diablo1

I'm an oldskool dev who shys away from 'the new shiny' because I've learned the basics of JS and you can get pretty far with the fundamentals, despite the allure of these rather expressive frameworks that get released every week now.

Frankly I get more joy out of writing bookmarklets, Tampermonkey/Greasemonkey scripts and customizing websites with various CSS 'userstyles'.

I also prefer SFTP and still enjoy uploading PHP scripts with SFTP and then building out some barebones CRUD app in my free time. Again, I shy away from the new shiny like GraphQL and things like Docker or Kubernetes etc.

> And didn't have any or much experience with old school HTML

A good heuristic for how good a web developer is is getting them to list every HTML element they know, including the deprecated ones like <marquee>. You would be surprised just how little elements they know, and more importantly, the semantic value of the elements. For example, knowing when to use <span> instead of <div>

The JS API is a bit safer as the user has to "explicitly enable this feature". Although in some browsers, full access is granted. Thanks for pointing it out. Another reason to surf with JS disabled and whitelist for sites that require it.

I am somewhat of a polymath, but a narrowly focused one, in that most of my skills solely apply to computers, and very little else. But then you may ask: computers are a broad topic: how does one ever conquer the subject and attain mastery of it?

My answer is simple: the world of computers is an endless one, a gigantic rabbit-hole (especially when combined with The Internet). Being able to download source code for a broad number of programs and have them run and configured any way you wish is still magical, no matter how many times I've tried it.

Then there's the fact that you can get reliable information on an endless amount of subjects with very little friction or red tape. I am still in awe of The Internet and haven't become jaded about it yet, as many of my peers have (they literally have grown bored of the net...something I can't understand). I guess it's how you apply the knowledge instead of merely knowing for the sake of knowing.

Thank goodness. Google is the biggest potential 'database of ruin' that could embarrass many people if even a sliver of the dossiers they have on people were leaked. Holding onto this database (without periodically wiping it) is like keeping tonnes of radioactive waste under the floorboards.

...That is often abused https://in.mashable.com/tech/12219/tiktok-and-other-popular-...

Would be interesting to see how many of these attacks could be mitigated with CSP[0]

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

It's worth inspecting traffic from iOS apps. I normally do this by creating a wifi hotspot in Linux, connecting my iPhone to it, and then inspect the traffic with Wireshark. Then I look at the DNS protocol and what is listed there. There is so much tracking going on behind the scenes in apps it is staggering! Also some (not most) of the traffic is unencrypted and I've even seen stuff that was sitting in my pasteboard being uploaded to some random server. (Even popular apps like TikTok spy on the pasteboard)[0]

https://in.mashable.com/tech/12219/tiktok-and-other-popular-...

I have made a habit of mining HN's Algolia search engine. You can uncover some real gems if you just put in the effort to narrow down your search to the particular topic you're interested in. Also: to avoid bias I wrote a script that opens random stories from the HN main page in my browser tabs, and am often surprised and refreshed by what I read (As most stories that gain popularity on the main page have vague titles)

PWAs need to be pushed more. PWAs are more private and don't have access to things that could contain sensitive information like the clipboard's contents which are often scraped and uploaded to shady C2s by some apps

I know people who have to have everything wireless. Little do they realize that all that extra radiation is probably slowly killing them. On top of that is the security risk of having personal data leaking out of your room to whomever decides to eavesdrop on the signal (A threat model which becomes clearer when you see how easy it is to collect signal leak)

I worry about this being swarmed by traffic and hugged to death. Since it's popular on HN, I imagine the particular Heroku instance is overwhelmed. I was surprised that it worked when I used it. I guess I'm gonna have to pony up and donate then...

If you dig around, you can find some alternatives to YP

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Rigid, ingrained beliefs can't beat a math problem

Even the Wayback Machine will not exist and there will probably be a reincarnation of it with archived copies of Wayback URLs. This is why blockchain tech is so exciting. Very soon everything can be cryptographically proven to have existed, stopping people from rewriting history and denying things like The Holocaust etc

There's an XKCD for this: https://xkcd.com/1319/

Also, anecdotally, I literally automate to prevent RSI[0]. There's only so much the human body can manually do with a computer

[0] https://en.wikipedia.org/wiki/Repetitive_strain_injury

How can these be forged? Say a page no longer exists, it could be possible to forge a quote and play a little game of disinfo?

Cool list. Although if I had the money, I would be using the premium version of some of these because premium actually _does_ necessarily mean better in most of these cases

You could do something like this:

`https://htt.ps/accounts.google.com/`

`htt.ps` if bought could potentially be weaponized for phishing since it resembles https://

I treat Javascript as an embellishment. I try to think of sites as electric stairs that still work even when they are turned off. A site should be as accessible as possible.

> I also wonder if it is named UtahFS because of the NSA facility near Salt Lake City.

Yeah I wondered this too. They don't say why they chose that wording. Maybe it's a subtle nod to that datacenter

Interesting name for a file system. Reminds me of this: https://en.wikipedia.org/wiki/Utah_Data_Center

Just as an example: there's a site Tom's Guide that monetizes in an article here: https://www.tomsguide.com/best-picks/best-vpn

The site is huge and they're doing affiliate marketing on multiple pages, not just my example link.

Also: The articles are also authoritative, authentic and not mere blogspam. They explain everything in detail and offer insights; the affiliate links are not the sole purpose: they want to write a blogpost too!

It depends on how much you want to earn from it. Most people are happy with Adsense and like their income from that, but to really earn properly you need to have guest writers, paid promotional posts, and be doing affiliate marketing. You also need to be as authentic as possible and not give the impression you are just doing the blog for money (as many sites do). Like anything, if it was easy, everyone would be doing it.

Well you won't exactly become Kottke overnight. Blogging requires that you build the habit of blogging. I like to write on an airgapped machine to trial out some posts before they go live to the masses.

If my post looks good, then I move it off the airgapped machine to my main device where I upload it to my Ghost instance and then seen by thousands, or even millions if it gets picked up by other bloggers/news outlets who would amplify your message and spread it far and wide.

Providing you have monetized it, you can generate revenue, although to really earn properly from it you would need a small staff of writers and master Commission Junction / Amazon Associates and you would need to consistently churn out well written high quality posts and also build your audience organically over time.

I meant spreading across devices. So separate DNS addresses for your phone, another for your tablet, and another for your laptop. If you use virtual machines, you can diversify the DNS addresses even further. You can also enable different DoH servers for different browsers that you use to further diversify.

Sending all your requests to a single DNS point is bad security. Best just 'spreading' your DNS out, so use a mix of Quad9, Google, OpenDNS, Cloudflare 1.1.1.1 etc

I live by the motto: Don't put all your eggs in one basket

Google is just a digital Eye-of-Sauron[0] and very difficult to avoid if you do any meaningful surfing of the open web. They have their fingers in many different pies.

There is even small subcultures on the web dedicated to avoiding Google by doing things like running 'degoogled chromium' and blacklisting various Google domains in their /etc/hosts file. Sadly all these mitigations don't work because Google already has a dossier on many people and even if you don't have a Google account, Google keeps tabs on you via fingerprinting or other means and knows who 'you' really are (using simple correlation and heuristics).

Then this raises the issue of: what can be done? I prefer to just be nihilistic about it and accept that Google already has dirt on me, despite my mitigations (I have a bit of history blindly handing over personal data to Google for a number of years). I think young people these days in 2020 have a great opportunity to implement mitigations and are better suited than me to browse privately, since I'm already contaminated by Google. (I still mitigate however, but it's not enough).

[0] https://lotr.fandom.com/wiki/Eye_of_Sauron

All of those attempts to provide a hosting service on the darknet are doomed to fail, because they are a huge target and have many people constantly berating the servers with requests trying to get in. I know setting up a hidden service is not for the faint hearted, but there's nothing stopping people reading Tor's manpages and diving in, figuring out how to host a .onion. It can't be that hard surely.

Doing mitigations on the server to avoid leaking the true location of the service could be tricky however, and requires you to do defense in depth. Apache is infamous for leaking details about the server.