ryan29

> - Using a copyleft license like AGPL makes this an automatic non-starter for most businesses, no matter how impressive your tech might be. You'll have a lot more luck with mid-size and enterprise adoption with an MIT license.

What makes the AGPL unattractive? I thought it was basically just the GPL with a limitation on using the software to provide a SaaS product. You don't even have to contribute unpublished changes, right?

Before reading your comment I actually checked the licensing in the repo because I was thinking the exact opposite; using MIT would be a mistake because it's too easy to undermine the turnkey offering by selling a competing service without the cost of development.

As soon as you connect a phone to your home WiFi or log into a single account that device is instantly associated with you and tracks you forever. Phone numbers are just a convenient way for big tech to share your identity amongst themselves.

Use a VPN and try to create all of the accounts you'd need to participate in society. It's impossible. You'll be lucky if you can get an email address. I can't imagine being un-banked or unable to afford a phone. You can't participate in modern (western) society without a (non-VOIP) phone number.

Also, there's no air gap on a phone. Devices will be correlated via location data, SSID scanning, etc.. Put two devices in the same house with wifi disabled and location data enabled and they'll be instantly linked as knowing each other.

I have 3 tech related subscriptions; BorgBase, JetBrains, and historio.us. I self-host everything, but I've never found anything that replaces historio.us. It indexes just enough to always get me a complete copy of the data I want cached and the search results are just right. I often have about 1 page of search results when I'm looking for old info and I can pick out the page I'm looking for instantly.

I use it a lot when I'm learning something new. As I'm looking for beginner info I'll often find more advanced stuff that I'd like to try or learn at some point, but I don't have a good enough understanding to know if it's truly useful info. I historify those sites and move on knowing that I can find it in my historio.us search at a later date.

I also reference cached pages in a lot of my personal docs. I recently started using ArchiveBox for that, but the search doesn't make it a good replacement for the above use case.

I've been using historio.us since 2011 (!) and have never found anything to replace it. Great job!

> Also, as much as I dislike ads I think web3/crypto grifting is worse. I feel ambivalent =\.

I super briefly skimmed the crypto (BAT) token stuff. I think the general idea of earning tokens for searching and browsing is neat, but the way they're trying to use it directly as a microtransaction currency isn't super innovative.

I don't like crypto in general, but I think the "proof of idle capacity" tokens have stumbled onto something that could be valuable for online reputation because they invert economies of scale in a way.

Take something like Chia (XCH) as an example. As a typical user I can allocate some idle storage space to mining and, as long as I only mine while I'm browsing the internet, the incremental cost to me is basically $0. Compare that to someone building a rig specifically for mining. They have costs, I don't.

Assume I can opt in by plotting some proofs on idle storage and mining into a pool where rewards are split up and some of the rewards (aka tokens) can only be used for liking (ranking up) or disliking (ranking down) websites. Ex: 20% of your rewards go to the pool operator (search index), 5% can be donated directly to sites or creators you like, and 75% go to ranking (search reputation) which "burns" them. Adjust the ratios as needed.

A million normal users with 10GB of spare storage cancels out 10PB of storage from bad actors trying to game the system. IE: What's free for the masses is expensive to game and the more users hate your site, the more expensive it is for you to game the results. If you never give users "real" money (aka redeemable tokens) as rewards there's not much incentive to buy storage just to "earn" crypto currency, so hopefully you'd keep it limited to using truly idle resources only.

The search index (ex: Brave) could use the tokens as a currency for selling ads (ie: keywords) and that could be weighted by the reputation score of the site you're driving traffic to. In other words, the effectiveness of your ad buys is impacted by your existing reputation and if you have a site that everyone hates you'll eventually get to the point where ads for your keywords cost significantly more than competitors that are well liked.

Now everyone on Hacker News can tell me why that's a dumb idea :-) Lol.

Something brandable is worth holding on to IMO, especially if it's distinctive enough to trademark which likely means there isn't a lot of search competition either.

My `dns_cloudflare_api_token` is in `/data/database.sqlite`.

I think blockchain domains are detrimental to the existing system, so I don't get why XYZ would help try to legitimize them. They're not even promoting XYZ. They're literally encouraging customers to go buy a .eth domain where XYZ doesn't have any control or make any money.

It's probably well intentioned and I like seeing XYZ making an effort to do more than maintain the status quo, but there are better ways to promote domains than jumping on the blockchain bandwagon in my opinion.

> Another factor could be the fact ENS names expire and require a renewal fee

I have no proof, but I doubt any of them were paying for it. I tried to figure out how some of them got their names by looking at the blockchain. There were some patterns where I thought it looked like someone bought up a bunch of popular names and transferred them to the influencers. I'm not very well versed in blockchain though, so I couldn't follow it well enough to do anything more than speculate.

I think it was nothing more than promotion. It would be interesting to know if anyone got paid because they should be disclosing it as paid promotion if they did. Having the domain given to you is a type of payment (if that happened).

> I think it was something like $250 per year (in ETH at the time) to keep it active

If you weren't looking at a 3 or 4 letter domain you were probably seeing super high transaction fees which made the initial transaction very expensive. The registration is supposed to cost about $5 per year. I bought one a few months ago and that's how it worked.

I paid $11 in transaction fees for the first transaction where you submit your order + secret. Then I paid $72 in transaction fees for the registration plus $55 for 10 years of registration. I also got about $5 transferred back to me by the ETH ENS registrar. So the cost of the domain registration was $5 / year, but the transaction fees were around $85.

I watched gas prices for a week and tried to time my order with low fees. The cost of the second transaction went up by $20 while I waited for the 1 minute delay required between transactions. It's crazy.

You also need to pay transaction fees every time you want to update the record. Now imagine a proof of stake system where the rich (ie: early adopters) get a cut of transaction fees just for holding a bunch of tokens. I think that's why enthusiasts are so excited. Imagine getting paid every time someone needs to update a record in a database.

I don't think blockchain domains have any benefits. In fact I think they're significantly worse than our current system. However, I did buy one to match my favorite / best .com domain because even if they're a terrible idea they could still get popular and I thought it was worth $135 USD to ensure I didn't have to worry about someone squatting on my name.

Wow. I hadn't seen that. I just read about it and it reinforces my view that cryptocurrency is appealing to the wealthy because of the promise that whoever controls all the tokens and resources (ie: wealth) controls all the rules.

When you look at some of the issues with ICANN at least there's some chance that public opinion can influence them. The .org scandals show this. Imagine if the whole system was "code is law" and the existing executives and board members owned a controlling interest of "vote tokens".

I don't understand why people would want a system like that with crypto domains. Do they think that a system where $1 = 1 vote is going to be democratic?

> EDIT: Apologies - as pointed out below - not my intent to align the site with the TLD - I could have worded that better. I think the domain is more likely a product of the ENS team, but I don't know for certain.

It is though.

> Eth.xyz was created for the ENS community with love by the XYZ Registry, the company behind .xyz domain names. The project is open for contribution or feedback on GitHub. Send us a message @xyz on Twitter! [1]

It's kind of neat, but seems like a registry taking on a lot of extra liability that they typically don't have as a domain registry. Putting a disclaimer on the sites doesn't exempt them from the law.

> The profile content on this page is automatically generated from publicly available information provided through ENS and is ultimately controlled by the relevant ENS user. Nothing on this page implies any endorsement or affiliation between XYZ or ENS and the person or organization whose profile information appears on this page.

So what gain does the blockchain get you? XYZ isn't judgement proof like the blockchain, so they'll have to follow the current laws for trademarks, copyrights, etc.. If the blockchain isn't adding any revolutionary tech, is slower, is expensive, and is only accessible using gateways that are subjected to current laws, what's the appeal?

1. https://eth.xyz/

I've never used Vercel, but skimming their site I think it's roughly the same concept as Cloudflare Pages / Functions.

SvelteKit has adapters [1] for both Cloudflare and Vercel (and Netlify), so they must be reasonably similar. I think Vite is a similar idea. I've never used it either, but have seen some references to Cloudflare deployment via a plugin.

The basic concept is really compelling IMO.

1. https://kit.svelte.dev/docs/adapters#supported-environments

I think JavaFX could have been more successful if they would have managed it differently. I really liked it. The JavaFX developers were all great to deal with and would help you as much as they could.

One of the problems in my opinion is that once you went up the chain beyond the developers, it seemed like there were some people that didn't understand what they were doing or didn't care or possibly both. They had targets to meet (or something) and the health of the project was a secondary concern. Part of this could be seen by the messaging saying they were investing in JavaFX, mobile, etc., but most of the commits to the repo were done by a few people. I can't remember what the numbers were, but I remember being shocked and thinking that if one of the top two contributors disappeared the project would be in trouble.

However, the biggest mistake in my opinion was forcing JavaFX into the JDK way too quickly. You can tell that's the type of decision that comes from the top down. They wanted to be able to say the JDK had a next generation GUI toolkit and checking that box was more important than letting the project develop in a healthy manner.

Before JavaFX went into the JDK it was really easy to contribute to the project via the dedicated bug tracker and you could get quick, friendly, helpful feedback directly from the developers. Bugs were fixed and would land in the next release. After it was part of the JDK you had to use bugs.jdk.com and it became much harder to participate. Factor in JavaFX having to adhere to the JDK release schedule rather than iterating quickly like they had been and it was impossible to figure out what Oracle was trying to do. Was having JavaFX on the JDK marketing material really worth stalling the development and ruining any chance it had of becoming more popular? I still can't get my head around it.

The fixation on the browser plugin and applets always confused me too. It was obvious for years they'd eventually get locked out of browsers, so I don't know why they didn't push things like Web Start a lot harder. Web Start was a pretty decent distribution system and if they had improved it to fetch JREs, like OpenWebStart does now, it would have been one of the best options at the time.

To this day I'm convinced that JavaFX was a missed opportunity. I'd love to try to build an app that uses Gluon [1] stuff for direct framebuffer rendering on a Raspberry PI with Mender [2] for distribution. I think you could combine something like that with JxBrowser [3] to build a digital signage system that's much better than anything on the market, but the licensing is a huge pain and too expensive for a hobbyist project.

1. https://gluonhq.com/products/gluon-embedded/

2. https://mender.io

3. https://www.teamdev.com/jxbrowser

I think trolling, misinformation, etc. are big problems, but forcing everyone to use their real identities online is a mistake. I see several problems with it.

First, you take away people's ability to learn how to be a good participant by using a low value identity. I did this a lot when I was younger and I think it's extremely important for kids and young adults to have the option of throwing away their identity to start over. Think of it like bankruptcy for your reputation.

I used a pseudonym when I first started participating on open source bug trackers and mailing lists. I think it turns out that I was doing a good job of participating even though I was a bit unsure of myself, but I still think it was a good idea to leave myself the option of abandoning that identity. When I started using my real name I was concerned about tarnishing my permanent reputation, so I was always careful with things I said. I think that's helped me become a much better participant. I never talk politics, I wait a day to post if I'm frustrated, I say please and thank you, and I don't contradict project members unless I can back it up with a provable test case (or qualify it with "in my opinion", etc. if it's subjective).

Second, you're not going to eliminate misinformation if it's propaganda from a nation-state. At that point there's nothing stopping them from creating new identities as needed and those identities will be more valuable because everyone will be operating under the false assumption they're dealing with a natural person with a verified identity. You could force everyone to use their real legal name in an attempt to help people distinguish nationalities, but the appropriateness of that approach is a debate on its own and there's nothing that says a person from the US or UK can't have a Russian or Chinese name. What's next? Are we going to make people participate with their full legal name and address?

Third, you'll create an opportunity for someone else to capture the social media markets by building a better system that doesn't require identity verification. People will take the path of least resistance. That's why YouTube, Facebook, Twitter, etc. got popular. They were easy to use. I'm from Canada. Why would I subject myself to identity verification to use a (foreign) US platform if there's a competing (foreign) Chinese platform that doesn't ask for my photo ID and a face scan?

Opening the door for China or Russia to build competing systems is a bad idea if you're from a western country and a welcome opportunity if you're not. I think there's value in oversight and regulation and, since I'm from Canada, I always favor services that have Canadian regulators (FINTRAC, CRTC, CIRA etc.). However, that's only for things involving money and that I consider valuable (financial accounts, phone numbers, domains). I'm not sure if I'd choose a Canadian regulated social media platform that requires my government ID over a foreign competitor that doesn't if I don't attribute any value to the account / profile.

It changed [1] from capacitors and "power loss protection" to something else described as "power loss immunity" with the MX500. I don't think I've ever seen it explained very well.

> With the release of the MX500, Crucial has included a new replacement for the traditional power loss protection feature, power loss immunity. Instead of relying on a bank of capacitors for power loss protection, Crucial was able to work the new 3D TLC NAND and the code to allow for more efficient NAND programming so that the capacitors are no longer needed.

That's just a regurgitated press release IMO.

A lot of consumer drives also stopped reporting DRAT/RZAT [2] around the Crucial MX500, Samsung 850 timeframe. They swap internals as others in this thread have pointed out and the write endurance has dropped since reviewers stopped reporting on it. I have a Crucial MX500 in my system right now with 11% life remaining and only 37TBW even though it's advertised as having 180TBW of endurance.

Edit: I actually found [3] an explanation of "power loss immunity".

> The impact is still the same: you don't get the full protection that is standard for enterprise SSDs, but data that has already been written to the flash will not be corrupted if the drive loses power while writing a second pass of more data to the same cells.

I always thought write operations on SSDs were more or less to write a new page or block or whatever the terminology is and to flag the old one(s) for garbage collection. I don't understand how it would be possible to lose the old data by doing that. Did they just invent a term that sounds like power loss protection, but doesn't actually do anything special?

1. https://www.thessdreview.com/our-reviews/crucial-mx500-ssd-r...

2. https://forums.anandtech.com/threads/looking-for-new-ssd-tha...

3. https://www.anandtech.com/show/12165/the-crucial-mx500-1tb-s...

AnandTech is owned [1] by a media conglomerate with a $4,000,000,000 USD market cap [2]. That's a lot of water bottles.

1. https://www.anandtech.com/show/13092/future-plc-to-acquire-c...

2. https://ca.finance.yahoo.com/quote/FUTR.L?p=FUTR.L&.tsrc=fin...

I'd really like to see one of the popular influencers disrupt the review industry by coming up with a way to bring back high quality technical analysis. I'd love to see what the cost of revenue looks like in the review industry. I'm guessing in-depth technical analysis does really bad in the cost of revenue department vs shallow articles with a bunch of ads and affiliate links.

I think the current industry players have tunnel vision and are too focused on their balance sheets. Things like reputation, trust, and goodwill are crucial to their businesses, but no one is getting a bonus for something that doesn't directly translate into revenue, so those things get ignored. That kind of short sighted thinking has left the whole industry vulnerable to up and coming influencers who have more incentive to care about things like reputation and brand loyalty.

I've been watching LTT with a fair bit of interest to see if they can come up with a winning formula. The biggest problem is that in-depth technical analysis isn't exciting. I remember reading something many years ago, maybe from JonnyGuru, where the person was explaining how most visitors read the intro and conclusion of an article and barely anyone reads the actual review.

Basically you need someone with a long term vision who understands the value you get from in-depth technical analysis and doesn't care if the cost of it looks bad on the balance sheet. Just consider it the cost of revenue for creating content and selling merchandise.

The most interesting thing with LTT is that I think they've got the pieces to make it work. They could put the most relevant / interesting parts of a review on YouTube and skew it towards the entertainment side of things. Videos with in-depth technical analysis could be very formulaic to increase predictability and reduce production costs and could be monetized directly on FloatPlane.

That way they build their own credibility for their shallow / entertaining videos without boring the core audience, but they can get some cost recovery and monetization from people that are willing to pay for in-depth technical analysis.

I also think it could make sense as bait to get bought out. If they start cutting into the traditional review industry someone might come along and offer to buy them as a defensive move. I wonder if Linus could resist the temptation of a large buyout offer. I think that would instantly torpedo their brand, but you never know.

I wonder how that affects activation.

> Literally a trap to hand over your encryption keys.

I let my keys sync to my MS account. I mainly want to protect against untargeted theft of my computer, so having recovery keys online makes more sense than a recovery key printout or USB key in a drawer.

They have some dirty tricks they use to “convince” users to put all their files in OneDrive. The main one is making it seem like a backup or something the user forgot to set up (“protect your files”), so a lot of users fall for it.

Files on demand is a way to make people dependent and the low quota is to get them onto a subscription.

I use multiple non-admin profiles for different activities and I think this will ruin my strategy. I always make the first user a local account and never use it for anything but adding normal user profiles.

I log in with my personal Microsoft account on one profile. I use a local account for a work profile that also has a MS365 account added to it (to avoid being joined to the domain). I have a second MS account for a side project. I have a second local account for a second job that uses Google Workspace.

I use Windows over Linux because it’s more convenient. Although that’s only because I’m forced into Office for work. I could probably switch to Linux for 80% of my stuff. I have a Linux install for development, but rebooting to do a quick task is a pain.

I think the government needs to break up big tech. The anti-consumer behavior they’re engaged in because they have no competition is crazy. IT costs for small businesses have skyrocketed in the last decade. Everything is a subscription and costs 3-10x what it used to.

I'm fairly sure you need to provide ID and notarized docs where I am, but I've never done anything more than a sole proprietorship since we're allowed to conduct business under our personal name up to a certain point.

Anyone along the route between LE and chase.com can possibly get a certificate from LE. For example, if you have access to a chase.com firewall or load balancer and can redirect traffic for a minute you could get a DV certificate.

The thing is, TLS certificates are a "weakest link" system. Even if chase.com is buying EV certificates, a bad actor can still get a DV certificate. You can mitigate that a bit by using a CAA record in DNS, but AFAIK there's no way to specify anything like a policy identifier (which indicates the type of certificate) in a CAA record. The best you get is the ability to limit issuance to a specific issuer.

There could be _some_ value to using a CA like DigiCert if you use a CAA record that limits certificate issuance to them only. Since they don't offer DV certificates you reduce the risk of a MITM using HTTP to get a DV certificate for your domain. You'd also want to reconcile every certificate issued to make sure they're legitimate requests.

> And most techies went along with it because they shared the vested interest, or did not appreciate the existing system that creates the real life shopping experience we see every day.

I don't agree. I think a lot of tech people (like me) felt like the whole system was a grift and that nothing of value was lost when LE offered an alternative. If you start a business in my jurisdiction your paperwork is going to get a lot more scrutiny than what the certificate authorities were (or are) providing.

OV certificates are even worse. The verification is a hassle and it's extremely difficult to distinguish OV from DV. Try to figure it out. The only way I'm aware of is to make sure the `Policy Identifier` [1] of the certificate is `2.23.140.1.2.2`.

I've also never had a good experience with the validation process from any of the CAs. They often push anything that's not immediately discoverable back to the applicant and expect them to do the leg work. I've had both Comodo and DigiCert do this to me in the past. Here's an example from DigiCert. This happened this year (2022).

> First, As part of the verification process, we are required to confirm the registration of your organization with the local registering authority.

> We have attempted to locate the registration records using online resources, however we have not been able to locate such a document. If you are aware of any government based search tools for your jurisdiction that can be used to locate proof of the organization's registration, please reply to this email with a link and instructions for locating that record. Once received, our validation team will confirm the record and proceed with the validation process.

Really? To me that seems like someone who isn't familiar with my jurisdiction because they don't know the process. What's stopping me from sending them a link to a fake, official looking site? It seems like an invitation for social engineering. Code signing certificates are the same. It's infuriating.

In my experience, they look for your company on Google Local (or whatever it's called now) or similar and if they can't find it they punt it back to you. I think the whole process is worse than nothing because it's selling a false sense of security for anyone who believes the marketing.

From a customer value standpoint, I'd rather pay for a DV certificate where the value comes from helping me to set up proper CAA records to prevent mis-issuance as well as certificate monitoring for any potential lookalike domains. Of course, the margins on that probably wouldn't be as good.

Thankfully I only deal with one place that insists on buying expensive certificates because "they're better". Just for fun sometime go look at the TLS certificates used by all of your local government websites and try to figure out what they cost. Then factor in the labor for multiple people to coordinate annual renewals and manual installation. It's frustrating.

1. PDF Warning: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

Yep. It's really weird if you think about it. The first time I saw a company being upfront about their ad revenue [1] I was surprised.

> The Premium fee is basically about $7 per year, which is less than what a free user generates in ad revenue. Thus leagues that pay for Premium and use an ad-blocker are generating less revenue than free users.

They charge about $20 per user per year to remove ads. I pay for that, so I'm not sure what kind of ads they have, but I'd love to see what they're advertising and what the click through + conversion rates look like.

What you said makes sense to me. I wonder if advertisers are paying a fortune to acquire users with a lot of disposable income.

1. https://www.fantrax.com/forums/general/messages/public/l72mh...

> Notarization and code signing has hardly posed a problem for malware on either platform so far.

It's big business. They buy EV certs from what I've seen and no one in the industry cares about anything but the money.

The registrars are obligated to prevent fraud and abuse. If they fail to do that job you can appeal directly to the registry. If the registry doesn't do anything you can appeal to ICANN.

All of them are within the scope of the legal system, so if you send a police report demonstrating fraud to a registrar or registry and they fail to act you have some recourse. If their inaction results in increased damages they've opened themselves to liability and you could sue them. The possibility alone is enough that everyone has published polices detailing how they deal with those situations. As long as you follow the rules you can get a domain taken away from a bad actor. It's not easy, but it's possible if someone is doing enough harm.

So yeah, you can host a scam on a normal ICANN domain. It's what happens afterwards that matters. In ICANN land you get one chance to run your scam because the victim can make an appeal to authority to have you shut down. In blockchain land it's tough luck for you.

As an example, this [1] looks like PayPal's wallet. What do they do about this [2] wallet which owns paypals.eth (alongside sqaree.eth, chasebanks.eth, etc.)? They have two choices AFAIK. The first is to pay whatever the owner demands for those domains. The second is to take the risk of the owner selling those domains to someone that wants to use them for phishing.

There are exactly two winners in the blockchain version; the domain squatter and a would be scammer. In the existing system a high value domain owner like PayPal will have an established procedure for dealing with bad actors that infringe on their trademark and dealing with typo squatting like that is probably as simple as sending a template they have to the corresponding registry.

1. https://app.ens.domains/address/0x527FC48f1CA8b41DF3E870F5DE...

2. https://app.ens.domains/address/0x7731652a9F7F48F77E94a8675F...

It's literally whoever owns the keys listed as the registrant owns the domain. If you lose your keys you lose your domain. You have no recourse if someone squats on your domain, uses a lookalike domain for phishing, steals your domain, etc.. And for the privilege of having a judgement proof blockchain with no oversight you get to buy your domain from an early adopter that's squatting (investing) and you get to pay fees every time you blink.

All the crypto bros printed (mined) a bunch of monopoly money (coins), invented assets (NFTs), bought (allocated to themselves) all the assets (NFTs) using their monopoly money (coins), and want us to buy into these crappy systems with real money so they can sell us the assets (NFTs) while still being the landlords (transaction processors) that charge us rent (fees) on everything forever.

I own one. All the blockchain domains are a dream come true for squatters and scammers. I'll take the oversight, stability, accountability, and mutability of ICANN and the current registry/registrar system every single time given the choice.

My favorite thing about MXRoute is the super simple rate limits that you can configure when adding a user. I use it on devices for notification e-mails and being able to limit those logins to something low like 5-10 emails per day is awesome. It really minimizes the damage if something goes haywire, a device gets compromised, or a device gets stolen.