Recent submissions

Comment · 3 years ago
It wouldn't always be a mistake. Moderna stock is significantly lower than it was in 2021 so the CEO could be harvesting losses.
Comment · 4 years ago
I've been on hundreds of calls for both and have personally had far more issues with zoom than google. I also prefer Google's UI and security model, and Google's pricing is better for companies using gmail.
Comment · 5 years ago
Comment · 5 years ago
Looks exciting! It is kind of disappointing the AI generated main example on their home page has what appears to be a url encoding bug in it though (in text=${text}, text should be url encoded before being passed to fetch).
Comment · 6 years ago
Comment · 6 years ago
This seems to predate FIDO2. https://solokeys.com/ would be a better option if you prefer separate keys for each site (via FIDO2) and open source hardware.
Comment · 7 years ago
I agree that short term providers will likely take in less money with a "Medicare for all" solution, but I think the problem presented by this blog post is overstated/misrepresented: 1) The "Over 65" demographic visits the hospital more than other demographics so comparing raw number of people is an apples to oranges comparison (65+ somewhere between 3-10x more likely to utilize an inpatient stay, https://www.hcup-us.ahrq.gov/reports/statbriefs/sb235-Inpati...) 2) Roughly half of all administrative costs in US hospitals are associated with billing. Administrative costs are lower in single payer systems because hospitals don't need to bargain and coordinate billing with multiple parties. Doctors will still be needed by hospitals, but hospital workers/sales people/VPs who bargain with insurance companies will be less necessary. This is a significant percentage of hospital expenditures [https://www.americanprogress.org/issues/healthcare/reports/2...] Administrative staff seem much more likely to see paycuts or staffing cuts rather than necessary staff like doctors/nurse.
Comment · 7 years ago
ITP 2.1 also already says it will block cookies of this type if it matches Safari's completely non-transparent ML model for "tracking cookies". Also Chrome pushed back the release date of this new default from end of August 2019 to February 2020 and the bug has been "fixed in a non-yet released version" of Safari since early June (safari is really slow to release security patches).
Comment · 7 years ago
Apple's search ads are projected to be one of the largest online advertisers in terms of ads revenue in 2020 (they have larger advertising revenue projections than both snap and twitter). Device sales in general are dropping so they are expected to continue to invest in this area of their business. Given that Apple is a large organization known for their lack of transparency, I would be very surprised if they weren't already doing shady things with user data for targeting purposes.
Comment · 7 years ago
Comment · 7 years ago
It's a bit disappointing their demo doesn't appear to leverage certificate transparency logs as a source of truth for which certs are out there and instead relies on pinging the server directly
Comment · 7 years ago
Comment · 8 years ago
Prepared statements tend to be the best answer for most cases which is similar to the approach you describe but is natively supported by most SQL dialects and also improves performance.

In my experience, many developers and even experienced security engineers can fail to give this answer though.

Comment · 8 years ago
Comment · 8 years ago
Seems like a bit of an oversight that they are including third party tracking scripts like googletagmanager.com in the same context as the javascript doing encryption. If you need user tracking, at least put the tracking scripts in an iframe sandbox or something that can't accidentally grab the keys from the URL fragment and send them off to google.

Also they do call out that URL fragments get stored in browser history which is a big risk, but they should also mention that many browsers automatically "sync" history across devices (so keys will get sent to a cloud if you aren't using incognito/private browsing).

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton