HNHacker News
TopNewBestAskShowJobs

ryan29

977 karma · joined May 19, 2020

submissionscomments
ryan29··on Google requiring all ‘G Suite legacy free edition’ users to start paying
That's how most of those tools work from what I've seen. Some let you use an MS365 admin account with impersonation rights, but that's even worse than giving up the credentials for all the normal user accounts.

The biggest problem with every migration tool I've ever tried is they all do a very poor job of reconciliation. I've even used a few that incorrectly report success for partial (aka broken) migrations.

The MS365 IMAP migrations are a good example of poor reconciliation, but at least they give you total message counts if you're paying attention. What I'd really like is a tree view of the old mailbox vs the new mailbox with read/unread message counts for every folder.

ryan29··on Google requiring all ‘G Suite legacy free edition’ users to start paying
Zoho has a lite email plan for $12 per year per user. I can put my whole 6 user domain on Zoho for the same price as a single Google Workspace user and the loss of things like Google Drive aren't really a loss in my opinion because I don't trust Google enough to use them.

The $6 per user per month price point is pretty high for users that want basic email.

ryan29··on Google requiring all ‘G Suite legacy free edition’ users to start paying
It's the purchases for me. I'd be ok with every user in my domain getting converted into standalone Google accounts.

If they don't do something, I'm going to think about emailing every developer I've ever bought an app from and asking them if they can move my purchase to an alternate GMail account. I'll at least do it for anything expensive that I still use.

I'd love to see a class action lawsuit for Google Play purchases that get usurped.

ryan29··on Ask HN: Recommended Domain Registrars?
+1 for Porkbun. The site is clean/simple and they support WebAuthn with the ability to add multiple keys. They also have an extra password option for important domains which I set to my phone PIN so it isn't written down everywhere.

For DNS, I use Cloudflare for everything.

ryan29··on Expired web domains help criminal hackers unlock enterprise defenses
> But also you are teaching your customers to click on phishing-links, because apparently the e-mails you send out to customers contain a new domain every time.

I've noticed government departments have become bad for this in Canada. It's crazy. Who runs these sites?

    https://www.ehealthontario.ca
    https://ehealthontario.on.ca
A long time ago everything used to be split provincially and you could register private domains under the `.on.ca` namespace [1], so there's not a guarantee a `.on.ca` site is a government website AFAIK.

I don't understand the aversion to subdomains. Assuming the government owns `canada.ca`, I'd rather see things like:

    ehealth.on.canada.ca
    ehealth.bc.canada.ca
That makes it easier to determine if a website is government run or not by looking at the URL.

Also, all the government websites use super expensive OV TLS certificates. I don't get that either.

1. https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_a...

ryan29··on Cloudflare Workers Now Even More Unbound: 15 Minutes, 100 Scripts, and No Egress
Awesome! I have some questions about the way usage works. I'm wondering if there's a point where efficient, short lived executions are more cost effective as Unbound rather than the bundled Workers now. The docs [1] say:

> Cloudflare will bill for duration charges based on the higher of your wall time or CPU time, with a multiple applied to the CPU time to account for the processing power allotted to your script.

Does anyone know how the CPU time is calculated? What's the "multiple"?

Are there any minimums in terms of execution time? I remember when Workers Unbound was announced I didn't see any mention of minimums anywhere, but other provides have them. For example, Azure [2]:

> The minimum execution time and memory for a single function execution is 100 ms and 128 mb respectively.

I remember thinking the examples in the original announcement assumed no minimums. Even if there's a 100ms minimum, are short lived executions that don't do any waiting on I/O cheaper as Unbound Workers now?

    # Bundled Cost
    $0.50 / 1000000 = 0.0000005 per execution

    # Unbound Per GB-s Cost
    $0.15 / 1000000 = $0.00000015 fixed cost per execution
    $12.50 / 1000000GB-s = $0.0000125 per GB-s (duration cost)

    # 100ms Unbound Cost
    .1s * .125GB = 0.0125 GB-s per execution
    $0.00000015 fixed cost
    $0.0000125 per GB-s * 0.0125 GB-s = $0.00000015625 duration cost
    $0.00000015 fixed + $0.00000015625 duration = $0.00000030625 total cost
Assuming I calculated that right, it's $0.30 per million for 100ms of execution vs $0.50 per million for a normal Worker. There's wall time vs CPU time, but that's a pretty huge discount for short lived executions, right? Am I way off on something? It seems too good to be true. Lol.

1. https://developers.cloudflare.com/workers/platform/pricing#w...

2. https://azure.microsoft.com/en-ca/pricing/details/functions/

ryan29··on Cloudflare Pages goes full stack
The Cloudflare stuff is the first "serverless" platform I've considered using. I develop independently and the value proposition is too good to ignore. They scale to $0 on idle deployments, I don't have to maintain any infrastructure, I don't need CI systems for building and deployment, I get preview URLs, I can layer in Cloudflare Access, etc..

I'm going to drink the Kool-aid and see how it tastes :-)

ryan29··on We analyzed 425k favicons
> In fact, I recommend that browsers ignore these hints because they are wrong much of the time.

I don't agree. That's the kind of coddling that encourages incompetence. Instead of compensating for others' mistakes, just let their stuff break.

I wonder if Safai on iOS ignores the hints. When I tested, I was surprised to see that pressing the share icon, which holds the option for `Add to Home Screen`, would cause a download of all of the icons listed with `link rel="icon"`.

Favicons are a huge pain to deal with correctly.

ryan29··on Cloudflare's Disruption
> If you haven’t had a look at CF’s serverless stuff for a while, it’s worth a look again.

That's especially true if your workload makes sense for the all-inclusive Workers. I evaluated only the pricing a while back and Cloudflare Workers are far more attractive than anything else in the market IMO.

With AWS and Azure, it's really hard to calculate just how expensive things are going to be. I'd say it borders on impossible without just running your workload for a bit and waiting for the bill.

With Cloudflare Workers, it's dead simple. As long as your Worker runs in <50ms, it costs $0.0000005 per run. I can tie that directly to (page) hit counts and calculate costs with very little effort.

For my own reference point, I ignored the fixed cost per run, which is actually more expensive for Lambda@Edge, ignored the variable cost per run, which actually has minimums for Azure Functions, and calculated the egress cost per byte.

Assuming they use GB and not GiB for egress, it's $.09 / 1,000,000,000 = $0.00000000009 per byte. Now take your Worker cost and divide it by the per-byte egress cost and that's 0.0000005 / 0.00000000009 = 5,555.

That's <6KB of egress for the same price as a Worker run on Cloudflare. Even if AWS and Azure started offering free Lambdas / Functions, it would still be a bad deal if Cloudflare Workers meet your technical needs.

ryan29··on Registrar for Everyone
It feels censored. Is it? For example:

- bigbongforbonnie.com = 1 exact match

- bigbongforbonnie = no results

- bigbongsforbonnie = lots of recommendations that aren't good

For the last one, I say the recommendations aren't good because the .com is available. I used 'bong' as an example because it seems like any drug related terms or slang are disallowed, but it's super strict and bleeds over into legitimate uses.

For example, imagine you run PEI Pipe Fitters in PEI, Canada and search for 'peipipefitters'. The .com is available, but it gives terrible recommendations instead. The recommendations don't even include the words 'pipe fitter'. It swaps 'floor' for pipe. What a clbuttic mistake. Lol. You have to go for the exact match search (peipipefitters.com) just to realize the .com is available.

Swear words also seem to be filtered. What's the deal?

ryan29··on Surveillance capitalism will transform the domain name system
I've looked at HNS and ENS a bit. I want a domain on both, but haven't bought any. The biggest problem is having to deal in crypto currency.

In Canada buying and selling crypto currency is similar to dealing with stocks. You need to track it like an asset and both sales and transfers create taxable events.

Imagine you want to buy a 2x4 at Home Depot. In the crypto equivalent world, you'd have to provide KYC / AML information to an exchange that supports Home Depot to get an account, buy Home Depot stock, use the stock to buy lumber, sell your excess stock, and claim any relevant losses / gains on your taxes. It's a hilariously bad user experience.

Then on the ENS side the fees are insane. To buy a "$5" .eth domain right now shows me .001 ETH (they try to keep it around $5 USD) for the domain plus .083 (~$285) ETH for gas fees for ~$290 total.

I went as far as signing up to an exchange to get a .eth domain and that exchange charges .008 ETH to transfer my money off the exchange which is another $30. So all in, right now it would cost me (up to) $320 USD to buy a "$5" .eth domain.

Paying $315 in fees to buy a $5 good doesn't seem like the free market efficiency the crypto crowd is selling. To me it feels like a bit of a grift where whoever's getting those fees is taking a ton of money out of the system.

Then if you jump over to the HNS side, the exchange I signed up with doesn't support HNS, so I would need to provide them (HNS) KYC levels of identity verification too and I'm not willing to do that because they're not listed in FINTRAC (Canada's AML regulator). I think Coinbase would be ok, but what a hassle!

ryan29··on Anonymous Hacks Epik
Sometimes they have the cheapest renewal rate for some of the TLDs, so if you're deal hunting on sites like tld-list.com you could end up registering via Epik.

Before today the only thing I knew about them was that they were the registrar for a few controversial domains. I didn't realize they were soliciting that market.

ryan29··on Anonymous Hacks Epik
Did anyone download it and look? This is huge if it's true isn't it? I don't want to download it because I don't know what the laws are, but I'm really interested to know if it's true. Rob Monster is a really big domain investor, right?

This is really big news if it's true.

Edit: I looked it up. Rob started Epik [1]. I wonder if that's really his password. Lol.

Edit 2: I wasn't aware of Epik's reputation either. I just knew they're a big (ish) registrar.

1. https://en.wikipedia.org/wiki/Rob_Monster

ryan29··on Stripe banned us for payment disputes but we never had a single dispute
> What's the right solution? It's case by case, down to a mixture of morality and expertise to decide.

I think the idea of minimizing harm is a really good one.

I've never done any machine learning type stuff, but, based on my limited understanding, I think there are probably a few issues at play that make things difficult.

I think the feedback loop for an algorithm is likely important. If you're training an algorithm to match fingerprints, you have a few things that work in your favor. First, matching is easier with fewer samples, so you can train the model incrementally with larger and larger data sets. Second, the process of identifying false positives is easy, relatively definitive, and isn't influenced by external factors. If the ML algorithm only has X% confidence you send it to a human who assesses the match and tells the algorithm the answer so it can "learn" for the next situation that's similar.

Contrast that with something like payment processing. First, you need to scale with demand and it's not easy to incrementally train the algorithm. Second, false positives don't have a tight feedback loop. A false positive negatively affects a customer and every case is different. You need to rely on external, subjective data that isn't definitive enough to be useful to an algorithm (IMO).

I think matching fingerprints is a good analogy to illustrate some of the problems, especially when you hear things along the lines of "looked too similar to fraudulent activity." With fingerprints, you could give 10 to an amateur and they could probably match them accurately. Scale that up to 10,000 and you have so many that look similar, but not identical and you need a professional to do the matching.

I think ML is similar. It's better on a small scale than it is on a large scale and just doesn't scale up as well as the sales pitch says (unless it's assessing problems with definitive solutions). The issue here is that tech companies are treating ML like it scales in a linear fashion. Just throw more compute at it and 10x the scale, right? Wrong (IMO).

There was another comment here that said something along the lines of getting to 98% accuracy and deciding not to serve the other 2%. I think that's what's happening everywhere, but rather than explicitly telling customers they're not welcome, companies are simply letting their ML algorithms run to find the equilibrium where they can manage the "not positive" rate.

And that goes back to your idea of minimizing harm. They don't want to. They don't care if they promise you service even though you're borderline in terms of triggering false positives. You're part of the data set for their machine learning algorithm and that means you're viewed as acceptable collateral damage. They'll ruin your life to train their ML algorithm(s).

ryan29··on Stripe banned us for payment disputes but we never had a single dispute
This should be at the top of the comments IMO. I'm honestly stunned by this blog post because I always assumed a relationship with a payment processor like Stripe was akin to a banking relationship where you'd have an account manager that would reach out to you to resolve problems. If the banks can do it, why can't Stripe? Is it simply a difference in regulation and what they can get away with legally?

All of the big tech companies think they can use machine learning and algorithms to do everything and they have an "acceptable" rate of failure as a target.

The main problem with that is that even if the failure rate is .01%, the failure is typically catastrophic for that .01%. When the error is going to ruin someone's life, is there really an "acceptable" rate of failure?

A secondary problem is that machine learning and algorithms are going to have a tough time accounting for virility. IE: If I have a small product that goes viral, as a percentage change, my error/fraud/dispute rates are going to jump drastically. So at the exact moment where reliable, scalable payment processing is the most important in my life, the automated systems are going to have the highest risk of banning me and automatically denying my appeal.

The fact that 24-48 hours is considered an acceptable timeframe for an appeal is worthy of it's own paragraph. That's unacceptably slow if they're locking the account and doing irreparable harm to your business. That wouldn't be tolerated in a market with proper competition and my instinct is to ask for regulation that would involve a 3rd party in dispute resolution for a payment processor that's terminating a relationship in a non-amicable manner.

At least give me some options that can make things suck less. I'd prepay $500 (non-refundable) without even thinking about it to be guaranteed a phone call prior to account termination. I'd let them hold back a percentage of revenue up to an absolute value so it can be held as a (refundable) bond to protect against fraud. I'd let them hold back a higher percentage if their automated systems detect an increased chance of fraud / issues.

I think stuff like this is a stunning failure and I can't understand how tech entrepreneurs (of all people) can't understand why it's unacceptable. The dream for most of us is literally to build something that has overnight, viral success and makes us rich, but we've got companies like Stripe using ML algorithms that'll auto-ban you as soon as you deviate from the norm. How is that reasonable?

The absolute worst case scenario for a Stripe customer should be for the customer to opt to have all payments withheld (by Stripe) and to undergo some kind of dispute resolution or problem solving. Would you rather wake up to a banned account or an email saying they're holding your money until you call them? I know PayPal gets a lot of flack for the latter, but maybe it's not that bad compared to the alternative. The problem with PayPal AFAIK is they hold the money for a long time no matter what.

I get so frustrated when I see PR / damage control and the solution they're providing is "we're going to improve the algorithms." You can't. By the time those systems fail you need one-on-one human support where both sides can adapt, compromise, negotiate, etc. in real-time.

YOU NEED PEOPLE, NOT MACHINES!

ryan29··on Mixed views on new DNS top level domains
Which TLD was it? I’ve been trying to find an example of a domain being reclassified as premium while registered for almost two years. Are you sure you didn’t let it expire?

That violates the registry agreement AFAIK. They’re not allowed to arbitrarily change the price for a registered domain. Can you give more detail?

ryan29··on DNS Privacy Considerations
I tried to buy some of those. IMO, it's all DOA because the crypto currency end of it makes it too hard to deal with. I wanted a Handshake domain and a .eth domain. I even set up an account at an exchange to buy crypto which involved giving a TON of personal information / ID to satisfy KYC/AML regulations (in Canada).

I gave up eventually. I realized I couldn't figure out exactly how the ENS domain registration worked, how much it actually costed because of volatility and gas prices, and I didn't know if it would be 1 (ETH purchase), 2 (+ ENS purchase), or 3 (+ ETH sale) taxable events triggered by the transaction(s).

After giving up on the ENS stuff I signed up for a namebase.io account and realized I'd have to give them all the same KYC/AML info I gave the other exchange. Since they're not even regulated by my country's regulator (FINTRAC), there's zero chance I'm giving them all that info. Plus, all the tax stuff related to the .eth domains would apply, so I just gave up.

I wanted domains, not crypto assets :-(

ryan29··on Self hosting is important
> If you have enough skill (or the willingness to learn) and initial investment of time, then the ROI on these DIY projects can be immense.

I self host a ton of stuff. Sometimes I feel like I'm wasting time that could be spent writing code, but, ultimately, I think having good sysadmin and network admin abilities makes a difference in the quality of software development.

Sometimes I see developers that barely seem to know how networks and DNS work.

And the whole argument about time spent is getting weaker. My stuff has gotten to the point where it's a bunch of Docker containers that I could auto-update if I wanted. The hardest part is picking containers that are maintained, but all the official ones are nowadays.

ryan29··on AWS now allows customers to pay for their usage in advance
> I really wish you could just designate a group of resources as unimportant, set a billing limit, and let Amazon nuke everything / delete your files / whatever, if you go over the limit.

That's exactly how it should work. It would even be useful if I could designate my development / testing account as unimportant by default so everything can be nuked to limit spending.

I think it's the kind of thing that will only be solved by regulation. The government needs to institute the concept of capped overages for cloud providers where if I set my budget to $100 / month they aren't allowed to send me a 100x bill for $10k.

Here's the 9 year old request for the same thing on Azure.

https://feedback.azure.com/forums/170030-signup-and-billing/...

I politely asked @AzureSupport (on Twitter) if they could have someone provide an update, but they didn't deliver on their promise to follow up :-(

ryan29··on CoffeeShopWifi.com – An HTTP website for connecting to guest WiFi
It's actually a moderate pain to set up something that doesn't answer on port 443 unless you want to host it yourself. I tried with http://wifi.help, but it's at Cloudflare and I don't know of a way to block port 443 without paying for their WAF.
ryan29··on Mozilla rolls out DoH to Canadian users of Firefox
> I trust the Canadian government more than I trust an ad company.

Me too. However, since it's sort of the government running it, I wonder if they could ever implement ad blocking without getting sued by the ad companies.

ryan29··on Mozilla rolls out DoH to Canadian users of Firefox
I personally use split horizon DNS for my home lab. I have several things that I put behind Cloudflare, but I don't want my local access to go me > cloudflare > me, so I use split horizon DNS. If you're not behind something like Cloudflare you can use NAT reflection (hairpin NAT), but those are a bit of a hack.

Canada also has some large, private networks used by provincial governments that use split horizon DNS and DoH is going to be a huge pain for them. One specific example would be libraries that are on a private network and have access to resources handled differently depending on how you connect; via the private network = no auth, but via the internet = auth required.

Split horizon DNS is a simple, practical way of affecting how traffic is routed in a lot of cases.

ryan29··on Quad9 and Sony Music: German Injunction Status
> Most people don't care about holding a token

I definitely do NOT want the token/coin. As soon as I touch it the transaction becomes a taxable event for me. It's a nightmare. Imagine if every store in your city used a different foreign currency and the government made you track every transaction you make so you can report your foreign currency gains/losses on your taxes.

ryan29··on Quad9 and Sony Music: German Injunction Status
I signed up, but didn't do any of the verification. I'm from Canada and they're not in FINTRAC (our KYC/AML regulator), so I'm not willing to give them any personal information beyond what I'd use for a normal credit card transaction.

The thing is I wanted a brandable name that I could likely get for less than $.50, but I'd be willing to pay $50 via credit card to avoid dealing with HNS. I would literally pay 100x the market rate to avoid dealing with their crypto currency because, by the time I deal with the bookkeeping and taxes of a crypto purchase, it costs me more than $50 in time and effort.

ryan29··on Microsoft announces Windows 11
I use Win10 Pro, but have Home on a few computers for my parents and nieces/nephews. I set up the first user on all of them as a local admin and their account (local or MS) is always a normal user.

It's such a simple way of making sure they don't trash their machine that I'm going to miss it. I'm sure there'll be a new way of doing the same thing, but with 5x the effort and 1/2 the effectiveness.

ryan29··on Introducing Windows 11
It's a prelude to subscription Windows. Instead of having a family PC that everyone can use, every user with a Microsoft account will need a license. The OS for a family PC is eventually going up 5-10x in price IMO.
ryan29··on Microsoft announces Windows 11
I don't get it either. I've never met anyone who liked any of the dynamic content provided by MS pretending that Windows is media platform. I think these are features the MS execs want, not users.

> Is Linux a usable alternative?

Who knows. Look at Ubuntu and some of the other distros that try to push the app store model, connected accounts, etc.. These people are building the software they want, not the software I want as a consumer.

I pay for Windows. I'd gladly pay for Linux instead if it was good enough.

ryan29··on Microsoft announces Windows 11
I need a local account. I set up my PC with multiple profiles. I start with a local admin account and then I add Microsoft accounts for my day-to-day work. I have one profile logged in to my personal Microsoft account. Another is logged in to an Office 365 account that belongs to someone I do work for. Etc..

Why is MS encouraging people to have one giant admin account with a work or school account connected? That's stupid. My personal account should be considered untrusted. Having it acting like the root account is just dumb, right?

ryan29··on Quad9 and Sony Music: German Injunction Status
I've looked at blockchain based domains. There's also ENS (.eth) and HNS (namebase.io). The biggest problem with them is they're a huge pain to purchase. You need to buy their vBucks style coins first (ETH or HNS) and many western governments treat those like a security. That makes it tough for someone like me who wants to buy legit, brandable domains in those systems.

So the only people left are the ones mining coins and skirting KYC/AML laws and I think that leads to a scenario where they'll gain a reputation of being a "nefarious" technology even though there's _some_ merit in the idea.

DNS based censorship by western countries is a risky game IMO. That makes the system vulnerable to a developing country coming in, setting up alternate DNS roots, and refusing to filter / censor for copyright infringement. It won't take much for western users to learn they need to use a foreign search engine to find things the western countries want censored.

China's citizens will be using US search engines and US citizens will be using Chinese search engines. Lol.

ryan29··on Browser VNC with Zero Trust Rules
Overall, I think this is really cool. The parts that are a hard sell IMO are:

1. The need to trust Cloudflare is a no-go for some. I trust them and I think solutions like this are better than the "roll your own" type you'll see with self-managed PKI and VNC, but someone having the ability to MitM the remote connections is going to elicit a hard pass from some people I know. Or did I get that wrong? Cloudflare can MitM the connection if they want right?

2. Local/private traffic becomes non-local traffic. For example, I know of a place that's part of a large private network and all their internal traffic (between physical locations) transits that network without hitting the internet. They also have traffic management policies that favor keeping traffic on the private network whenever possible.

The second one is a fairly specific case though.

There's some awesomeness to this type of setup that uses Cloudflare Access. I was recently working on a network where we needed remote access to a single machine, but also needed to loop in a couple people from different organizations. It seems like there are a dozen systems for remote access and screen sharing and everyone is on a different one. Coordinating a couple people to collaborate was a pain and collaboration tools with screen sharing don't allow you to leave access to the remote machine in place if one of the participants needs it.

I wish Cloudflare Access had the concept of free guests and a OneDrive like workflow for sharing access to apps / resources. Maybe it does, but I don't use it beyond testing. For example, I'd like to configure VNC like described and be able to "share" the resource with an external user via email where they can get a one-time-pin for auth and where I can set an expiry on the share.

Do I have to pay for guests that only log in once or twice via Cloudflare Access? I know they get marked as inactive if they don't log in during a month, but having to pay for them (and think about it before sharing) takes away from something that's pretty awesome otherwise. This is the reason I dropped paid GitLab too. Paying for external users that barely use the service is a no-go for me.

← PreviousPage 6 of 10Next →