gingerlime

what do you use for outbound SMTP? do you need to add/authenticate each domain or from address with it? (I host several domains and mailboxes)

Sending email out is a royal pain. Trying to deal with a Microsoft ban on my IP even though it’s sparkling clean for several years. DKIM, DMARC, SPF etc all ser up, reverse dns, you name it. Looks like Linode is being blocked as a whole pretty much?

Hate the level of centralization, particularly since there’s still a shit ton of spam still around. Sorry for the rant.

https://docs.microsoft.com/en-us/answers/questions/674558/55...

Yes. both a link and the code.

yes yes yes! not only that, the graduation ceremony won’t be as interesting as a casual day at home. What are the kids playing with? what’s on TV? or on the computer screen or phone (that’s going to be vintage in 20 years). Cars on the street and signs on shop or on buses. The dull daily stuff can become super fun to look back on.

source: me looking at family videos from the 90s

Thank you! super cool! how do you solve the trust issue? (e.g. someone reporting their competitor ips as attackers, or whitelisting false positives/appeals)

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam lists are a double edged sword?

in our case we included both a link and the code and saw an increase in confirmation rates. If I recall we reached over 90% conversion rates. For a B2C niche service, I think that’s pretty high. I somehow doubt removing the link will improve things further, but it might be interesting to test in future.

Besides the security and usability problems others mentioned, I also highly doubt it will improve confirmation conversions.

One thing that helped us improve confirmations -- we A/B tested it and confirmation rates increased ~8%: send a 4-digit confirmation code rather than just a link.

It's easier and more familiar on mobile, especially if you see the code on the push notification, so don't even need to open the email. I suspect it's less likely to land as a promotion email in Gmail, because of the code/semantics. It's quite a fun experience as well in my opinion. It seems like more work, but entering 4 digits on the same open tab is easier and nicer experience than clicking on an email link.

There are some security considerations. A short code can be brute-forced, so you need to rate-limit the number of guesses.

Impressive investigation and mitigation!

My lingering question however is still how come the phishers knew so much about cloudflare, yet missed the critical key (no pun intended): they had 76 phone numbers of CF employees and a plausible call-to-action, plus knowledge about okta usage, but missed the crucial fact that CF uses hardware tokens??

Whilst hardware keys are clearly better, I appreciate how storing TOTP keys on bitwarden also largely mitigates this kind of phishing. Bitwarden also checks the domain name, so if you don’t see the auto-login option (with or without 2FA), you should be concerned and not proceed. I know that storing the TOTP keys in Bitwarden kinda reduces the second factor to one factor. But practically I would argue that this kind of phishing is a bigger risk than someone hacking Bitwarden itself. For small orgs without security teams and resources, promoting password manager usage and including TOTP keys is a smart move.

without using Sol, I would say that not mining user data is quite a big benefit.

From the Raycast privacy policy:

> We use Personal Data for the following purposes:

> …

> To analyze how you interact with our Service. Reason: For our legitimate interests or those of a third party, ie to be as efficient as we can in our delivery of the Service to you

(personal opinion: it doesn’t pass the smell test)

GDPR excludes some financial data. So I don’t know about Experian, but I don’t think you can opt out of your bank holding data even after you close your account. For example, Transferwise asked me to provide a copy of my passport or driving license. I asked why they keep it for 10 years after they identify me, and they pointed out to some extensive regulation (which I believe trumps the GDPR).

That’s my understanding as well after listening to Crypto Critics and Griftonomics podcasts. Highly recommend both although so much stuff is way over my head. I wish there was a beginner’s version :)

not OP but I’m using a GL.iNet travel router. It’s tiny. USB powered so can be plugged to a power bank. It has an Ethernet connection as well, can use your phone’s tethering as well. Great little gadget for travel.

works great but has a couple of limitations compared to darksky. For example I couldn’t find a badge showing percipitation probability or even humidity (there’s one badge for everything?). The hourly forecast is disabled by default for some reason. luckily easy to enable once you know about it.

