB Madness

Aside from the "no HID" (does a YK even count as a HID if you turn off the default slot 1 functionality?), was the proxy designed to have a firewall / sandboxing of some sort? Google engineers have done some incredible things and while ambitious, it seems this kind of thing is well within their reach.

anfedorovon Vendors, Disclosure, and a bit of WebUSB Madness

Was there some work-around I'm missing or did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". Because the folks at Google Security are definitely smart and many orders of magnitude more experienced than me, and that's a vuln even I can understand / see the problem with so something institutional must have gone way wrong if WebUSB shipped on the stable release without some kind of block-U2F-forgery filter.

As far as Yubico, I get that they are doing something pretty hard in the hardware / product-market-fit domains, and I respect that and I want them to succeed, but they appear to be seriously dropping the ball on the software part of their product [1], as well as "simplicity breeds security". They could do so much better on the actual UI/UX if they piece-by-piece copied the setup UX of a "smart" vacuum cleaner.

1. I emailed & on-site support ticket submitted them days ago about some of their certs having expired on 2017-05-10, and have gotten not a peep in response & no fix in sight. Did nobody set a team calendar reminder and is nobody responsible for checking it on a monthly / quarterly / at the very least end-of-year cycle? That seems pretty elementary "underwear goes inside the pants" kind of security competence.

https://i.imgur.com/bOCfXJ2.png https://developers.yubico.com/yubikey-neo-manager/Releases/y...

anfedorovon Sucking carbon dioxide from air is cheaper than scientists thought

Noting conflicts of interests makes sense, but the point of the article may still stand. Why is there no market force for extracting CO2? Do any emissions trading systems include folks who capture emissions and improve the "supply side" of the equation?

anfedorovon Prove the badness of coworkers at your own risk (2012)

Sounds like there was bad blood or a general cultural problem there already. I can't imagine a well gelled team of people who like each other ever being unable to solve this kind of problem.

An employee should be comfortable going to their manager and their manager's manager about problems like this, and a manager should "nip it in the bud" when an employee begin running such "little pseudo-managerial experiments" on their colleagues instead of voicing your frustrations directly. What even is a managerial experiment? Colleagues and subordinates are not experimental subjects.

anfedorovon Please – A Cross-Language Build System

Are there any serious comparisons with package managers versus curl-to-bash? Seems as if there are a lot of trade-offs.

anfedorovon Uber and Waymo Reach Settlement

If all of the models line up a ton, an expert witness could explain that these the chances of reaching the same tuning on all these choices via independent work is practically 0.

anfedorovon New porn laws will mean Pornhub asks for your name and address

Not in the context of impersonating Boris Johnson's IP they are not.

anfedorovon Ask HN: Who is hiring? (February 2018)

Sigma (https://sig.ma) | Software Engineers | Millbrae, California | full-time | ONSITE / VISA transfers

We're bringing memberships, certificates, licenses, and credentials into the connected era via a platform built on Scala, GraphQL, and React.

More info: https://angel.co/sigma-certified/jobs/130819-software-engine...

contact eng-apply@sig.ma or andrey@sig.ma with questions

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

OK, then perhaps Dunning–Kruger effect.

Hayden does does not agree with you on this issue.

anfedorovon Addressing the recent attention focused on Strava and our global heatmap

I get what the controversy is about, but I don't get how this is OK from Strava's PoV — none of my runs are "public" in the sense that I think of it — they're not on the website that's my "profile" and they're not visible to people who are not following me in the app...

anfedorovon New porn laws will mean Pornhub asks for your name and address

What about them?

anfedorovon Addressing the recent attention focused on Strava and our global heatmap

I'm a quasi-active user and never realized my updates were public beyond the people who followed me. It has absolutely no UI indicating it the way, e.g. Facebook does, and does not show me any activity of people whom I do not follow.

Doesn't look like they're actually public, though? https://www.strava.com/athletes/22230419

anfedorovon Former employees say Lyft staffers spied on passengers

> I can think of more than one well-regarded unicorn where everyone still has access to basically everything

Hard to be sure, but GitHub support signed up for a friends-only beta of one of my products before I had told anyone outside my immediate circle about it.

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

What do you think corporations do to their corporate laptop disk encryption? Have only the employee be able to access it?

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

Link? Curious how one would go about measuring, e.g., criminal insider trading facilitated by wide-spread e2e encryption.

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

Violent crime, gun crime, murder rates.

What other kinds of crime are there, and how would you measure how much of it there is?

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

Sounds like you're in a bubble. There's reasonable people on both sides of this debate, even if some of them are wrong: https://www.youtube.com/watch?v=6HNnVcp6NYA

anfedorovon Senator asks FBI director to name the cryptographers who support backdoors

Source?