daave
Joined 15 years ago
Karma
354
Submissions
115
Member since
Nov 13
Recent submissions
Comment · 1 year ago
HackerNews - aka local news for residents of the Bay Area, Seattle & NYC
I wonder what percentage of the world’s software engineers live in these 3 cities?
Comment · 3 years ago
You're certainly more of an authority on it than I, so I trust when you say most schemes don't keep long-term keypairs around; but of the two companies I've worked at that use SSH CAs: one used Teleport, and the other had long-lived keypairs, but fairly-short-lived certificates -- you had to get your public key re-signed each day. They used Yubikeys to store (or maybe just unwrap?) the private key material during the SSH handshake; much as a TPM or the Secure Enclave could be used to do this.
Comment · 3 years ago
This is a non-sequitur, even if you use SSH certificates you still need a public/private keypair, hosts just authorize the key by checking the signature from a trusted CA on the public half of the user key. The OP is about a way to store the private key part of the user key that can't be extracted even with physical access to the machine. So, this is an equivalent/alternative to using a YubiKey, that is conveniently built in to a popular piece of hardware; not something orthogonal to using SSH certificates.
Comment · 4 years ago
Re caching:
I had a look into it, and it seems we set the following headers when retrieving user images:
> cache-control: public, max-age=3600
So I believe your browser _should_ be caching these.
Comment · 4 years ago
Done - https://radiopaper.com/Stavros
Being able to change your email address is a known gap, sorry about that. For now if you want to use a different email you'll need to make a second account. We plan to make account merging possible in the future.
A short-sighted technical decision on my part: we use the Firebase Auth UIDs as our internal user IDs, but Firebase Auth does not allow you to have multiple email auth-providers on a single account. So we need to add a layer of indirection in our data model.
Comment · 4 years ago
Yes! They will receive an email with the message, and some boilerplate explaining that it was sent from Radiopaper and that if they reply to the email the message will be published. They'll also receive a link to view the post on the site if they prefer.
Comment · 4 years ago
https://radiopaper.com/about
It's helpful feedback that this isn't as discoverable as it should be. If you hover your cursor towards the bottom of the explore page, some links show up.
Comment · 4 years ago
We don't have usernames!
You can log in with OAuth, or by Email.
You can change your _display name_ on your profile page, and that's what appears publicly on the site (your email doesn't appear publicly, even if you log in by address!).
Today to get a custom profile URL like radiopaper.com/Dave, you just need to ask and we'll create an alias for you. There isn't a self-serve alias mechanism available today, but we're thinking about how to provide one. Any profile can be linked by the URL radiopaper.com/uid, for instnace my profile can be reached at https://radiopaper.com/user/AwQLwnOgQFdyDfNoYfNCSSsVdx43, "Dave" is just an alias.
Clearly having separate concepts of login method vs display name vs profile URL is all a bit confusing, this is helpful feedback!
Comment · 4 years ago
Adding a feature to block specific accounts is on our short-term roadmap.
We'll also endeavor to block accounts from the platform that violate our policies (https://radiopaper.com/policies).
Comment · 4 years ago
Hacker News has definitely pushed us out of the free tier for today, but these services are still impressively cheap. We may have a $5 cloud bill this month.
Comment · 4 years ago
The ability of the OP to accept or ignore replies is in addition to, not instead of, regular spam filtering techniques. Certainly we'll want to automatically block bots and other bad actors that violate our policies to reduce the burden on users.
Engineer at Snowflake. Co-founder at Radiopaper, PerfectSchedule. Ex-Google. Ex-Mixpanel. Ex-Stripe.
Views here are my own.