Hacker Newsnew | past | comments | ask | show | jobs | submit | Finster's commentslogin

crickets


Depends on the game, but usually turning up the FOV to much higher than most defaults will help a lot. But screen size, etc. will have an impact as well.


https://slate.com/technology/2011/07/netflix-streaming-is-ki...

> It’s convenient, it’s not that expensive, and the selection is just good enough.

Welp, netflix (and others) are 3 for 3 on eroding those advantages.


Not sure that it makes sense to compare NATS to gRPC. Maybe the thinking is because gRPC supports bi-directional streaming? The integrations are wildly different, though.


I didn't realize it was time to drag this old chestnut out of storage. Nothing like dusting off a decades long flame war. I'm sure everyone will come to an agreement this time.


Looks like github is down, and aws is having issues, too.

https://downdetector.com/

I should've stayed in bed


Is this why facebook is down?


The big concern I have here is that the address resolution seems similar to DNS... Which is very bad, IMHO. Are they taking necessary steps to mitigate ddos and Man in the middle attacks? If they're not, they're seeing themselves up for major disaster.


>>Just like how domains get resolved to IP addresses, every VPA needs to be linked to a bank account. The UPI handles get resolved to bank accounts and IFSC during the payment (we will see how).

I am sure I am missing something. Just curious to know where do you see an attack vector for DDoS or MOTM attack?


> Are they taking necessary steps to mitigate ddos

I am not sure how this would happen in this case. If you want to flood the system you will have initiate a lot of payments which will be costly.

Both sender and receiver are authenticated with bank, so there is a traceability.

Also, you need a bank license from the central bank to act as a bank and each UPI is linked to an bank account which itself is linked to details. To add, it is now difficult (not impossible) to have anonymous bank account because they are linked to a central ID called Aaddhar number [1] and other KYC procedures.

One will have to really execute an elaborate scam like in Ocean's 11 movie to make this work.

[1] https://en.wikipedia.org/wiki/Aadhaar


I don’t know about UPI, but those concerns can be mitigated by not operating on public networks. The SWIFT payment network for example is private[1] and is only accessible via dedicated routers.

[1] https://www.exalog.com/en/swiftnet-network-banking-communica...


Relying on perimeter security like this means you are as vulnerable as your weakest nodes. SWIFT can be and has been hacked via its less sophisticated participant banks.


Actually this got me thinking they should have built the resolution system on top of DNS. We already use emails for very sensitive communications and rely on DNS to resolve them correctly. I'm not sure why we couldn't do the same for payment addresses.

NCPI could definitely be a single point of failure, and I think that makes them vulnerable to more than just MITM and DDOS attacks.


The “resolution” is done by forwarding the query to your PSP which forwards it to the NPCI which forwards it to the issuing bank.

The client-PSP is over HTTPS, and the remaining legs are over UPI (which is essentially SOAP+XML) which uses XML signatures.

There are rate-limits built at most ends, and I think most PSPs also cache the resolution.


The resolution is not done at the client end, but in NPCI, while processing the transaction. So this is nothing like DNS.


There's already a PR to fix this, looks like there's a missing space after one of the minus signs.


From the slack post:

> In other words, if you’re one of the approximately 99% who joined Slack after March 2015 or changed your password since then, this announcement does not apply to you.

Hackers compromising plaintext password would seem to apply to everyone using Slack, whether their account was compromised or not??


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: