Hacker News new | past | comments | ask | show | jobs | submit | ViVr's comments login

I'd like to see them add support for including attachments in your Bitwarden exports before i go putting any more critical data into their ecosytem.

It has been a feature request for close to 6 years now: https://community.bitwarden.com/t/allow-attachments-to-be-ex...


Personally I just backup the underlying filesystem (i.e /data) that vaultwarden uses.

Edit: I realize you are probably using bitwarden directly, in which case don’t you trust them to safeguard your data?

ps: if it’s just ssh keys, just store them as key value pairs? I haven’t kept ssh keys for a long time thanks to tailscale ssh…


> I realize you are probably using bitwarden directly, in which case don’t you trust them to safeguard your data?

Yes i use bitwarden directly, no self hosting. I do trust them keep my data safe (although i also trusted LastPass at some point, big mistake) but why not also keep a local copy, just in case. The type of data you store in bitwarden is worth the hassle and if Bitwarden Inc. ever gets into big trouble suddenly you'll be glad to have the backup.


If the data worth the hassle to backup, isn’t it worth the hassle to self host? Especially if you were part of the lastpass breach

Information wants to be free but might be losing the battle regardless. The siren call of centralization lures in too many people who only realize the implications when it's too late.

On most projects and topics i work on i keep personal notes. Sometimes i copy entire pieces of information from websites into my notes so that i don't lose it when the website dies. Any interesting webpage i at least archive through both archive.today and archive.org. Eventually i might look into taking that locally as well.


Since archive.org is now getting into a court battle that doesn't look good for them, it would be prudent to make local copies of anything you want to save on there, in case the whole site disappears.


> "The network, owned by a Dutchman named Danny Manupassa, had made a spectacular bungle: it had stored the private keys for the system on the same server as the network’s messages. Analysts in the Netherlands obtained the private keys and then used them to decrypt Ennetcom texts."

Not your keys not your comms. But even then then, apply defense in depth.

> "Sky’s messages ran on a different system than EncroChat’s, and it was more difficult to infect the network with bulk malware. Instead, someone with knowledge of the investigation told me, analysts seem to have launched a “protocol attack” that deceived handsets into revealing their private keys."


HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page.

It also increases privacy because the contents of the traffic can not be observed by third parties.


Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.


HTTPS does not leak the requested URL to servers between the client and the server.


> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS


Most public web sites leak information about page accesses to anyone who can count bytes.


What kind of attack are you describing?


Count how many bytes of TCP traffic you see. Measure the size of each web page on the (public static) website.


The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.


> host name was leaked, but with SNI even that is gone

nope, you can still see it perfectly fine:

https://tlshello.agwa.name/

please don't spread misinformation.


ESNI*


OK, now name at least two public servers that use that. I will wait...


It's a theory by wealth manager Brent Johnson that the next big recession will trigger an enormous demand for dollars. The dollar will rise against most other currencies and non-US bonds thus sucking up all the liquidity (that's the milkshake part).

He's been on many podcasts to explain his theory and provide updates. I will link you an interview at realvision from september 2020 timestamped at 51:55 where he goes through it in summary: https://www.youtube.com/watch?v=h_HCIyc6MaA&t=51m55s


I hadn't heard of the theory before but in googling it I came across this video[0] from mid 2019 where he claims the demand for US dollars will be driven by rising interest rates and a shortage of dollars. Obviously things went a very different direction in in the past year and a half or so as the Fed has kept interest rates low and monetary supply has increased. So it's odd to see him arguing in the video that you linked from late last year that the same outcome will result from very different circumstances.

[0] https://www.youtube.com/watch?v=2qTOWuL7Zco


I prefer to get my economics pop-econ-theory from Lyn Alden.

She has a very good post about this same topic titled "The Global Dollar Short Squeeze":

https://www.lynalden.com/global-dollar-short-squeeze/

Recommended.


1. 2008 recession was offset by both US Fed, PRC, et al. buying lots of UST and stimulating global economy.

2. 2020 was offset by US Fed buying tons of UST and USG printing USD. However, global economy cannot magically expand by 40% or whatever is required to balance that expansion of USD. Hence a persistent supply chain crisis.

In current geopolitical climate, no foreign state will buy lots of UST. US Fed is still buying lots of UST, causing a liquidity glut causing inflation. Global economy physically cannot expand at the necessary rate to absorb this inflation, so stagflation or financial collapse is the only way forward for America.


For item 2, you may want to consider how the Fed stepped in to hush up the reverse repo inter-bank lending in Fall 2019. That rolled into 2020 bailouts.


Any articles you can point me to? I can’t find anything about this.


This september 2019 article from Financial Times might be a start.

Why is the Federal Reserve pouring money into the financial system? Answer lies in short-term issues and structural market changes https://www.ft.com/content/345da16e-d967-11e9-8f9b-77216ebe1....


Hey NY Times, now do an article on clothes dryers which use 4x more energy than the BTC network[1][2] while air-drying can do it without any electricity.

[1] https://twitter.com/csuwildcat/status/1392639419920785411

[2] Same tweets but on threadreader https://threadreaderapp.com/thread/1392639419920785411.html


Or try to estimate how much power the current financial industry takes, hint: it's not exactly a small scale operation. But while the motive for attacking BTCs might not always be honest (see this article also has no shame in casually calling out the early adopters of Bitcoins as "anarchists"), the point about energy consumption isn't entirely invalid. Right now it's probably on the line of being fine, but it a puts a real hard cap on how much further BTC will be able to scale. We definitely can't have another 10x increase in power consumption or something like this. So maybe protocol changes are needed, or things will slowly shift somewhere else, just something to keep in mind.


PC gaming alone as much as bitcoin and its useless as bitcoin in my eyes.


> Following a random exercise routine can result in injury.

A trainer can check your form and help you execute the exercise safely but how does an exercise routine injure you?


It might not be super clear from the site shared here, but most of these exercises are done with barbells with weights, or dumbbells. It's not hard for a beginner to do these with incorrect form, and then increase the weight over time, until bad form plus weight results in injury.


Citation needed that bad form inherently leads to injury.


In a world where the Fedcoin and e-euro are commonplace, having access to a decentralized money system not tied to the whims of politics would really matter to me.


Not disagreeing but from Bitcoin, ethereum to DogeCoin they are all tied to the whims of non trust worthy persons.

What if satoshi (unlikely but maybe the Fed itself) decides to liquidate its position of at least 1M Bitcoin. Ethereum foundation forks ethereum again to roll back transactions. Or Doge is uncontrollably minted (I don’t think it has a supply cap) or Elon decides to stop pumping it and decides to dump it.

Everything else in between is just a bunch of discord/telegram armies pumping for their own interests. I just that’s great so long as you have the social credit to be on the inside.


Your post seems to have an undertone of nervousness about the exchange rate of USD/cryptocurrency which is understandable in the middle of this bull market. In my opinion bitcoin is a revolution disguised as a get-rich-quick scheme. A whale liquidating lots of BTC sounds like a sweet bargain to me. BTC has a capped supply so they will run out of steam at some point.

Due to game theory mechanics most network participants have an incentive to play by the rules and agree on rules that are as fair as possible. A hard fork has to be embraced by the majority of the users to be accepted. It's not just the miners or the whales who decide the rules.

Of course there are countless of cryptocurrencies in use right now of which most are doomed to fail (maybe even all but one are doomed to fail).


It’s not USD/BTC. That’s not longer the dynamic, if BTC is dumped it’s value falls in relation to all other coins/tokens/fiat.

> A whale liquidating lots of BTC sounds like a sweet bargain to me.

This is my point, it’s all me, me, me. What about the people that lose everything. And what about when it’s no longer a situation of “only invest what you can afford to lose” rather that’s the currency you get paid in and it’s regularly subjected to pump and dump schemes. That’s not a system of currency, much less a democratization of money.

The entire defi system is currently set up for people to literally act as vultures and skim money from liquidity pools staked by others. NFTs are effectively money laundering schemes mixed with guerrilla marketing consisting of fake collectors, self purchases/self dealing, and more pump and dump scams.

Imagine some senior citizen just trying to pay rent, buy groceries and pay for meds fiddling with the most user friendly centralized wallets much less managing their own private key and setting gas. They fact is there are whales and they are sophisticated persons/organizations (if not live neural nets/bots trading on their behalf with unlimited capital and liquidity seeking to scrap profits by manipulating the prices) they certainly aren’t the unbanked which is another bs marketing scheme of the technology.


I don’t think you can predict the future of crypto based on the current state-of-the-art. Using bulletin boards in the 80s internet was a difficult experience only for the technically savvy. I would give it more time for non-technical people to start using crypto.


Unless these non-technical people collectively work out that they are the chum for the consumption of the neural nets, whales etc. previously mentioned.

