HN user

Fej

2,806 karma

Full-stack engineer in northeast New Jersey, USA, near New York City.

https://fej.io

Posts31
Comments675
View on HN
securityledger.com 5y ago

Neopets Is Still a Thing and It's Exposing Sensitive Data

Fej
1pts0
github.com 5y ago

Allow sideloading addons on Nightly that use supported WebExtension APIs – Fenix

Fej
1pts0
news.ycombinator.com 6y ago

Ask HN: What types of companies and industries tend to hire recent (CS) grads?

Fej
6pts5
blog.nuclearsecrecy.com 6y ago

The President and the Bomb, Part IV

Fej
111pts62
blog.nuclearsecrecy.com 6y ago

Why Nukemap Isn't on Google Maps Anymore

Fej
787pts289
www.reddit.com 6y ago

Pokémon Sword/Shield causes Roku devices on the same network to crash/bootloop

Fej
122pts10
www.chinalawblog.com 6y ago

China’s New Cybersecurity Program: No Place to Hide

Fej
3pts0
www.tandfonline.com 6y ago

There is no Plan B for dealing with the climate crisis

Fej
31pts51
9to5google.com 6y ago

The Need for ‘Reddit Requests’ Shows the Sorry State of Google Support

Fej
2pts0
blog.nuclearsecrecy.com 7y ago

Notes on the Hawaii false alarm, one year later

Fej
9pts9
www.nydailynews.com 7y ago

Bronx man, 21, guide scores of confused passengers with thousands of tweets

Fej
2pts0
nuclearsecrecy.com 8y ago

Missilemap

Fej
190pts50
news.ycombinator.com 8y ago

Ask HN: Is the Ballmer Peak real?

Fej
1pts4
blog.nuclearsecrecy.com 8y ago

Global Hiroshima: notes from a bullet train

Fej
1pts0
blog.nuclearsecrecy.com 9y ago

The Reinventing Civil Defense project

Fej
2pts0
news.ycombinator.com 9y ago

Ask HN: Do you believe that Authy cloud backups are secure?

Fej
23pts6
rpcs3.net 9y ago

Persona 5 Is Now Playable in RPCS3

Fej
2pts0
labs.bitdefender.com 9y ago

Massive GoldenEye ransomware campaign slams worldwide users

Fej
2pts0
www.economist.com 9y ago

An Inglorious Return to Austin for Uber and Lyft

Fej
3pts0
news.ycombinator.com 9y ago

Ask HN: Is there an alternative CSS for HN on phones?

Fej
2pts1
news.ycombinator.com 9y ago

Ask HN: What password manager do you use, and why?

Fej
19pts22
news.ycombinator.com 9y ago

Ask HN: When's the best time to post to HN?

Fej
4pts2
blog.nuclearsecrecy.com 9y ago

NUKEMAP at 5 years

Fej
2pts0
news.ycombinator.com 9y ago

Ask HN: How much does a master's degree matter, in addition to a bachelor's?

Fej
3pts2
blog.nuclearsecrecy.com 9y ago

The President and the bomb: understanding the history of US command and control

Fej
1pts0
blog.nuclearsecrecy.com 9y ago

Operation Crossroads at 70 (the first postwar nuclear test series)

Fej
1pts0
news.ycombinator.com 10y ago

Ask HN: Whatever happened to TeamViewer?

Fej
2pts1
arstechnica.com 10y ago

Cats may have a rudimentary grasp of physics, study finds

Fej
7pts0
www.eff.org 10y ago

Tattoo Recognition Research Threatens Free Speech and Privacy

Fej
4pts0
www.gog.com 10y ago

GOG launches GOG Connect; allows users to import certain games from Steam

Fej
5pts0

Do older versions of Nova have any security flaws which preclude using them?

I've been using this app for ages and it's been essentially feature-complete for several years. A part of me wants to switch launchers for no other reason than "it is supported and not tracking me", but it is possible for software to be finished, and I believe Nova falls into that category. If there's no meaningful vulnerabilities in it, there's really no reason for me to switch away, at least not immediately.

Those threads appear to be stoking the drama more than anything. HN's stated goal is to satisfy intellectual curiosity, and even if the post topic itself is of interest, if the discussion isn't substantive then the system is probably working as intended (regardless of whether it's the flamewar detector or a manual downweight).

NJ Transit uses QR codes for all train tickets and it works well enough. It's not quite as seamless as a tap card but NJT has moved largely to mobile ticketing and they're in the odd position of having to scan tickets both at turnstiles and by train crew (handheld scanners); cards would be awkward in the latter case. The paper tickets used to have magstripes but once they adopted QR codes for the mobile app, the tickets lost the magstipe and gained a printed QR code.

So the central server model is practical. The user's device has to have an internet connection at some point to activate the ticket within a reasonable period before using it but the connection doesn't have to persist after that. I don't know how their handheld scanners work in the Hudson River tunnels where there is no cell service but they do, so long as the user activates their ticket before the train departs.

This is really cool, thanks for pointing it out! I have used Eruda and keep it in Tampermonkey in Firefox for use in a pinch but it's hacky. It's impressive that it works at all, but it's very difficult to do any actual work.

I already had Kiwi installed and it's neat to pop it open and see this feature hiding in plain sight. I can definitely see myself using it regularly, although I won't use it as a daily driver since it selectively blocks adblockers on a hardcoded list of domains which is just untrustworthy. https://github.com/kiwibrowser/src/blob/master/extensions/re...

I am on Fios in northeast NJ, issues with some services (Netflix) but not others (Google except significant variance in ping times, Bing, AWS).

The million dollar question is, how do we know which brands are the good ones?

Is there a community which tackles this sort of problem alone? The best I have found so far is to find the community surrounding a type of product, especially on Reddit - there is a community around almost every interest imaginable - and figure out which brands they recommend, via search or just asking.

Often they even have advice in a stickied thread or wiki article.

YouTube Down 6 years ago

Not much of it actually helps me.

Neither do TV or movies for the most part; there are many examples of high art in those formats but the most popular examples thereof are hardly at all intellectually gratifying, educational, or otherwise "helpful", as you put it (a good descriptor). It's entertainment - it's there for fun, and in many cases, it's there for the sake of art. (That's not to say that e.g. popcorn flicks don't have any artistic qualities, just that they're aiming for the former, not the latter.) The issue is more in the ways that YouTube tries to keep you watching, like the other massive social media sites.

No one else, ever, has had a platform where an independent video creator could start with a handful of viewers and build up to millions, and even potentially make a career out of it. No, it's not common, there's a ton of work involved with no immediate payout, and it requires at least a bit of luck with the dreaded "algorithm", but it's probably more merit-based than what we had before, and that's a wonderful thing.

(I'm not entirely certain about that last bit, hence "probably". How merit-based was/is TV and film, precisely? I just find it hard to believe that they're better than YouTube, given the quantity of quality creators on it who could never find a slot, much less an audience, on any other platform or format that has ever been.)

With regard to the ubiquity: given the lack of competitors, apparently the capital requirements are so high and the lock-in effects so strong that there aren't any companies willing to give it a go. The closest thing we have, Twitch, filled a niche that YouTube wasn't technically capable of at the time, grew large enough before YouTube decided to try to enter that market so Twitch was able to acquire those same lock-in effects, and was bought by Amazon who provides the capital to ensure a smooth experience (Twitch prior to the acquisition was far more prone to performance issues).

Ableton Live 11 6 years ago

I loved Live when I had a chance to use it, but to quote the professor I had at the time - it's "so bloody expensive".

As an amateur, it's extremely hard to justify the doubling of the price of FL. (The $100 edition of Live is limited to 16 tracks so don't even bother.)

YouTube generates $15b in revenue on ads, plus YouTube Premium memberships [1] and so the cost of storing and serving all of the data would also have to total in the billions, after paying ad revenue to creators as well as other costs. That could be the case, although if they were taking a substantial loss it's unlikely they would hold on for as long as they have.

YouTube also has the benefit of having monopoly power over its market - to their credit, no one else, ever, has had a platform where an independent video creator could start with a handful of viewers and build up to millions. But since they have all of the creators already, and starting a competitor is extremely capital-intensive, there aren't any competitors at anything near their scale. For the most part the usual way to find other YouTube creators is YouTube, via their recommendation algorithm. There is a significant lock-in effect.

Since they have monopoly power, they should be able to find ways to monetize their platform, even if potentially contentious. They recently turned on mid-roll ads on all videos longer than 8 minutes (unless the creator opts out) [2] so it's not like they're out of ideas.

[1] https://www.theverge.com/2020/2/3/21121207/youtube-google-al...

[2] https://9to5google.com/2020/07/10/youtube-mid-roll-ads-short...

YouTube allows free video uploads and ingests an incredible amount of content every day. Most of that content won't make any money, or just pennies, and yet they're storing it for free. They're not running out of space.