+1 for suggestions. It’s so much more helpful to see a diff and even be able to commit it.

generally I agree, but a no-card trial removes friction. I have a few open source projects, but they don’t use much code review or at all compared to the private repo at my company. Yeah I can add a card, but it’s easier to start without it, see if there’s a fit and then decide.

looks very interesting. a quick question about pricing: do we need to pay for all people in our github organization or can pick a few? we have some bot users, translator access, but only need the review tool for developers.

looks neat. A quick question: you mention pundit, but we use cancancan. Would it cause any conflicts?

That’s covered by the right of withdrawal, and is handled between the customer and merchant. But they cannot chargeback but can get a refund.

The idea that crypto solves fraud is laughable, particularly when so much fraud is facilitated by it.

Or 3DSecure which is becoming very common in Europe. No chargebacks.

if you want to pay, get Cleanshot. Not affiliated in any way. (very) Happy customer. It now has a cloud version, but the shrinkwrap/standalone license is enough. You get one year updates I think, and then you can keep it at that version or buy more updates. The most ethical software license for a tool like this one. We’re happily paying to support them and they keep delivering great enhancement. A recent favourite was OCR. You grab a portion of the screen like you take a screenshot, but instead it keeps the OCR text in your clipboard. Quite accurate even in different languages.

It’s easy in hindsight, but I think digital cameras had lower quality initially, and lower capacity, but it was clear that it’s a question of scaling until they replace film. Especially with instant feedback. Similarly early amazon was already useful for what it did.

> The ability to do distributed trusted transactions will change how business is done.

Trusted transactions are already done. The distributed part doesn’t solve a realistic problem in 99.99999% of use-cases. That’s why I think cryptocurrency feels like a solution looking for a problem.

I’m not sure if you’re joking or not. I tend to believe that simple designs improve security, so this sounds like the polar opposite.

But I guess I’m not the main target audience. Given the succees of Grammarly and other privacy invasive apps, people are happy to give away their data for convenience. The HN crowd might be a bit different however. Winning this crowd might or might not be an indication of success.

It sounds much more privacy respecting. I guess it depends on what’s included in those statistical updates and how much trust I can give the extension. For example for not getting hacked or bought by hackers (see the great suspender as an example).

Edit: I don’t even use Chrome :) but that’s not the main point, but perhaps shows where I am personally on the privacy scale?

I like the idea, but have the same concerns which prevent me from using Grammarly. I understand the challenge of doing this locally. But I just can’t get myself to install something that siphons off essentially every keystroke I make.

On a more positive note: is there something that detects or warns against hostile tone to help write in a friendly and non-hostile way? :)

Thanks for bringing in an extra perspective. I think I may have come across too negative. I initially felt excited about it, I hate captchas and deal with bots frequently and hate them even more. It’s all a trade-off, and this one seems a reasonable one at the moment. Yet I think we need to be careful not to take it too far. If my device manufacturer decides if I’m legit for me, and the largest proxy decides to cut me off based on that decision, that’s a pretty scary thought.

Not sure how I feel about it. Feels a bit dystopian for Apple to decide if I’m a human or not, as long as I pay the Apple tax?

I just imagine some video cams with robotic fingers attached to a device and automate browsing this way? sounds viable and there must already be some device farms even with human operators?

There’s an iOS feature called time-sensitive notifications (which eg Uber uses). Unfortunately it’s a subset of notifications as a whole, so I can’t disable notifications and allow only time-sensitive ones :-/

I tried but to no avail. My German is very basic which makes things even harder. From what I recall they have a legal duty to notify me, and email is an acceptable form of notification, and that’s about it. I ended up using a unique email address and then let it bounce, but not sure it’s the wisest thing(?). I don’t actually need any emails from my bank, so thought it was an ok solution, but not great.