HNHacker News
TopNewBestAskShowJobs

developer2

2,010 karma · joined December 27, 2015

submissionscomments
developer2··on AWS EC2 General Price Cut
To add context to the downvotes you've acquired: I didn't downvote you, but I think I understand why others did. Your parent comment was asking about 96 GB of RAM, and you posted a reply talking about 512 RAM. I suspect others thought you were talking about 512 MB (ie. 0.5 GB of RAM, which is common in very cheap hosting) rather than the 512 GB of RAM you actually commented on. When I first read your comment, I admit I first saw "512 MB", but you quite clearly wrote "512 GB".

tldr; The number "512" when talked about in the context of RAM is assumed to be measured in MB, but 512 GB is also a less-commonly-encountered amount of RAM. :)

developer2··on GitHub Insights
Nope, fuck this.

The moment a product mentions "From developer to CEO" (ie. includes the word "CEO"), this is bad news. As soon as you introduce any metrics involving "participation awards" (whether based on lines of code, commits, reviews/pull-requests, etc.), the company is doomed to fail at understanding how productivity/worth is measured in the development world.

The fact they even mention "CEO" in their tagline is all one needs to know. There is not a single CEO in the world who should give a goddamn shit about actions taken at the source control or release level. It's all marketing drivel intended to promise management that the product being sold can somehow deliver insight into a world they will never understand. The fact is developers will just waste time inflating their metrics to satisfy productivity algorithms, while costing the business time–and therefore money–developers could have spent actually improving the product.

developer2··on No cookie consent walls, scrolling isn’t consent, says EU data protection body
Bingo. "Auth Token" simply becomes "Session ID", and the backend then tracks anything it wants as part of the session.

I don't see much of a solution other than making it a matter of policy, eg. Microsoft's "P3P" header. Otherwise authentication credentials need to be supplied with every request. Not a session id or token as a cookie, but the actual username and password being supplied with every request. Basically the old http basic auth, but with a more modern system to replace it.

I understand the core idea behind the EU's desire, but the fact is that cookies are absolutely required for login sessions, and it's impossible to allow users to opt out. The EU doesn't understand the tech behind the laws they are trying to enforce, and this is where it leads to. Absurdity.

developer2··on Postman delivers 'somewhere in Sheffield' parcel
>> This is why I don't pay merchants for any sort of expedited delivery.

That depends on the difference between ground vs. air delivery. I usually pay expedited shipping if I expect it to convert a 2-3 week ground delivery into a 1-3 day delivery by air.

Yes, some companies offer "normal" vs. "expedited", with either choice being shipped by ground. In that case, I agree that shipping expedited ground–especially if it's within state–is designed to rip off those who don't known any better.

developer2··on IRC Logger with fluid web interface, search function, and live streaming (2019)
> I guess I view it as speaking in public.

100% this. IRC chat has no right to privacy as far as I'm concerned. If anyone can join without an explicit invite that has an expectation of privacy, those rights don't exist.

developer2··on Unity Learn platform free for three months
Thanks for the insight.

> In VR people will stick their heads everywhere.

Particularly when players have any level of knowledge about what kind of complexities or edge cases are likely involved (eg. any software developer or QA, even if not part of the gaming industry). Or... hell, maybe it's even worse when you have ignorant players who expect the VR environment to mimic real life so perfectly that they get frustrated and can't understand why certain actions aren't supported/working.

The first VR game I got to experience was one of the haunted house horror games, and you're damn right I bent down and tried to shoved my head into an open cupboard just to see if the collision detection stopped at the outer box of the model, or whether my head would be allowed to enter the space. Then repeatedly leaned/shoved my head against VR walls at various angles to see if I could get the camera to clip or bounce/reposition jarringly. Poor, poor developers who have to try and nail all that logic perfectly. It must be so rewarding to see final results when everything works out well, though. :P

developer2··on Unity Learn platform free for three months
What does the other 10% entail, when creating a VR game vs. a (first-person) 3D environment for PC? I'd never pondered this, and am curious exactly which elements are any different whatsoever. The only obvious thing that comes to mind is making the camera smooth and flexible in terms of variable degrees of leaning/bending/crouching.
developer2··on Chrome phasing out support for User-Agent
I interpreted your parent's comment differently; namely, if Google's developers can't do User-Agent detection, then internally even they will have to improve how they develop (eg. via feature detection), making their products more compatible with other browsers.

Many people assume Google, as an upper-level business decision, purposely makes products work better on Chrome in order to vendor-lock users to the browser. Maybe that's true; or maybe it's developers being lazy and using User-Agent detection. Removing their ability to do so might actually improve cross-browser compatibility of Google products.

developer2··on Show HN: A Covid-19 testing location site that a group of us are building
[edit: tldr; There is no such thing as "getting tested". Stop looking for reassurance over a cough and fever; YOU WILL NOT BE TESTED FOR MILD SYMPTOMS; you're wasting very limited and precious healthcare resources which people who are potentially dying from severe symptoms need access to. Just. Stay. Home! /rant]
developer2··on How do Unix pipes work?
> Convention is that when a program dies because of a signal, the exit code should be 128 + the signal number

Note that this is incorrect. This is a common misconception about POSIX/UNIX. Not every process exits with an exit code; that's right, a process can exit without an integer exit code! A process exits with either a) an exit code, _OR_ b) the signal which terminated the program (as a separate status in the underlying struct, rather than as an exit code).

Many shells–including bash–provide an abstraction that translates process exits caused by signals into 128+signo, but this is only to fake an exit code for processes as seen when executed within the shell; this is a nonstandard and shell-specific abstraction.

Look at the man page for waitpid() for details. There are macros to test for the difference between an exit status with a code vs. an exit due to a signal; eg. WIFEXITED() and WIFSIGNALED(). WEXITSTATUS() will return the exit status... if one exists because WIFEXITED() tests truthful. Hint: if you're used to seeing your shell report 128+signo, that's because your particular shell happens to check waitpid() for WIFSIGNALED() and sets $? to 128+signo for you… as an abstracted convenience.

tldr; An exit code, vs. an exit caused by a signal, are mutually exclusive statuses. Processes terminated directly by a signal do not have an integer exit code; your shell may provide a fabricated exit code to make things appear simpler, but that is shell-specific and NOT a standard convention provided by POSIX or UNIX.

developer2··on How do Unix pipes work?
The biggest takeaway here IMO is that Python breaks the standard contract regarding signals–at least for SIGPIPE. Python should not be catching and throwing an exception for SIGPIPE; it should simply exit immediately, which is literally the default POSIX behaviour... unless a script/program/process specifically installs a signal handler to perform cleanup before exit. Python has some pretty awful behaviours built into it, and this is one of them.

Half of this article is not "How do Unix pipes work", but "how to fix broken SIGPIPE handling in Python".

developer2··on How the iPad's New Trackpad Works
It remembers where you left the cursor. It's still a normal cursor, they just make it invisible when not in active use.
developer2··on Launch HN: Fly.io (YC W20) – Deploy app servers close to your users
Meta Comment: Why are such posts (to HN users) written in grey text on a matching background? So hard to read, and I'm not even color blind. Please make it normal black text, ffs; there is no reason for this abysmal color scheme. Every time I open one of these posts, my initial impression is that it has been downvoted into oblivion, because that is what the color represents.
developer2··on Lesspass – open-source stateless password manager
Those of us using a different random username and/or email address for each sender do it for two reasons:

1. If whichever identifier is used for login (eg. email address) is exposed/leaked, it cannot be used by the attacker to lookup accounts in other leak dumps.

2. It allows to detect which site/service/entity is selling or leaking email addresses to third parties which send spam. I no longer need or have a spam folder. The moment I receive a spam email from someone I don't recognize, I can lookup which site/service that email was for, and choose how to act; eg. update that site/service's to use a new email address and blackhole the old one; maybe unsubscribe/close the offending account if it happens again. Of course since setting up my unique-email-per-site setup, I haven't been victim to third-party spam yet; likely because I no longer have a personal email in public Github commits.

developer2··on Alcoholics Anonymous vs. other approaches: the evidence is now in
While that is touted as being the case, many groups make use of the Serenity Prayer[1]. Most of the time, it directly invokes the use of "God" or "Father" which can turn off non-believers. Some groups use a variation that omits direct reference to a religious entity, while a few groups are committed to avoiding the prayer altogether.

https://en.wikipedia.org/wiki/Serenity_Prayer#Use_by_twelve-...

developer2··on Ask HN: What's the best corporate password manager?
Yeah. While I can understand wanting to be able to reset a user's password as an administrator of other users (eg. an IT department supporting those who forget their master password), it's also a security problem to allow such a feature. Basically, all user accounts under an organization would need to be encrypted with two separate passwords: the user's, as well as the IT/admin/company "master key". Having all users' passwords encrypted with a master key password to allow resets means all users' passwords across the entire organization can be compromised by a single IT employee's master key password.

Personally, I'm ecstatic that there is no recovery process to reset or recover a Bitwarden master password. No security questions. No email reset. No one-time use login codes (which would need to be stored somewhere not encrypted by a user's secret key in order to verify). Again, I can understand why an IT department would want that, but all that does is open up attack vectors that are very easy for an attacker to abuse.

The whole point of the master password is it's the ONE AND ONLY password you cannot forget or lose. One... lousy... password.

developer2··on Ask HN: What's the best corporate password manager?
I imagine the parent's question was moreso "share any credential between any two accounts" (as a multi-to-multi relationship), rather than being limited to sharing any/all credentials between exactly two accounts, which is extremely limiting beyond a pair of spouses.

Of course, Bitwarden also has the "Families" paid version, which costs... $1/month for up to 5 users (that's $1/month flat for all 5 users, not $1 per user). $1/month for a whole family is beyond reasonable, and precisely why I love Bitwarden – it's great software with prices designed to support a single developer's open source software rather than the exorbitant prices required to support an entire company and their proprietary software.

developer2··on Ask HN: What's the best corporate password manager?
The paid features are the same whether you self-host or not. The only difference is whether you're using publicly hosted servers or your own.

Search for "Organization Accounts" on https://bitwarden.com/ – either a) $5/month for first 5 users in a team + $2/user/month thereafter, or b) $3/month per user for enterprise (teams + premium for TOTP + user groups). If I understand correctly, the teams version allows users to manually share what they want, while the enterprise version allows finer-grained permissions based on predefined groups of users (including optional integration with LDAP).

I haven't used teams/enterprise, but based on the feature list ("User Groups: Use groups for easier user management and greater control across departments and teams", and "Access Control: Implement fine-grained access control policies and organize your vault with collections"), I assume it's possible to setup permissions to the shared collections however you want. I would hope it's possible to have read/write owner(s) to manage credentials, with an option to allow other users to be readonly if desired.

Based on my experience with the personal edition of Bitwarden, and how well the developer handles his community and GitHub issues, I expect it's now as mature and flexible as anyone needs. You likely need the enterprise ($3/mo/user) for the most flexible use cases. Don't quote me on that though. :)

developer2··on Ask HN: What's the best corporate password manager?
I have to spam another comment here to suggest that Bitwarden also has built-in two-factor auth. $10/year (not per month) for personal use, and I believe it's included for $3/month/user in the enterprise version. Cheaper than 1Password, and a better overall app imo.
developer2··on Ask HN: What's the best corporate password manager?
To OP: Please don't consider Passwordstate. It's so horrible to use, that users refuse to use it when it is offered. My company expects it to be used, but instead everyone (hundreds of in-house users) reuse the same password everywhere, and/or ignore company policy by using a personal password manager not linked to the company's internal servers.

Passwordstate pisses me off so much I can't even be bothered to go into details as to WHY it's so bad.

developer2··on Ask HN: What's the best corporate password manager?
I've never tried it, but I'm not surprised to find a support article for importing to Bitwarden from LastPass: https://help.bitwarden.com/article/import-from-lastpass/
developer2··on Ask HN: What's the best corporate password manager?
Can you elaborate? Changing a password with Bitwarden is just editing the field or–even better–a one-click button to (re)generate a new random password (including options for length and complexity requirements). If you are logged into the browser addon, it will also (depending how javascript-hacky the website is) prompt to save the new password when you modify the password in a website's settings.

Unless you're talking about mass-replacing a single password across a bunch of different entries? Which is certainly not a limitation of any password manager; reusing a password is just horrible.

developer2··on Ask HN: What's the best corporate password manager?
I haven't used it in a corporate setting, but personally I've been using Bitwarden[1] since November 2017 without a single hiccup. It's amazing. The best part: it's open source, including all clients/apps (browser addons, desktop apps, smartphone apps). The server component being open source means you can host your own instance on-premise (clients let you specify a custom host to sync with to avoid using Bitwarden's public servers).

Personal use is free, with an optional $10 per YEAR (not per month) addon that adds a built-in TOTP client (ie. Google Authenticator compatible two-factor auth). There are also "Organization" accounts at extra cost for more enterprise-level usage, including sharing credentials among teams.

Note: I believe that even if you host on-premise using the open source code, it expects a paid license for the extra features (TOTP and Organization accounts), at $3-5/month per user.

[1] https://bitwarden.com/

developer2··on Google Kubernetes Engine is introducing a cluster management fee on June 6
Yeah, that's the one. I'd done my own analysis before that came out and figured it was an unacceptable risk, and then that article came out with the actual attack vector in all its glory. The simple fact the k8s/etcd ports are exposed on a public address with no ability to firewall it off is bad enough, as you're relying on the security of the software running on those ports rather than a firewall restricting which source address(es) can even connect to begin with.

The credentials (certificates) being exposed via http://169.254.169.254/metadata/v1/user-data – from within any pod/container, not just from a physical node – was the final straw. I'd forgotten that the DO token wasn't directly listed there, but can be extracted from the etcd instance where it is stored (explained under "DigitalOcean Account Takeover" of that article).

Again, all of this may have been (and hopefully has been) mitigated since the original release. For me, it's too late to reevaluate; the fact that was considered releasable in the first place destroyed any credibility in my eyes.

developer2··on Google Kubernetes Engine is introducing a cluster management fee on June 6
Care with DigitalOcean's Kubernetes offering. Unless they have completely revamped their entire stack since their initial release, it's a security nightmare. The way they launched it was unacceptable for any company to use. I immediately migrated my projects away and closed my account upon understanding how abysmally they screwed up the security of that offering. The fact they were willing to launch that means they cannot be trusted to host anything.

Not only are your cluster's administration ports exposed on public addresses with no ability to firewall them, but each node pulls an Admin-level auth token to manage the DigitalOcean account behind the scenes. A single http request made to an internal IP, from within any Docker container running within the cluster, grants the attacker full read/write access and control to the underlying DigitalOcean account. This includes any developer who does so from code deployed into the cluster, giving the developer full access to the business's DigitalOcean account.

developer2··on iOS 13 app tracking alert has dramatically cut location data flow to ad industry
Hint: if Apple allowed apps to run indefinitely in the background, it would be less than a month before almost every app "needs to run in the background", for user-unfriendly reasons. And battery life would drop to a couple of hours.

This is why I'm an Apple user. Hate regarding Apple's policies like "use a platform that lets the app function correctly" (ie. drain battery running in background just to do more tracking, or because every developer assumes THEIR app is so special that it must never be unloaded from memory, in order to open instantly when being swapped back to... weeks after user's last interaction). With hilarious frequency, the complaints people have about Apple are precisely the reasons I prefer their products.

developer2··on Better protecting kids’ privacy on YouTube
You replied to a comment where their primary concern is, quote: "When a scary clown jumps out and screams, that's traumatizing". Not porn, sexual innuendo, or pedophiles looking for potential victims. Not war, or violence, or even brainwashing advertisements. It's clowns... their primary fear about YouTube's content is the possibility their sensitive child will be exposed to a clown.

It's impossible to satisfy everyone, regardless of the content rules, and no mater how curated. YouTube could spend a billion dollars curating content, along with surveys where 90% of parents have to approve a video before it is included, and the remaining 10% would still be the vocal minority ruining it for everyone.

Sure, YouTube probably doesn't do quite enough. But when you have parents looking to let YouTube babysit their 2-8 year old children without supervision, whose fault is that? YouTube's, I'm sure. /s

developer2··on The Decade of Swift
Has Swift improved their text handling? Last time I looked, it took way too many lines of code and temporary variables just to extract a substring range from a string. Their convoluted idea that a string can't be directly sliced with integer indexes–by bytes, let alone by Unicode code points or graphemes–was so frustrating I swore I would never look in Swift's general direction again. It was such a joke just to try to extract x UTF-8 characters starting from position y. I liked the overall feel of the language, but the fact I ran into such a horrible wall trying to perform the most basic of string manipulations was unforgivable.

Swift came out at a time where UTF-8 was already the standard. They talked a lot of talk about grapheme clusters being the most accurate representation, and then failed to deliver a coherent API to back it up. Any chance that has changed?

developer2··on Epic CEO says it won't ban Fortnite players for taking a stance on human rights
To be specific, Riot Games sold the full 100% to Tencent. Tencent owns partial shares in a lot of companies; when it comes to Riot Games / League of Legends, that percentage is the full 100.
developer2··on Saving Money by Switching from PHP to D
Would I be right to assume that your PHP was version 5.x and you didn't do the upgrade to a 7.x release? PHP made enormous leaps and bounds in terms of performance starting with 7.0, and has subsequently been improved in each of 7.1/7.2/7.3. It even has JIT coming in the next version. One fact: PHP 7.0 started to closely match–and in some cases beat–the performance of HHVM (Facebook's PHP replacement); so even Facebook could likely run on the latest PHP rather than their custom solution.

Personally, if I switched away from PHP for web development these days I would do the backend in Go. But thank you for teaching me something new today. SCGI is not a protocol I'd heard of before, what with FastCGI being the (horribly legacy) standard. I have something new to research. :)

← PreviousPage 3 of 25Next →