newscracker

> Recognizing the increasing demand by consumers to enhance security and in particular user convenience, Amazon rolls out passkeys widely across most devices and browsers. This underlines Amazon’s commitment to bend to consumer demand.

Which consumer base has demanded enhanced security and convenience (for which passkeys are the proclaimed answer)? The non-tech crowd has no idea what it is and is probably just hearing about it. The tech crowd on a forum like HN seems to be mostly against it because of issues with account recovery and cross-device use that passwords don’t pose.

From what I understand, it seems like passkeys may ultimately rely on SMS OTP or similar mechanisms for account recovery. The other likely result would be losing the account forever, especially if the user is a single device one (there are billions of such people around the world).

I’m going to wait it out a little longer to see how the interoperability factors play out in reality and learn from those who are braver than me.

It's easy to give some generic advice, which may or may not help. Becoming an "expert" (knowing something well, not intended to mean knowing more than the audience) can increase your confidence. The tangential aspect is dealing with "impostor syndrome", which will work against you.

For presentations, there are books and videos to learn from. But what matters is practice, which can be done in safer spaces and smaller groups.

Lastly, this sentence in Steve Jobs's commencement speech at Stanford in 2005 [1] could help:

> "Remembering that you are going to die is the best way I know to avoid the trap of thinking you have something to lose."

Realizing that everything is impermanent, and that whatever you think or others think today may not stay around in a decade or few from now, also helps. It is ok not to be good at presentations or speaking to an audience. Not everyone is cut out to be a great speaker or a good presenter. Focus on your strengths and derive satisfaction from those. Frame this or keep this around in some form: "This too shall pass".

[1]: https://www.rev.com/blog/transcripts/steve-jobs-stanford-com...

> Software that is merely source available, of course, is not FLOSS by default. But I don't actually see free software being replaced by software which is just source available.

GP here. I agree. I should’ve worded it better to say that a lot of “*source” terms are used to make it seem as if the publishers are meeting a great ideal (like FLOSS), but are muddling things more and more. I shouldn’t have listed “source available in the very same sentence” without being clear. I don’t have stats, but “open source” and similar terms have been used as buzzwords for marketing while the publishers really want their SaaS to be the one people ultimately pay for and use.

I hope he’s able to manage it well (since the prognosis is good) and is around for a lot longer.

We need absolutists like him who go to extremes and are known widely. For a few moments, leave aside his personality and what people have said about his behavior or hygiene. If he hadn’t been there, our world would’ve been a lot different and a lot poorer. A visionary is what he was and is.

While the Free part of FOSS is being substituted by “(just) open source” and “source available”, while DRM goes deeper into our lives, and while everything is becoming a “hosted service”, one can only hope for (and put efforts into) going back to the ideals he proposed and pushing back on the elements that control us and seek to do even more so.

We all don’t have to be absolutists (it comes at the cost of convenience, which most people prefer), but there are enough of such people around the world as far as FOSS is concerned. Whenever I see FOSS meetups and people connecting over it, that’s something I’m grateful for and wholeheartedly support (though I’m not one of them).

I’ve been using Bitwarden more as a backup since it lags in more ways than one. With iOS 17 bringing password sharing, I may be able to rely on that and switch to KeePass (and its derivatives) as a cross platform backup where needed.

Products like 1Password and Dropbox first made a good consumer product before pivoting to enterprise and making the products worse. Even before the VC funding of $100 million, Bitwarden started pivoting to cater to enterprise features and neglected the consumer side. This has resulted in Bitwarden doing a minimum set of things in a very mediocre way.

Its desktop clients are based on Electron and suffer with the common issues related to that (don’t behave like native apps for keyboard shortcuts or navigation, sluggish, etc.). Its mobile app, at least on iOS, is also sluggish and has poor UX.

People have asked for additional predefined item types (like WiFi passwords, software licenses, etc.) and that’s been on the roadmap for more than five and a half years [1] with no timeframe for release in sight. It just recently changed the timeframe for this from the first half of 2023 back to “Under Research”. [2] In all likelihood, it’ll be six and a half to seven years by the time that’s done, if at all.

One positive about Bitwarden is that its free tier offers something that’s somewhat good (ProtonPass is nowhere close to this as of yet). But I don’t see anything in the password management market that’s cheap enough (like Bitwarden’s personal plan), has good features (including browser extensions) and stability, and is managed by courteous and helpful people (1Password fails on some of these).

[1]: https://community.bitwarden.com/t/additional-item-types-pre-...

[2]: https://community.bitwarden.com/t/bitwarden-roadmap/12865

Keep in mind that Posteo recycles email addresses after a few months or so once the account is unpaid and/or deleted. This means, unless you have a difficult to guess or uncommon email address on Posteo, the chances that someone else might intentionally or inadvertently get your old email address is higher.

But I like the fact that Posteo allows prepaid credit balance in the account (but it allows only a maximum balance of EUR 60). That could help in keeping one’s address alive for longer.

I somewhat agree with this. I do believe that a larger provider is less likely to lose their domains than an individual is (there are always exceptions).

Domains expiring is one reason why I always have my domains paid for 10 years in the future and renew every year to extend it by a year. I’d like to see service providers who work on a prepaid credit model (not a monthly or annual charge model, where the cards or payment methods may have been closed or canceled) and renew the domain automatically every year as long as there’s a balance in the account.

Last I checked, even Cloudflare doesn’t allow prepaid credit balances to be used for domain renewals and insists on charging the payment method on file. And it’s not even the case that people haven’t asked for it. Cloudflare’s billing policies are weird. This is one of the reasons why I’ve avoided transferring domains to it.

I wish ICANN would allow paying for domains (at least the most common TLDs) for a longer period though. If my domains aren’t renewed in 10 years after I’m gone and someone is dependent on those, there’s nothing much that can be done.

There's nothing that offers all these features and is free. But if you'd like to try Orion browser by Kagi [1], you can install uBlock Origin and many other web extensions for it on Mac, iOS and iPadOS. A paid alternative that is similar (at least for blocking specific elements) is AdGuard [2].

[1]: https://browser.kagi.com/

[2]: https://adguard.com/

If you only need email, then there are a bunch of providers in Europe that are cheaper (especially compared to something like Fastmail if you need one mailbox for each person in the family), have been around for several years and support custom domains. In no particular order, they are mailfence, mailbox.org, runbox.com and migadu. All of them support IMAP directly (unlike ProtonMail that needs a bridge application and Tutanota that does not support IMAP).

Or if you’re comfortable with extensions, use “Form History Control” [1] to save all your form inputs and to restore or export them.

Before XUL extensions were removed in Firefox, the “Lazarus: Form Recovery” [2] extension to save form data was one of my “must haves” with Firefox.

[1]: https://addons.mozilla.org/en-US/firefox/addon/form-history-...

[2]: https://github.com/lazarus-recovery/lazarus_addon

> If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong.

I can only partially agree with this point. Businesses getting cybersecurity wrong has almost no material and significant consequences. At best, they get a tiny slap on the wrist or asked to answer some questions. Nobody in said businesses goes to jail for it or personally pays any fines. Compare that to criminals who have a lot more to lose if they get caught — jail time, fines they have to pay, not having freedom for quite sometime, life not being the same after they’ve served their sentence, and more. Businesses have it extremely easy compared to this. No wonder cybersecurity is so poor among all businesses, including very large ones (like Microsoft, as a recent example).

Instagram bans accounts for no reason at all. It’s had some rogue and buggy bots or algorithms banning or deactivating accounts for years. Appeals don’t work.

Unfortunately, this situation doesn’t get a lot better with the fediverse, where one or two admins would decide what they like or dislike and use the ban hammer without any warnings. No appeals process or no responses over other channels. Maybe everybody is better off having their own blogs and websites rather than having (unpaid) accounts on others’ systems (centralized or not).

When this change was made several years ago on iOS, I was quite annoyed because I had the habit of turning off WiFi and Bluetooth periodically (mainly to stay disconnected). I think I even provided feedback to Apple (from the public feedback page) to change this to a three-way toggle — On, Disconnect Devices, and Off. This idea had been proposed by many other people too. Since Apple rarely takes such feedback into consideration and does things the way it imagines is best for users, I had to go to settings and turn these off every time.

Later (maybe a year or so), I found that turning these off was possible through shortcuts. Since then, I have one widget to turn these off and an automation (within the Shortcuts app) that turns off WiFi at bedtime. I use this regularly because I just don’t want WiFi turning on at 5 a.m. the next day.

If you’re fine with a single tab browser, Firefox Focus [1] comes with a built-in content blocker.

I don’t use Chrome (Firefox is my regular browser) and hence don’t know how the current/previous download interface was. The blog post doesn’t seem to have a before/after comparison either. Is there a screenshot or GIF or video of the existing/old UI for downloads?

I’ll be checking out the free version.

1. Proton Pass does not have password sharing right now. That makes even the initial limited time discounted pricing ($1 or €1 a month) higher than Bitwarden, where the latter allows password sharing even on a free account (though it’s limited) and in a less-than-$1-a-month premium plan.

2. The Proton Pass apps are native apps [1], which should be better (over time) than Bitwarden’s non-native apps on mobile. Proton Pass does not have a desktop app though and relies only on browser extensions. Bitwarden has an Electron-based desktop app that is slow and doesn't have standard OS keyboard shortcuts support.

3. No predefined types (like WiFi passwords, software licenses, etc.). Bitwarden has been working on this for more than five years [2] and it still doesn’t have it. It's eternally "on the roadmap".

4. Server code of Proton Pass is not (yet?) open source. So alternative implementations, like Vaultwarden in the case of Bitwarden, may be more difficult and more prone to having bugs with newer client versions.

I think if the price is lowered with an annual plan, password sharing implemented and the server code is open sourced, this could be serious competition for Bitwarden.

[1]: https://news.ycombinator.com/item?id=36787553

[2]: https://community.bitwarden.com/t/additional-item-types-pre-...

A few comments that I hope may help bring more clarity for your intended audience:

* Your website looks slick and kinda well designed (though there seems to be too much information moving around).

* The documentation starts with getting the user to sign up for the hosted version (SaaS).

* There is no pricing information or FAQ about pricing and business model.

* Though the code seems to be on GitHub and the license there is stated as AGPL, there are no prominent links to anything about self-hosting either on GitHub or on your main site. So I’m not sure why this is AGPL licensed but also talks the user into signing up to the hosted version in the docs.

I think the self-hosting documentation will help bring more people to try it within their own environment without worrying as much about privacy and security.

> Display resolution, eye tracking and hand tracking are problems that can be solved today with a more expensive device.

I don’t think Meta really wants its devices to be out of reach for billions of people, limiting its data collection and the future it imagines with vast amounts of behavioral data collected from all those people.

If Meta were able to create an independent company that doesn’t have to have tracking or profiling or advertising or connected to its surveillance properties like Facebook and Instagram, it could create good devices at high enough prices to compete with Apple on the experience and quality. But its not in Meta’s DNA to leave such things alone.

Totally agree. The value that ad blockers (especially uBlock Origin) have given in terms of user experience is immeasurable. It's a stark difference evoking anger as well as sympathy when looking at someone else's default (Chrome, usually) browser not having an ad blocker.

And in which you have personally audited every line of code for extra confidence. /s

There are several ad blockers or content blockers (free and paid) on iOS with varying experiences (and sometimes annoyances due to the platform limit on the number of rules a blocker can include). Firefox Focus on iOS comes a built-in blocker. Additionally, using something like NextDNS – which allows adding the same filter lists as uBlock Origin – also helps. Of course, these will not allow easy element picking and blocking.

I've copy pasted some of his rationale for not accepting donations (with links to the originals), in my comment on this thread at https://news.ycombinator.com/item?id=36230210

He's written in detail (with many revisions) about why he doesn't accept donations...since 2014, actually (and versioned those on GitHub too).

The latest version from April 2022 [1] says:

> I do not want the administrative workload that comes with donations. I do not want the project to become in need of funding in any way: no dedicated home page + no forum = no cost = no need for financial support. I want to be free to move on to something else if ever I get tired of working on these projects (no donations = no expectations).

> Have a thought for the maintainers of the various lists. These lists are everything. I can not emphasize this enough.

The oldest version from July 2014 [2] says:

> A couple of reasons, each on its own is enough for me to not want donations.

> First reason is a mix of practicality and because of who I am.

> If I were to accept donations, because of who I am, I would be unable to not disclose exactly what is going on with these donations: revenues, withdrawals (for what purpose), etc. Because these would be funds donated with the expectations to help, I would want to disclose everything related to these donations, so people who have given know how their donations are used for this project. That's just who I am, I wouldn't be able to do otherwise. Thing is, I don't want to deal with all this administrative work I would bring to myself if I were to accept donations. I just want to code.

> Second reason, to ensure the main purpose of these projects is protected.

> If I were to accept donations, then in my opinion, the projects (µBlock, HTTP Switchboard) would start a slow descent toward becoming dependent on outside funding, a slow descent toward a mean to earn funds, and this drift eventually leads to the projects' main purpose becoming vulnerable to other agendas. In my opinion. There are excellent open source projects out there which accept donations and are not compromised. Some others are in my opinion. So, as it is, I don't want these projects to have a dedicated home page (requires funding), a forum (requires funding), or whatever requires funding. No financial footprint means no way the main purpose can be preempted (µBlock, HTTP Switchboard are GPLv3). It bothers me Firefox decided to go along with HTML5 DRM.

[1]: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

[2]: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

The wayback machine has snapshots of this, including one taken today, June 4. [1] I hope the current error is just something transient and will be resolved soon. I also hope someone has contacts for the website to alert them.

[1]: https://web.archive.org/web/20230000000000*/https://www.bell...

This is great, and the fact that it clears HTTP cache and DNS cache is different from (and more aggressive on protecting privacy) other browsers and methods.

I use Firefox as my primary browser with Temporary Containers [1] and Cookie AutoDelete [2] (configured to clear local storage too). This combination does not handle DNS cache, but it does keep each tab separate (in Brave’s forgetful browsing, this is by site).

Brave makes it easier to choose Forgetful Browsing, though I just say that the toggle for this should be out in Shields instead of being hidden under Advanced controls. Most people who can figure this out and use it may probably be able to use Firefox and extensions as well. But the friction is a bit higher it’s Firefox and configuring different extensions. Brave should focus on eliminating this friction wherever possible so that the features are discoverable.

I keep Brave handy on my systems even though its not what I use the most. These innovations tilt the balance for me (on some of the negative steps Brave took with respect to ads).

[1]: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

[2]: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

This is well written, but it doesn’t really explain how or why Zulip will maintain its free plan forever. However, the existence of this post also makes Zulip committed deeper to not pull the rug on the free plan. Whenever that happens, I’d like to believe that there would be grandfathering for existing users on the free plan (unlike the rug pull that Google attempted with its free GSuite/Workplace offering and decided to not do it after a lot of backlash and bad press).

One thing I dislike about these chat platforms is limited message history. The 10,000-messages or 90-day message search history limits are arbitrary as well as too short to be useful for any group that has more than a few members on a specific topic/area. For some (or many?) people, this will be a practical and annoying limitation that makes the platform useless for anything other than trivial chats where history doesn’t matter (except for “this is what you said two days ago”).

Instead, they could consider offering very small (?) teams unlimited history. Platforms like Telegram (and Discord too, not sure?) are offering more and more features for free. Enterprise application integrations may be one area where Slack/Mattermost/RocketChat/Zulip may have an advantage for the time being.

Signal has had this feature (linking the same account in multiple devices) for years. I’ve added more details in a reply to another comment on this post: https://news.ycombinator.com/item?id=35729024

The article says (emphasis mine):

> WhatsApp users are getting a long-requested feature: access to the same account across multiple cellphones.

This has been supported by Signal for years by linking devices. You can have the same Signal account on the primary phone (the one you verified through SMS OTP), a tablet and/or a desktop or other device. Messages (and message read statuses) get synced across devices.

Open Signal, go to Settings, then to “Linked Devices” and then choose “Link a New Device” to set it up. And unlike the previous WhatsApp desktop solution, Signal doesn’t (and did not) have the requirement to have the primary phone close by to act as a proxy. You can leave your primary phone anywhere (like on some other network or offline) and still have the linked devices work fine.

One way could be to work with a tech collective that supports different causes. Riseup (riseup.net) is one. It may be more of sysadmin and platform work than developing apps though.

Unless you can commit for a longer term, it probably may not be worth their while.

Please see my other comment in this thread on how to copy filter rules from one profile to another. [1]

[1]: https://news.ycombinator.com/item?id=34735788