Hacker Newsnew | past | comments | ask | show | jobs | submit | ongy's commentslogin

How does that prevent the ID service from discovering which services you use it for?

You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id.

If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.


People do, in fact, have multiple profiles. For very valid reasons.

the solution to this seems to be to issue multiple "IDs". So essentially the government mints you a batch of like 30 "IDs" and you can use each of those once per service to verify an account (30 verified accounts per service). That allows for the use case of needing to verify multiple accounts without allowing you to verify unlimited accounts (and therefor run into the large scale misuse issue I pointed out).

If you need to verify even more accounts the government can have some annoying process for you to request another batch of IDs.


This is a solved problem in the authentication space. Short lived tokens backed by short lived keys.

A token is generated that has a timestamp and is signed by a private key with payload.

The public key is available through a public api. You throw out any token older than 30 seconds.

Unlimited IDs.

That's basically what you want.


Which either allows to use a fingerprint of the signing key to be used for the same.

Or would open the system up to the originally posted attack of providing ~an open relay.


Which hotel asks for id online..? I've only ever had to provide it once on-site and checking in.

And when then, only when I'm in foreign countries.


Happens quite often with Airbnb for example. You often don't meet the host in person so there's no way to show them a physical ID.

Ahh. The not-quite-a-hotel. I don't think I ever used them.

My main issue is trust.

In real world scenarios, I can observe them while they handle my ID. And systematic abuse(e.g. some video that gets stored and shows it clearly) would be a violation taken serious

With online providers it's barely news worthy if they abuse the data they get.

I'm not against age verification (at least not strongly), but I'd want it in a 2 party 0 trust way. I.e. one party signs a jwt like thing only containing one bit, the other validates it without ever contacting the issuer about the specific token.

So one knows the identity, one knows the usage But they are never related


> So one knows the identity, one knows the usage But they are never related

I could be wrong but I think this is how the system we have in place in Italy works. And I agree that it's how it should work.


No printer.

Iirc. Jack was accepted by the organizers but pressured out by the community.

Also, about github: Had a chat with the Gitlab chap doing the Git talk in the main track. Apparently they dialed back their involvement with upstream git quite a bit. Github is currently providing a lot of infra gratis (thanks!) but is at best neutral to code and community.


Agreed, this year was a bit light on questions.

OTOH, 80% of the reason I go to talks is to see if the person has interesting things to say and grab them after the talk for a chat. I.e. it sucks for the remote experience, but I think for on-site it's fine to just talk more.

Gets harder if you consider the talks the main attraction, but I really see them more as hooks to talk to people about interesting topics.


Eurostar was fine for me. Getting to the Eurostar within Germany apparently sucked for some. But I took a later train and didn't have issues there either.

It's mainly re-hashed. I think I've seen the same talk twice before? At least once.

It's a very "I've made a cool thing. This is what I think is cool about it" type of talk. Which I don't think is uncommon for FOSDEM. Maybe a bit uncommon for a higher profile figure like Lennart.


> It's mainly re-hashed. I think I've seen the same talk twice before? At least once.

He held a similar talk at All Systems Go I think (I missed the talk here at FOSDEM).

> It's a very "I've made a cool thing. This is what I think is cool about it" type of talk.

Varlink isn't something he just made up, he mearly "adopted it" (started making use of it). It existed before, but I don't know anything that really made use of it before.


Who made it up, then?

The official-looking website at https://varlink.org doesn't give any information about who the authors are, as far as I can tell, but the screenshots show the username "kay". There's a git repo for libvarlink [1] where the first commits (from 2017) are by Kay Sievers, who is one of the systemd developers.

An announcement post [2] from later in 2017, by Harald Hoyer, says that the varlink protocol was created by Kay Sievers and Lars Karlitski in "our team", presumably referring to the systemd team.

So the systemd developers "adopted" their own thing from themselves?

[1] https://github.com/varlink/libvarlink

[2] https://harald.hoyer.xyz/2017/12/18/varlink/


While I guess you aren't wrong, I also wouldn't say you are entirely correct that Kay is a systemd developer. He use to work on udev, but hasn't been active in any meaningful way on it for 2 years before varlinks release[1]. For what it was made I can't really say, but Lennart hadn't start integrating Varlink until a while after its release (I think I remember it being like 2021 or so when he started making use of it, after another check it seems the start of varlink stuff in systemd was 2019[2]).

[1]: https://github.com/systemd/systemd/commits/main/?author=kays...

[2]: https://github.com/search?q=repo%3Asystemd%2Fsystemd+varlink...


Kay Sievers' Wikipedia page cites a blog post by Lennart Poettering [1] which says that systemd was designed in "close cooperation" with Kay Sievers and that Harald Hoyer was also involved, so it seems pretty clear that he's on the team that develops systemd, the team that Harald Hoyer referred to as "our team". All three of them gave a talk [2] together in 2013 about what they were developing.

If Lennart Poettering "adopted" varlink, he seems to have done so from members of his own team ("our team") who created varlink and who are also fellow co-creators of systemd.

[1] https://0pointer.de/blog/projects/systemd.html#faqs

[2] https://www.youtube.com/watch?v=_rrpjYD373A


The most important realization about FOSDEM is really:

There's no way you can fully experience it or do it optimal.

It's really about making sure you get value out of it, listen to some interesting talks and meet some people.


It is been years since from my last time, however already about 10 years ago, it used to be either stick to a room, or stay close to a door and leave 10 minutes earlier, to try to get a spot in another talk, equally staying close to the door.

It's about collecting stickers.

It‘s about getting a selfie with the blue PostgreSQL elephant wandering around campus. :-)

It's about the friends you make when collecting stickers.

Sounds a lot like McMurdo

It's about meeting people who go to FOSDEM.

I was sitting behind you as you wrote this comment.

I just wanted to tell you that.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: