stanleydrew

I did start out this way, but I was trying to make something that would achieve the goal without requiring any changes to my application code. Setting the HTTPS_PROXY environment variable on the app server and adding the internal CA cert to the set of trusted authorities s is all that's required to get it working now, which is nice.

The thing you've described is still a MitM (the "protected API" can still see all of the request contents on their way to the destination).

Not even close.

> If the asteroid’s riches are confirmed, it may be worth more than the global economy at $10 quintillion.

But of course that "may be" is carrying a lot of weight. The actual value would be much closer to zero when you think about it for more than a second. The "market price" for these metals would plummet after introducing a massive glut like this.

> But what if Netflix and Amazon Prime Video lets their streaming licenses expire for "X-Files" and it's no longer available? Wouldn't that make the X-Files DVDs a great backup?!? It would, if she actually re-watched the X-Files -- but she never did.

The problem is that the future is uncertain. It's always possible that she might want to rewatch the X-Files at some point, even if she never actually does.

I agree we need to think hard about tradeoffs of regulation and adjust when the pendulum swings too far in one direction. But I think you can come up with a better example of downsides of overregulation than the Ghost Ship Fire.

To say that people were "forced" to live there due to overregulation is quite a stretch I think. I've known a few creative people in the bay area who lived in similar situations and they all were making an active choice to live in communal housing illegally converted from industrial use. They found it creatively energizing.

> Why are people so adamant that they absolutely must call non-REST APIs “REST”?

It's good for marketing I guess? A while ago REST took on connotations of "simple" and "clean", mostly in comparison to SOAP. So people will probably think more highly of your API if you call it REST.

I'm not going to try to convince anyone that has their mind made up about "dumpster fire" companies or whatever.

For anyone else reading, I'll just say that we all know there are tradeoffs between security and usability and we can actually have a good-faith discussion about that if we want to.

This is an unfortunate situation, but calling it a "dumpster fire of rotting clinical waste" is frankly absurd. Google in particular has done more than anyone to acclimate consumers to the usage-patterns of better auth (two-factor in particular). Is everything perfect? Of course not, but things are a lot better than they could be.

> When people shoot off their mouths about something, they’re not necessarily talking about what they’d actually do, but often merely what they feel in that passing moment.

Agree, but these things do matter on the margins. A Jewish landlord may almost always rent to Muslims, but once in awhile might not. Or might apply stricter standards to rental applications from Muslims on occasion.

There's been a lot of progress for sure, but self-reflection in order to understand your own implicit biases is work that's never really finished I guess.

Yeah you have to put up cash or collateral nominally worth (presumably in the court's discretion) the amount of the bond. This report seems incorrect.

> I don't know how Palantir investors were OK with the Palantir balance sheet getting loaded up with highly speculative investments.

Isn't the way this works that Palantir forms a partnership where it is the sole limited partner, hires a general partner or two, and then funds it? So the Palantir balance sheet just shows a single asset (the partnership interest)?

This appears to be an example of a failed margin call. The broker should have closed out the customer's position sooner, to maintain margin requirements. It's interesting to think about the reasons that didn't happen in this case.

But to be clear, the broker is very exposed in this situation. It reads like the customer is planning to cover the loss, but if a loss is big enough there's a strong incentive to declare bankruptcy and leave the broker with bad debt. Needless to say the broker doesn't want to be in the position of worrying about whether they will be on the hook for customers' losses. Which is why margin requirements exist.

The broker only loses money if the customer loses money though. So their interests are aligned. The broker doesn't want a customer to get wiped out, which is exactly the point of margin requirements.

I'm not arguing anything. But even if I were, I don't know what "leverage" has to do with it.

Last time I checked this is a discussion forum where many people gather together to express thoughts and opinions about various topics that they may not have "leverage" to argue about.

Well yeah, leaving is exactly what people are doing. Nobody I know is arguing he can't do whatever he wants with Twitter. But they are voting with their feet.

Fair. I guess I pedantically object to using the term "margin called" as a verb that implies it causes financial ruin. The margin call helps to avoid ruin.

But you're right, if he had to sell so much TSLA to meet margin requirements that he lost control, that would be bad.

> Elon might be getting margin called on Tesla right now, which could wipe him out financially.

I don't think this is how margin calls work. Presuming your broker is properly managing risk, then a margin call is explicitly designed to not wipe you out financially. You have to put up more capital or sell positions in order to maintain a certain amount of equity in your account, and that required amount is never zero (again, if your broker/lender is managing risk properly).

Of course it is a stressful situation, and he may need to sell assets at "unfavorable" prices which would effectively lock-in some reduced paper wealth. But I don't think a margin call is going to wipe him out.

Wait doesn't this just make the point that SaaS is the proper model for Windows? Do you expect that Microsoft should "support" everything, for free, forever? If you want bugs to be fixed, or for things to improve generally, then you should pay something I think.

If there were money in that I think we'd have seen it by now.

I guess this might be a nitpick, but I don't think most cryptocurrency exchanges do function like "traditional financial exchanges." They seem to operate more like a combination of exchange and brokerage.

I'm not an expert but I don't think "traditional financial exchanges" hold assets to be traded on behalf of customers. I think they are just meeting points for traders, and they host the public order book.

This is true, but there is some availability bias. There are presumably cases where "everything is fine" turns out to be pretty accurate (at least for a while), but we don't keep track of those.

> But it is also the lack of legit opportunities to invest

I think you mean lack of legit opportunities to get rich quick, which is not a new phenomenon. Getting rich quick requires a lot of luck.

Presumably this is like asking "why can't I get off this email chain where everyone keeps replying all."

Unless your client (iMessage I guess) offers you some kind of muting or blocking function, you can't stop people from sending you messages if they have your phone number.

I don't have experience donating to a charity that I created, so rules may be different, but in general no you don't pay any tax on donated in-kind securities and the amount of the deduction you take is generally the market value of the securities on the day they were transferred.

Haven't read anything about it but presuming it's well-designed and doesn't require me to store a password that seems like a nice thing to offer.

Yeah I understand OAuth isn't for everyone, it is mostly just convenient for me and simplifies the authentication process (no distinction for users between signing up and logging in). I can add Github and/or Gitlab pretty easily though. Which one do you need?

This is a fair point, although I have many Google Accounts verified with my single personal number and that doesn't seem to be a problem for them.

I don't like handling passwords and it complicates the signup/login process which is why I don't usually implement password auth for small projects, but in this case I should probably consider it.

I used to do that with Twilio directly too, and just got tired of configuring the same thing multiple times with multiple accounts. I added a simple voicemail inbox and then made a UI to display all the messages and voicemail recordings, and that became oneway.tel.

So oneway.tel is basically just the Twilio messages/calls/recordings log in a more convenient interface, with Google/FB auth (which is convenient for me).

If you're already experienced with Twilio configuration and their console then $5/month may not be worth it.

Success with 2FA depends on the type of phone number. Right now oneway.tel offers US wireline VoIP numbers (from Twilio), which won't work for verification with some services (although there's no technical reason they can't).

I have one customer using a UK mobile number (also from Twilio) to successfully authenticate with Wise (among other things). If you're interested in testing out a non-US mobile number let me know via email to hello@oneway.tel and we can work something out.

These are Twilio numbers. I have had success with verification using Twilio numbers although sometimes the "Call me instead" option is required. I implemented a simple voicemail inbox for those cases.

Your mileage may vary of course. I'd like to collect a list of services that don't allow verification at all via landline/VoIP and post it.

Yeah I'm a little disappointed about how Charge turned out too. Working with Sprint was tough, I'll just leave it at that.

The question about porting is a good one, and I basically punted on making a decision until I could tell whether anyone was interested in the service. I am of course using Twilio under the hood, so porting out requires using their process, documented here: https://support.twilio.com/hc/en-us/articles/223179588-How-d...

It's a little cumbersome but I don't see any reason to prevent port-outs.