Hacker News new | past | comments | ask | show | jobs | submit | sha666sum's comments login

This URL includes a bunch of tracking parameters. Cleaned version: https://news.gandi.net/en/2020/07/why-we-retired-the-securit...


Something nobody else seems to have said here, is that Valve's work on Linux, Proton, streaming from one device to another (even phones), etc, puts them in an excellent position for cloud gaming, as pointed out by [1]. Namespaces support seems like an obvious next step here.

Valve is already in the best position for this, since they're the dominant market player and gamers already have their game libraries in Steam. Buying a game from Valve makes more sense than buying a game from Google Steam users get to keep a playable product even if the streaming product is a flop.

[1] https://www.gamingonlinux.com/articles/looks-like-valve-coul...


If there was, they could've communicated it clearly already a year ago. There is no reason to give Google the benefit of the doubt, since it's clear they're not trying to get it.

If this rolls out, I'm going to very loudly tell my friends to use Fox, and not stop.


They have, https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz..., and reading it I have always thought it makes sense, as much sense as why Safari decided to do it. However, I don't think I have ever thoughtful discussion why their intended goal (security and privacy) is wrong or could be done in other ways.

I feel sad that each time this comes up even on HN it's always "Google, ad company, bad". There's a mention elsewhere about 30k limit being limiting. Why aren't we discussing alternative enforcement metrics, and request for inclusion?


The announcement makes it seem like they were doing so anyways, but they are willing to open source it first.


Almost everyone in Finland speaks either good or fluent English. Movies and TV shows aren't dubbed apart from some animated content, usually for kids. Domestic media can only create so much content for a population of 5 million, so the population is constantly subjected to English language media.

There's also regions along the coast where a sizable portion, or even the majority of people, are Swedish speaking[1] (and bilingual to various degrees). Swedish is an official language, and if you want to be a pain in the ass to the 95% of the population that doesn't speak Swedish apart from the mandatory school courses, you are entitled by law to get service in Swedish.

Working only in English is obviously harder, but if you want to live here, don't let that stop you.

https://en.wikipedia.org/wiki/Swedish-speaking_Finn


It runs locally, and if the attacker has that much access, in most scenarios there isn't anything stopping your adversary from just logging your keystrokes and curling the keystore to a remote server.


SMS 2FA is better than nothing if, and only if, you don't allow password resetting by owning the SMS.


TOTP is better than SMS in that it's secure with fewer caveats.

Why am I being downvoted?

I'm literally willing to volunteer days of my time, unpaid, to prevent SMS 2FA in favor of something more secure (i.e. TOTP).


> Why am I being downvoted?

I can't speak for all of those who downvoted you, but the comment you responded to mentioned how SMS based 2FA would be better than what they do today (i.e. nothing).

This is a fact. SMS 2FA, regardless of how bad it is, is still another hurdle an attacker would have to overcome. An additional hurdle, no matter how small, is still better than nothing at all. Therefore the assertion that SMS 2FA would be better than what they do today is simply an irrefutable fact.

If you left off the "Oh god please no." portion of your comment, you may not have been downvoted.


SMS 2FA includes the negative energy of "we have this, so we don't need TOTP or something better." It may well be a net negative.

The corollary to don't let the perfect be the enemy of the good is don't let the barely better be the enemy of the substantially better.


Generally companies treat the SMS 2FA as an additional check, so it's a security improvement. But some companies also then allow it to be used for password recovery, which is generally a security regression. Also multiple companies have used SMS 2FA numbers for ad targeting.

https://news.ycombinator.com/item?id=21197553


Not really. It means I now have to prove prove to the site that I got my sim hacked and has to go to a ton of trouble getting my phone number back.

Seriously auth over sms should not only be froned upon, but illegal. It is a nice cover you ass for the site that does it, but if you do 2f any way that is not using a uf2 physical token you should not be allowed near a computer.


My experience with Rust is that I have to fight the compiler a lot, but when the program compiles, it works. If it doesn't work, it means there's an error with my file/network paths or I did something in the wrong order, errors which no language can save me from.

Rust also becomes a lot less verbose when you get better at it. The ? operator is especially useful.


> but when the program compiles, it works

That's not even true for languages with dependent types, which Rust lacks.


It is (or should be) read as slightly hyperbolic, as there isn't to my knowledge a language that actually works that well. I could water down my message by saying "it mostly works", but then I fail to convey the main reason why I posted in the first place.

I could also instead spend a lot of time and words to explain things about Rust's design that I presume anyone who is slightly interested in the language would already know (specifically: lack of null, strict ownership checking, having to explicitly deal with errors), in order to explain that the language succeeds at solving some of the problems it was specifically designed to solve. But then I would just be repeating things that HN readers presumably already know. Instead I can use a shortcut in my communication which is perfectly understandable if you assume minimal intelligence, and take the other person's comment in good faith.

See, by the time we've reached the bottom of this wall of text, anyone who read this far through my intentional rambling has presumably forgotten my initial point: I had a positive experience with the language.


And at the same time, I've heard people say "when it compiles, it works" about much weaker type systems, like Go's. It just seems to mean "this language catches more errors at compile time than the previous language I used."


> It just seems to mean "this language catches more errors at compile time than the previous language I used."

That is a fair interpretation. I've programmed mostly in C# and Java because that's what was required at the time. I also know enough C and C++ to aim at my toes instead of the entire foot. So the comparison is between strongly typed imperative programming languages which are syntactically close to Rust.

Also, I like that Rust isn't OoP, but try to not get baited into that discussion.


"Out of pocket"?


object oriented programming


Normally only prepositions and articles are left in lower case, e.g. SaaS.


From what I've seen if you fight the compiler a lot it means you're trying to write something that very non-trivial memory ownership. Just as RAII is a learned concept, so is understanding memory ownership. Hopefully it will be taught more in school along the lines of RAII and similar concepts.



Data mining as a business model is fine, as long as the customer is making an informed decision, there are equally good alternatives out there which you can pay for in other means, and you're not drawn to a particular service because of network effects or platform lock-in.

However, customers aren't well informed, and if they were, they wouldn't use these services. Currently customers are getting scammed for their data. This is why we need regulation.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: