Hacker News Reader

pton Oh no, not again a meditation on NPM supply chain attacks

When we close and reopen VSCode (and some other IDEs), it updates the NPM packages for the installed plugins. Would these mitigations steps (e.g. pnpm) also take care of that?

pton Nikon Issues Small Recall for a 16-Year-Old Film Camera

Baby bullet.

pton Helping organizations do more without collecting more data

From https://github.com/google/private-join-and-compute:

"Our protocol has security against honest-but-curious adversaries. This means that as long as both participants follow the protocol honestly, neither will learn more than the size of the intersection and the intersection-sum. However, if a participant deviates from the protocol, it is possible they could learn more than the prescribed information."

Also: "Disclaimers: This is not an officially supported Google product. The software is provided as-is without any guarantees or warranties, express or implied."

pton Ask HN: What VPN service are you currently using?

Is there a way to setup an “always on” VPN on my device, such that it disallows any traffic to egress unless connected to the VPN?

pton I made my own WireGuard VPN server

On the client, is it possible to setup an “always on” VPN? Such that when the client restarts on reboot, there is no internet connection until the VPN is on. Or when either the client or server glitches, the end point computer/mobile does not connect to the internet in the clear?

pton Marissa Mayer launches Lumi Labs, a new incubator

“Thinking about what's next, I returned to my roots, rented the original Google office where I started my career, and founded a lab with my longtime friend and teammate @eamunozt. A bit of info: lumilabs.com”

https://twitter.com/marissamayer/status/986716678682587136?s...

pton Show HN: Fanout – Reverse proxy to push real-time data to connected devices

How do you compare it with PubNub?

pton Frp: A fast reverse proxy to help you expose a local server to the internet

Check out https://www.trustedpassage.com (private beta right now). It's like ngrok but with security as the primary focus.

Disclaimer: I am one of the co-founders.

pton Why aren’t we using SSH for everything?

I was referring to the browser side certificate that can be generated using the <keygen> tag, and then used for the subsequent HTTPS sessions. Would this be equivalent to ssh-keygen for SSH?

pton Why aren’t we using SSH for everything?

Do TLS client certificates make HTTPS equivalent to SSH?

pton Opera VPN behind the curtains is just a proxy

I am actually working on build something similar. So, you could roll out an app-specific VPN like secure tunnel real easy. It is inspired by the work at Google IT called BeyondCorp [1].

The target market is companies whose employees require secure remote access to internal apps, but IT does not want to give a broad network access via VPN. So, marketing/sales like employees who simply want to access internal portals, etc. without the hassle of dialing into a VPN.

[1] http://research.google.com/pubs/archive/43231.pdf

pton CloudFlare and Google Cloud Platform

Yes, DNS history is one way to leak your IP. There are several other ways that the origin IP may get leaked, so you should be very careful if you use Cloudflare:

* Keep all subdomains on CloudFlare

* Don't use wildcard subdomains if you are not on Pro account

* Don't host mail or other services on the same server as your web server (email headers have origin IP)

* Never initiate an outbound connection based on user action

* Make sure that your web server and web application are patched against all known information disclosure vulnerabilities.

* Change your origin IP once configured for maximum DDoS protection on CloudFlare

Cloudflare documents it here: https://blog.cloudflare.com/ddos-prevention-protecting-the-o...

pton CloudFlare and Google Cloud Platform

Besides Cloudflare being the biggest man-in-the-middle on the internet, their DDoS mitigation offering is also questionable. If you google "clouflare bypass" [1], you get to websites that can tell you the origin IP address of a cloudflare customer's domain name. So, malicious guys could hit the real IP directly.

[1] https://www.google.com/search?q=cloudflare+bypass

pton Ask PG: How is Arc coming along?

A dream is a goal without a deadline.

pton [dead]

So Rapportive for XLS?

pton Apple – Live – September 2014 Special Event

Anyone hearing Chinese commentary?

pton LocalFlow – Discover your neighborhoods

``It was through the private world of family that the public world of politics came alive.´´

-Sonia Gandhi-

This is a first. Never seen a startup quoting from a politician from India (not related to Mahatma Gandhi) in their landing page :)

pton The Swift Programming Language

swift-lang.org mentioned at the bottom of the page seems to be down.

pton Show HN: JS library to make your website instant

Yeah, just tried it. Does not work with angular SPA.

pton Powerchair: A dad hacks a wheelchair for his disabled 2-year-old son

I would like to contribute money for Alejandro (as I do not have the hacking ability/skills to contribute anything meaningful for the tech). Is there a way to contribute money for Alejandro and his dad?

pton iWork "free" only for Macs purchased after Oct 01, 2013

From the fine print:

"Keynote is free on the Mac App Store for qualifying Mac computers purchased on or after October 1, 2013."

So disappointed to learn that Keynote is not really free for everyone :(

pton The Yahoo board has approved a deal to pay $1.1 billion in cash for Tumblr

Heard Kara "Fisher" for the first time, and not sure why, but I like the sound of it.

pton Oracle launches their own social network

This is not new, been around for 3-4 years now, and is targeted for oracle employees.

What Oracle launched on Wednesday is this:

http://cloud.oracle.com//my-cloud/service_social.html

This is a Social Network layer on top of their latest Fusion Applications. In my opinion, this is more about enterprise collaboration and less about "social". Oracle is just being buzzword compliant here.

pton Osama bin Laden Is Dead

Trump will now ask to see the death certificate!

pton Carol Bartz's paycheck reduced by 75%

18 billion ad impression per month.

pton YSlow for Chrome

Sorry for the false alarm. It works now. I think may have had to restart Chrome for it to work. It got upgraded to 10.0 (snow leopard yes)

pton YSlow for Chrome

Does not work on Mac.

pton How the FBI raided Anonymous

Interpol? http://www.interpol.int/public/icpo/default.asp

pton Google Begins Testing Display Ads in Gmail

The clean GMail experience may be getting a little cluttered soon :(

pton [dead]

From what I have heard, people in Europe wanting to buy Amazon MP3's are always looking for Amazon gift cards on ebay. Likely because Amazon accepts only US credit cards for music purchase?