At some point it has to become obvious that there is no new opportunity for the non-technical, relatively powerless person. They are the food for the already powerful in this situation, as things currently stand. I know people in exactly this situation: older musicians and sound engineers on a discussion forum who clearly aren't up to speed on the mechanics of how all this works. The only redeeming factor I can see is that they're into POS instead of POW crypto, but they seem to have little idea of how fees and things work, and they're elderly musicians who're on the whole already not wealthy, and crypto is gonna take the last thousand dollars from some of these guys and leave 'em destitute.

When you talk about putting these sorts of things into the reach of the non-technically savvy, it seems we are generally NOT also talking about not predating upon them savagely. Instead we get Facebook and the like: we get mechanisms to consume those people, that being the point. Not great.


>This is my point, it’s all me, me, me. What about the people that lose everything.

I think that's a very important point. Contrast cryptocurrencies to free software. The free software activists intended to give every user more power, to let anyone modify and share the software they use.

But crypto is different. Instead of empowering everybody, it replaces one concentration of power (old money and fed) with another (new money and whales). So naturally, the arguments in favor are increasingly of the type "this will be good for me": support crypto so that you, too, can carve out your part. Or don't and "have fun being poor" (i.e. left out of the concentration of power).

If crypto were about empowering everybody, it would consider pump-and-dumps in particular and preferential attachment in general to be bugs, not features. But it doesn't, not as long as number go up.


The fact people are jumping through the hoops and hoopla now show that it's possible. Could you imagine if we still used dial up to access the Internet, some people actually do so tech being difficult is a given for first generation offerings.


Is there any evidence that Musk actually owns Doge? I think he's said something like, it's fun as a meme but has too much central ownership for him to actually buy it.

(wouldn't be shocked if he holds BTC though, since he got Tesla to buy in there)


Whether or not he owns it, he is single handedly responsible for pumping it.

Look at how he pumped it leading up to 4/20/21 (DogeDay) and then Twitter bots and scammers pumped it on Twitter getting “DogeDay” trending by multiple times and all the uneducated “investors”, if you can even call them that, bought in at the height thinking it would pop to $1 on 4/20/21 DogeDay with Elon’s continued support and instead it got dumped losing 50%.

I wrote a post on here about the scam and said it would get bought back up on the dump and go to new all time highs as the uneducated investors that got scammed sold due to fear and not only did that happen it happened on Musk’s tweets of doing SNL and skits of the DogeFather. It honestly is like a predictable a moral neural net that’s single purpose profit on self created pump and dumps that it is capable of creating with unlimited liquidity.

When I made my post it got the inevitable comments of “so what, it’s no different than X, and the way it’s always been”. Maybe but its always poor people targeted and ultimately hurt, it’s immoral and should be fucking criminal. Especially if he is pumping it just for shits and giggles.


While I would support regulation to stop stupid people from losing their money, I also have zero sympathy for anyone who loses their money on something like doge.

Anyone who buys into a get-rich-quick scheme is a greedy fool, rich or poor.


If you don’t believe in protections of uneducated investors that do lose money on Doge who exactly deserves protections. These are the very same people that would invest in a stock based on a tip, they’d never be able to perform due diligence, and that’s exactly why they would trust Elon, because that’s what uneducated investors that need protections do.


It's impractical to demand laws to protect people from all incarnations of their own stupidity or credulity.

Specifically, it's not Musk's fault that it seems a large numbers of stupid and credulous people are choosing to have their "investment" strategy influenced by the tweets of a well known Twitter jokester. If Musk tweeted that paper shredders actually convert $100 bills into gold, should he be liable for any losses incurred by anyone stupid enough to think he was being serious?


There is a major difference between laws to protect people from all incarnations of their stupidity from pump and dump schemes directed at unregulated investment vehicles.

It’s the same individual who has already faced legal repercussions with the SEC for his Tweets related to publicly traded stock. Let’s not forget Martha Stewart didn’t actually go to jail for insider trading, but she did go to jail for publicly stating she would be found innocent of the insider trading and they ended up nabbing her for those comments which amounted to securities fraud because they boosted her stock price.

It’s not like he doesn’t know his tweets are primarily influencing young, uneducated investors, and as they say in tech...that’s a feature not a bug. And for what it’s worth your comment is consistent with the opinions of scammers who never accept responsibility, to them it’s always the victims that deserved to be scammed for what ever reason.


What else are laws for?


Wait, seriously?

The main (and to some people, only) point of laws is to protect people _from other people_, not from _themselves_.


Victims, whether or not they are educated, or even if they are stupid as they have been called, are still victims. You are exercising crazy mental gymnastics to victim blame, it’s exactly what people do when a girl is rapped and they say she should have dressed to provocatively.

It’s the stupidest thing I have ever heard...to not protect someone because they should have been smarter than to act upon a desire selfish desire to make money, well no shit that’s why fraud and cons work, because almost everyone acts on the desire to make money. It’s why people have jobs and work, that doesn’t give employers a green light to defraud employees.

Should all those old people who fall for scams down to the Nigerian price email scams not be protected because they are stupid and acted selfishly?

Let’s say a casino rigged a deck of cards or rigged a slot machine and falsely advertised the odds of winning to the public, would victims not be entitled to protection because they are stupid and acted in a greedy way to get rich?

Why shouldn’t the victims of Elon, all the Twitter bots , and those behind them, that are pumping and dumping Doge be protect besides calling them stupid and greedy? What is it is shown millions of the victims are actually just kids that idolize musk? Are they still just stupid and greedy and thus deserve to be scammed?


> What is it is shown millions of the victims are actually just kids that idolize musk

Just to be very clear, even if everything about your argument was correct (which I don't grant), you're talking about hypothetical future victims, in a hypothetical crypto crash, because Dogecoin (along with the rest of crypto) is at a dramatic all-time high.


It’s also debatable whether a person who “invests” in crypto and loses everything is a “victim” or merely ignorant to the basic principles of investment risk.

Doge isn’t a scam, it (as with all crypto investments) behaves like any other investment vehicle, except that it has no inherent value and produces no value.


Fortunately, there’s a competitive crypto landscape. If none of these are actually decentralized, people will move to different currencies. Sure it will be turbulent, but we’ll probably get to something effectively decentralized eventually.


Why would people move to decentralized currencies? They are clearly moving from decentralized currencies to centralized exchanges.


There's definitely a market for a currency that avoids monetary policy. I think exchanges are an intermediary until P2P becomes the norm. That's why I'm bullish on BCH. They make P2P cheap and fast, while retaining most of the other signature aspects of BTC.


> Doge is uncontrollably minted (I don’t think it has a supply cap)

It doesn't have a hard cap, but it does have a cap on inflation: 5 billion every year (current reserve is about 128 billion). The inflation rate is less than 5% and going down every year, much lower than most fiat currencies. (Not related to why it shoots so high these days).


All cryptocurrencies control their supply. That doesn't mean a supply cap. It can be as simple as emitting only 1 coin per second. That makes it very different from fiat, with its unpredictable supply.


If the satoshi wallet holder would liquidate its position, he/she would do it like Micro Strategy and Tesla, no body really notice it over time. Given bitcoins open ledger and the wallet address its quiet easy to anticipate that traffic. You already have chain analyses tools.


The issue with that is the instant those coins move to a new address people will notice and probably panic.


Crypto is tied to far more esoteric whims. Honestly the Fed has done an absolutely heroic job in the last 20 years and proven the USD to be almost indestructible. Crypto was founded for privacy, not for it's economic foundations which are still nonsense.


The dominant position of the USD on the world stage also might have something to do with the USA having deployed military to more than 150 countries at once and their involvement in regime changes all over the world.

Meanwhile the FED heroically partakes in piling on debt for the futures generations.


When your currency is the world reserve currency you are obligated to take on debt.


It's due to our centuries of issuing and paying off debt. No one is buying Treasuries because of our foreign policy.


It's not so much that it's tied to esoteric whims but that it would destroy the economy if at some point were to become the primary currency, just like the gold standard did.


Printing tons of money is not “heroic”. There is nothing difficult about handing out trillions of dollars.


Handing out trillions of dollars at the right time to prevent a disaster is pretty heroic. Crypto is handed out to whoever has the most GPU power.


> Now you have code that may or may not be buggy

Doesn't your solution of replacing the possibly buggy code with configuration leave you with configuration that may or may not be buggy?


Its mainly a question of it being deterministic and reproducible I think. The presumption is that you then go and test a bunch of stuff based on whatever was built, so no, it will not be buggy.

But if the code that actually goes to production is actually different to what is tested (because your rebuilt it based on a config with some runtime behavior that executed differently), you are compromising the whole thing and all bets are off.

People will try to split the difference and generate a static config with code and test that as a reproducible entity, but then you have another set of tradeoffs (not least, complexity).


This article seems to focus on clean code not having a significant effect on the software in production for the experience of the end user.

One example where I have experienced the benefits of a clean codebase is when onboarding new developers. It takes a few days of handholding but once they've started working with the code there's very little room for gotcha situations where they get stuck or inadvertently introduce bugs due to being misdirected by the code that was already there.


Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: