HNHacker News
TopNewBestAskShowJobs

fian

415 karma · joined January 16, 2012

submissionscomments
fian··on Around a dozen banking apps began specifically permitting GrapheneOS
It's not the NFC the bank is interested it, it the MFA provided by your phone PIN, fingerprint or face unlock.

When you open the app on your phone, the phone probably needed to be unlocked first, though not everyone sets a PIN or biometric lock on their phone.

Then you will be prompted for a separate PIN or your fingerprint within the banking app. This provides a stronger signal to the bank that you are the legitimate account holder. If your phone is lost or stolen, the chances of someone else being able to authenticate to your banking app are considerably reduced.

With the web app, people will often save their bank website login credentials in the browser. So now someone nefarious only needs to access the unlocked computer or phone the go to the bank's website to gain unauthorised by still authenticated access to the customer's accounts.

Yes, there are now laptops and tablets with biometric authentication, so the potential is there for adding biometric authentication for banking website. However, when you look at the demographics of banking app vs website use, a strong majority of Millennials and Gen-Z do all their banking via the phone app. Gen-X also slightly favour the phone app whereas Boomers strongly prefer the website. So banks focus their development efforts where the majority of users are.

fian··on JDK 28
Swing with the Nimbus Look and Feel isn't too bad for a quick, functionality-focused widget and it's super handy to have it still built into the JDK. It's not a good option for building a long term desktop application UI now though. There is no on-going development, the focus is now in Java FX. Prior to AI tooling, finding answers to Swing questions was getting much harder. Surprisingly I've found Claude to be pretty good at providing simple Swing UIs.
fian··on Oracle bans AI-generated code from OpenJDK
How could you establish what parts of the code was produced by an LLM vs updated by a human afterwards?

The LLM will output different results over time as the models get updated. Are we heading towards needing to retain a full prompt history that can be replayed against a specific LLM model version to prove what the output was for copyright purposes?

fian··on Stolen Buttons
That could be a real experience for children in the not too distant future.

We are seeing more and more appliances coming out with less buttons and a mobile app to access advanced features. Also cars (annoyingly) are coming out with more physical controls replaced by touchscreen interfaces. It's not hard to imagine a world without physical buttons becoming a reality.

The days of digital buttons might also be numbered. Apps designed for touched enabled interfaces, particularly on mobiles, support swipes and gestures to perform different actions. There is no obvious indication you can perform an action with a swipe or gesture. Having grown up pre-internet with physical buttons, dials, sliders etc I automatically look for the digital equivalent for interaction, I don't assume I can swipe or gesture to do something. I have to resort to searching for "how do I do x with y" to find out.

Children on the other hand spend a lot of time playing with new things. they are far more likely to discover swipe or gesture through play. As an adult I am much more task oriented, I'm not looking to play I'm looking to get the thing done.

As children grow up in a world without physical buttons, they may not see the relevance of digital equivalents and lean towards swipe, gesture, voice control etc. Digital buttons may disappear.

An example of an similar technological shift happened for many pre-Boomers with the introduction of Video Cassette Recorders (VCRs). My father grew up with analog clocks and watches. Time was told by two or three hands on a clock face. When VCRs became more affordable in the 80s they came with digital clocks. He could read the time off the digital display but couldn't make the leap to setting a recording time by putting it into program mode then using buttons to set a record start time and duration. To him, time was set by moving the clock hands or twisting a watch dial.

The introduction of flat-UI bothered me in it threw away a visual indication that this "thing" is a clickable button. I obviously not fully adapted to swipes and gestures. I feel like a few steps down the path for whatever the future equivalent of "can't program the VCR" is. I hope the advent of LLMs will make it easy enough for application developers to produce multiple UIs for different classes of user button users, swipe users, whatever the next thing is (brain wave control??).

fian··on AWS: Inaccurate Estimated Billing Data – $1.7 billion
This is probably going to push me to completely close a couple of AWS accounts I setup when doing training courses so I could get certified (mandatory requirement from my work).

I'm not currently running anything and have no plans to at the moment. I've always had a mild dread that I'll suddenly get a bill for more than $0.00.

If AWS can goof in a way that causes obviously massive bills (like today), what's to say they can't goof in more subtle ways and start charging small additional amounts that many people may not notice and just pay it.

fian··on Ryanair passenger sucked toward broken window after midair engine failure
It's also so that rescue personnel can see into the plane in the event it crashes.
fian··on VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage
The AI tool providers need companies and customers to pay for the tools and automation. If all the white collar jobs in the Western world are replaced by AI or AI generated SAAS products, some 60% percent the workforce suddenly won't have jobs. If such a large percentage of the workforce has no income through employment, who will be able to pay for the services from SAAS providers and thus ultimately the AI providers?

The tradesmen working on my house renovations aren't consuming SAAS products during their day jobs.

The white collar workforce can't rapidly switch to blue collar jobs.

So for these companies to remain viable, they need the white collar workers to still somehow end up with enough money to pay for services that ultimately the companies provide.

Maybe the turning point will be a recognition that companies can't only focus on maximising shareholder value. They also need to consider their role in maintaining and improving the societies they operate in.

fian··on Linux phones are more important now than ever
I work for a bank. There is a strategic focus on the mobile banking app over the web app. Younger generations are doing everything through their phones. Including applying for home loans. Many banks are moving towards being digital only as contactless payments means people are using cash a lot less to the point that physical bank branches don't make sense anymore.
fian··on Bicycle riders' knowledge and experience of structural weakness in bicycles
As I teenager and then poor uni student, I rode a number of bikes or bike parts to failure.

I first snapped the top tube of a stell framed BMX near the stem after many years of using it for a local paper round with a milk crate roped onto the handlebars. The weight of the papers was certainly a contributing factor.

I've snapped a chain while out of the saddle, accelerating a road bike. Nothing too serious, just banged by knee on the bars. Still, do not recommend.

While riding up a long steep hill, I snapped the nut off the outside of a clipless pedal. Luckily the pedal didn't slip off the axle and I could get to a safe stopping point.

I had a carbon top tube delaminate from some aluminium lugs near the stem. Something felt off with the handling so I glanced down and could see ~1.5 cm of the lug showing. Decided to walk the bike the rest of the way to work that day. Got a local carbon repair specialist to re-bond it and it lasted a few more years.

That carbon frame eventually developed a crack in the bottom bracket and frame from front to back right next to the seat tube on the chain ring side. When it failed, the bike started feeling "noodly" to ride, so I looked down and saw the crack opening and closing as I pedaled along.

Somehow I snapped the rear suspension pivot in a Trek Y3 without realising it until the next time I went to ride it. I jumped on it to ride to uni and something felt off. Then I noticed the front and rear wheels were both tracking straight but significantly offset from each other. Took a while to get it repaired as it was a custom part.

When borrowing my brothers (pre-suspension era) MTB I tried a little jump up a kerb. The front fork folded in half. I bent it back straight enough to get sufficient wheel clearance to finish the ride (slowly).

I have buckled many rims over the years on BMX, MTB and road bikes. The early aluminium rims were expensive and really easy to buckle compared to steel rims.

Had the freewheel pawls fail in a rear cassette suddenly one day. They would catch once every few pedal rotations for maybe 1/3 of a rotation. Initially I thought I'd dropped the chain. It was a long walk home.

I was having trouble keep my front QR wheel on a road bike from vibrating mildly as I rode on it. I thought the bearing were loose, so I took the wheel off then found the hollow QR axle had snapped in the middle.

From riding with many others over the years, I'm also aware that larger (taller) riders can break stuff more easily as well. One work colleague who was probably 6'3-4" snapped a cog off the rear cassette almost perfectly in half while accelerating. He wasn't a strong rider, he'd started bike commuting a few months earlier. Maybe the crank length he needed brought extra torque.

Another very strong 6'1" guy I rode with for a few years cracked 3 carbon Bianchi frames within the first few months of owning them. All replaced under warranty. I think he was just heavier and stronger that the frames were generally designed for.

Frames are typically weakest at the joins as that is where the stress is concentrated.

Any rotating part will eventually wear and fail.

Ride a bike long and often enough and something _will_ give out.

fian··on Casual Viewing – Why Netflix looks like that
The Book of Eli War of the Worlds 2012 Day of the Triffids (TV series) The Bodysnatchers Waterworld The Postman Contagion
fian··on The tragedy of running an old Node project
I know this is a late response, but for anyone curious you would need to use an official Oracle or Sun JDK/JRE from Java 8 or older. OpenJDK doesn't include support for applets.

You also need a browser that has NPAPI. IE 11 was the most modern browser I am aware of that still supported applets.

The old GUI framework mentioned in the GP might have been Swing. It is still included in most JDKs and allows for cross platform desktop GUI application development with no other dependencies outside the JDK. Finding documentation on how to do GUIs in Swing is getting increasingly difficult though.

fian··on Return-to-Office Mandates Aren't Worth the Talent Risks
Using your restaurant example, if the restaurant closes it may not have much obvious effect on other nearby businesses. However, that restaurant would have given business to various food and consumables suppliers, to waste management companies, to an accountant etc. All those businesses have now lost a source of income and may be less profitable.

Perhaps the restaurant was leasing the premises from a landlord. The landlord may still have a loan for the business premises. That loan could be at risk of going into arrears if no other person decides to try their luck running a restaurant in a location that doesn't have sufficient patronage.

Consider now that the office workers who have refused to RTO work for the bank that holds the loan for the business premises. There is a risk to the bank now that the premises is less valuable because it can't be leased and is less attractive for a future purchaser.

The point is that most businesses don't operate without having other businesses as suppliers or clients. When one business does badly it can affect other businesses in their network. A small number of isolated businesses failing doesn't cause knock on effects. However, if a larger number of smaller retailers, dependent on foot traffic close in the same locality it will have a ripple effect out to many other larger businesses.

Business owners and executives have an interest in trying to maintain a healthy business network. Some will believe that pushing for RTO should help other local businesses in their business network and thus will be beneficial for their company in the long term.

fian··on Return-to-Office Mandates Aren't Worth the Talent Risks
There are broader implications for the economy if a large percentage of people continue to WFH. In larger cities, many smaller businesses, like food outlets, are sustained by workers coming to their city offices most weekdays.

Many such businesses failed during COVID knockdowns due to lack of customers. Some are still struggling to become viable again with a low RTO percentage.

For some medium to large businesses, these struggling smaller businesses or business owners are their customers. So there is some self interest from many companies to go back to the way things were.

Arguably the failed or struggling businesses could be being replaced by other services, eg home food delivery, but I've not personally noticed anything like that happening.

fian··on Digital Wood Joints
You are probably thinking of dowels used as loose tenons, where a blind hole is drilled into the mating pieces of wood and the dowel is not visible once the joint is together.

Sometimes people glue a butt or mitre joint, then once the glue has set, drill a through hole for a through dowel from an outside face of the joint.

The blind holes approach is tricky to get perfect alignment on where dowels are being added across a longer length. As a hobbyist I've tried a few cheaper dowelling jigs and had mixed success. This challenge lead to other loose tenon solutions like biscuits or dominos which allow for some side to side misalignment while retaining the ability to keep the visible faces aligned.

The through dowel approach avoids the misalignment problem, but comes with the visibility of the end grain of the dowel on one exposed face. Some people are ok with that.

Dowels are still one of the "strongest" options for end-grain to long-grain joints. Many professional woodworkers now favour dominos simply due to who quick it allows them to work and the additional allowance for some side-to-side alignment.

fian··on Don't bet on the joys of pokies (2011)
Shorter words mean less time with your mouth open which means less chance for the flies to get in.
fian··on Why I always hit the crosswalk button (2015)
Some pedestrian crossing buttons play different audible beats so blind people know when they can cross. Famously the beat of one in Sydney was sampled for a Billie Eilish song (https://www.youtube.com/watch?v=I-zeJRjP6xA skip to around 4:00 mins).

However others have no indicator or sound. To make things even more confusing is the pedestrian crossings can also be programmed to happen automatically at peak times with no button press, but absolutely need a button press outside of peak hour.

fian··on The Decline of Usability: Revisited
Due to my age and work experience, I'm also familiar with archiving involving storing physical documents in cardboard boxes. My current job really is paper free and graduate employees joining will never deal with archive boxes.

Similarly, the icons on my mobile for making a call, answering a call and hanging up are all based on the shape of the handset for a corded phone.

The Save button icon in many applications is based on a 3.5" floppy disk.

I sometimes need to save data as a PDF, which in many cases involves "printing" to PDF. The icon is based on a paper printer, but the action I am using it for doesn't include any external device or paper.

This makes me wonder about what icons we could use in the future where so many actions are done via a touch interface on a phone/tablet. There are less physical objects involved in common actions. So the skeuomorphic approach to icons for buttons is becoming less valid over time especially for younger people.

fian··on Scrollbars are becoming a problem
I'm ok with adding more functions to the titlebar, it's something I experimented with myself for a desktop app some 15 years ago. I found there was a heck of a lot of special behaviours tied to the titlebar and that overriding them meant a lot of work to fix edge cases like - being able to move windows. So I never followed through with it.

Maybe the addition of dedicated Move button next to the minimise, maxmimise and close button would be a reasonable compromise?

That would provide a consistent target to click on with your mouse. Obviously a button is a lot smaller than the entire titlebar for clicking on, so there would be some efficiency loss for people that regularly move windows (I am one of them). Getting move use out of the titlebar space would be worth the minor inconvenience of a more accurate click-drag to move operation.

fian··on My 20 year career is technical debt or deprecated
Java has been around for a longish time. Around the early 2000's there was at least a perception that you should avoid creating too many objects as that carried performance overhead for construction and garbage collection.

https://softwareengineering.stackexchange.com/questions/1495...

Immutable objects often require you to construct a new object to store an updated value and garbage collect the now unused previous object. So a lot of early Java code was written with mutable objects to avoid performance issues.

The Java Bean spec was written in 1997:

https://blog.joda.org/2014/11/the-javabeans-specification.ht...

fian··on Ask HN: Why arent developers interested in secure coding?
In my current role I work as a developer in the finance sector. We are interested in secure coding. Every year we have to complete a secure coding course and pass an assessment.

We have a team dedicated to performing security reviews for most code changes. Your change can't go to Production until it has been assessed by someone from the secure code team. They can request rework if they think you have introduced a vulnerability.

We have regular pen-testing performed.

There are various vulnerability scanners running against the code repos and blocking builds if a dependency is identified to contain a new CVE.

The project I mainly work on has been in active development for decades. It has well defined frameworks for many common actions. Most of the time we are working within those frameworks, which have been already been vetted thoroughly. Ironically, it is rare that we would need to touch code in a way that could introduce a vulnerability.

In a previous role I worked on desktop applications for engineering simulation. There was no requirement for secure coding for those projects as there was no central database. All the models were file based.

So it depends on the project and the risk and consequence of an malicious actor finding a vulnerability and exploiting it. The health and finance sectors have to take secure coding seriously. From experience, many Oil and Gas companies are also super strict on controlling data access and will often request proof that a software application has been security reviewed and pen-tested.

fian··on Use a developer desktop setup instead of a laptop
Agree with you on laptops not being ergonomic by themselves for long term use.

Perhaps not an issue for many development activities, but anything involving lots of calculations (CPU or GPU) will inevitably generate a lot of heat.

Desktops tend to be better at dissipating heat.

In a previous job, our desktops massively out performed our similar spec laptops for long running simulations.

Also you can typically attach more storage and GPUs to a desktop than a laptop if you need to.

fian··on Ask HN: Do you look angry while you work?
I regularly get apologised to by customer service people when I have been waiting for coffee of food. Usually something like "Sorry for the wait".

While I am waiting, I often retreat into my own thoughts, mentally processing some difficult problem or trying to plan out a project in my head. When I am thinking hard I adopt a "focus" face with a slight frown with lips pressed together.

The servers must be reading my face as annoyance or anger.

I always say thanks and smile when I collect my order so they know I wasn't unhappy, especially with them.

I guess most people are more "in the moment" and maintain a neutral or friendly face.

fian··on Quest for my perfect watch
https://www.casio.com/intl/watches/protrek/
fian··on What not to say to someone who has just been laid off
For many people, being selected for a layoff can feel like you have been judged as a lower performer than your colleagues. The thinking being that the company would always want to retain their best performers. This can cause a big loss of confidence for some people. They will be stuck thinking "Why was I one of those chosen for being laid off?"

Often though, the decision on who to lay off also considers who might be close to retirement, who might cost more to make redundant (redundancy pay in many places is based on years of service and there might also be long service leave owed), and the mixture of skills and knowledge the company thinks it will need going forward.

Also some people will have built up strong relationships with colleagues, teams and clients through their work. Their potential to continue these relationships typically drops dramatically without it being a regular part of work. That can make some people quite sad personally and frustrated that all of the work developing those relationships will suddenly not be very useful anymore.

fian··on The Match Girls
Many more people can now access dental/orthodontic treatments and minor cosmetic procedures. Getting your teeth straight makes a big difference to your appearance and make you more likely to smile in photographs.
fian··on Europe now has so much natural gas that prices just dipped below zero
To expand on this a bit, oil and particularly liquefied natural gas (LNG) production facilities are hard to stop and restart. Many systems need to be at a particular temperature, hydrates can form in gas pipelines during long shutdowns and thus need chemical back injection to manage, hot/cold cycling of equipment cause thermal degradation and many other challenges.

So a lot of design work for oil and gas production facilities is around minimising shutdowns. A large part of this is working out storage capacities, and for LNG, the shipping rates. If the LNG carriers (tankers) are unable to offload at a receiving terminal there is a higher chance the LNG loading terminal will reach tank tops. Tank tops at the loading terminal means the upstream production facility will need to turn down or stop all production. Given the high costs (capital and production opportunity) that incurs for the production facility, it might be better to take a short term loss for a few cargoes to prevent the tank tops at the loading terminal and thus a production shutdown.

fian··on How does a nail puncture a tire? (2003)
I have experienced a roofing nail puncture as a cyclist. In Australia roofing nails usually are galvanised with a washer to spread the load held by the head across a corrugated sheet of steel or plastic.

I was riding at around 35 km/hr and believe my rear tyre rolled along the nail from point to head until the tyre hit the washer. The washer then then forced the point of the nail upwards into my tyre, tube and then right through my aluminium rim. There was a very load bang and an near instantaneous loss of tyre pressure. I was lucky it was the rear wheel and not the front so I could keep the bike straight and slow down safely. The wheel wasn't ride-able after that.

In my car the two times I've had puncture were due to roofing screws which also have a built in washer type flange. Again I think the washer/flange acts as a lever helping to flip the point upwards into the tyre. In both cases the car tyre didn't deflate but we could hear the screw hitting the road on every tyre revolution so drove straight to the nearest tyre repair shop to get it fixed.

fian··on I Listened to 1000 B2B SaaS Sales Calls
A few companies I have worked for have had a strict no gifts policy. Many of our customers had similar policies, to the point that we couldn't even pay for a customer's coffees if we have a meeting at a cafe.

These policies are aimed at preventing even the whiff of bribes or favoritism wrt purchasing or awarding of contracts.

Mostly this was in the Oil and Gas industry. We had a few mining clients that were less strict wrt gifts/swag. I now work in the banking industry where there are strict regulations against bribery, facilitation payments and many types of gifts.

So I find it a bit weird to hear that sellers provide "swag".

fian··on Penetration testing wireless keyboards
I just recently replaced a cheap wired keyboard and mouse with a Logitech MX Mini keyboard and a MX Master 3 mouse.

My current WFH desk is not ideal and having a full sized keyboard with numeric keypad meant I couldn't center the keyboard for typing and have enough room to comfortably use the mouse.

I tried to find a ten key less wired keyboard that didn't have noisy mechanical switches. I can clearly hear my colleagues typing on theirs during Teams calls, which is very distracting.

I couldn't find a wired, small form factor keyboard, without mechanical switches. So I went the wireless route. I would have gone wired if I could find one that met my requirements.

Having used the Logitech for about a month, there are some pros and cons. I often like to use pencil and paper to diagram existing code to better think through how to change it. With the wired keyboard I was limited in where I could move the keyboard out of the way. Now I can move the wireless keyboard right off the desk.

I usually work with a work laptop open for Teams voice chat while primarily working via a virtual desktop connection on my personal PC. I haven't done it yet, but the work laptop recognises the wireless keyboard and mouse, so I could switch input between the laptop and PC at the press of a button. This means I wouldn't need to use the laptop keyboard or touchpad for input, freeing me to position the laptop for screen visibility and video chat.

The main cons so far are that the keyboard has lost the wireless connection to the USB dongle a couple of times. This can be temporarily worked around by (ironically) plugging in the USB cable used to charge it. Also the mouse seems to be laggy sometimes. Picking it up and repositioning it on the desk gets it working smoothly again.

fian··on Researchers successfully convert methane gas into liquid methanol
Liquified Natural Gas (LNG) is mostly methane with some ethane and is typically transported in cryogenic containers as it would require too much pressure to otherwise keep it in a liquid state. Even when transported in cryogenic tanks there is some boil off that is either captured and recompressed or used as fuel for the tanker.

Liqified Petroleum Gas (LPG) is a mixture of propane and butane which does not require cryogenic storage and will remain liquid.

Page 1 of 8Next →