In retrospect, it's not surprising that they're ending the unlimited free ride. Most (all?) of the major photo hosting sites ended their unlimited free plans ages ago. Clearly it is not sustainable from a business perspective.

(I am not referring to the meme sites like Imgur who host images at a far lower resolution with a far higher compression ratio, which is of course useless for photos.)

Has there been any movement on this front since 2016? I've also heard of these security issues with Mint, since around that time, but it's been four years and I'd like to give them the benefit of the doubt that it's possible they've improved in that timespan, one way or another.

Thank you very much for your analysis and explanation. I was a happy customer and would recommend them to almost anyone, up until a few minutes ago.

There was always a nagging voice in the back of my head - "their backup encryption can't possibly be good" - but I wanted to believe it since their deal is so good, in terms of storage per dollar, and it's hard for me to afford otherwise right now. I did a bit of digging not too far back and their help pages go into a small amount of detail but ultimately just say "trust us". I trusted them to throw away my encryption password after a session, which is terrible, of course. After reading all of your work, I cannot even countenance trusting them anymore.

Ironically the first thing that comes to my mind for offsite backup is Backblaze B2... if you do all the encryption before it leaves your machine, then it doesn't matter what they do, and their storage is cheap. Rclone or similar means that their client software need not be trusted. It's up to whether you tolerate their business practices.

You mentioned in another comment that you are still looking for cloud backup software which ticks all the boxes - why did you not go with Rclone? On the surface it looks great but I haven't tried it yet.

It's not even just that Excel is Turing-complete. It's that Excel is widely used and is its own programming language with a comprehensive standard library, and I don't mean VBA - entering the = character in a cell opens up a massive library of functions which can be used in a fashion sort of similar to functional languages, since everything is nested functions.

There's branching. There's Boolean operations. There's variables (cells, which is ultimately the point of the entire exercise). There's even a switch construct. There's even really simple web requests! All of these are of course functions. The only thing that's missing is function definitions (which can be done with VBA, but I excluded that specifically for the sake of this exercise).

It's not particularly pretty, but is usable by almost anyone, has good documentation, and a huge community of like-minded power users. As you mentioned, Excel doesn't have any of the constructs which help developers for other languages to avoid mistakes. The simple syntax, users which are not necessarily aware of good practices, and a lack of methods to implement such practices produces a perfect storm of factors to introduce bugs.

It's absolutely for the latency, it's almost a faux pas to play the games I mentioned online at a high level without an Ethernet adapter (since there's a decent chance you'll get a match with others who are). Additionally, the Switch is the sole major gaming platform which has avoided the bloat endemic everywhere else; there are no games on the platform anywhere even close to triple-digit GBs in size, or even half that.

For games that require low latency, such as twitch shooters and (traditional) fighting games, a wired connection is indispensable. I don't think the "hardcore" platforms will ever remove it.

Regarding Nintendo, while they've never shipped a console with an Ethernet port built-in, they have supported it since the GameCube (Broadband Adapter); the Wii, Wii U, and Switch all accept standard USB Ethernet dongles. Use of these adapters is somewhat widespread on the Switch, particularly for Mario Maker and Smash (although this is more due to Nintendo's incompetency with netcode than inherent latency in Wi-Fi).

my favorite part is the PS5 consumer friendly expandable storage

This is a pattern, the PS3 and PS4 both had end-user accessible bays which contain a 2.5" HDD. Any drive can be formatted even from blank using the console's safe mode.

the XboX overpriced and proprietary SSD cartridges

This is also a pattern. The original Xbox and Xbox One had internal hard drives that were not end-user serviceable. The Xbox 360 used 2.5" HDDs in cases. The original 360 drives had a special port on the cases, for whatever reason. The 360 S/E drives used regular SATA connections, it's plainly obvious looking at one that the connector is just the edge of a 2.5" HDD.

The PS4 has one of my favorite little touches like this. Accessing the 2.5" bay on the original PS4 is done by sliding off the cover of one of the four quadrants. The HDD caddy is held down by one screw. Not sure about the Slim and Pro, but on the original, it's a Philips head screw, but not just any Philips head - it's wider than necessary so that they could etch their trademark four symbols on it.

This is a custom screw that 99.9% of users will never see (guessing at that number of course) but they put it in anyway. That must have been a lot of work.

Epic did for a time only distribute their game through their launcher, available only as an APK from their website, but they eventually capitulated to Google's policies and listed Fortnite on the Play Store. They did this because it is evidently not realistically possible for a commercial app to be distributed outside of the Play Store and reach a critical mass of the Android userbase, whatever the cause(s) may be.

Google has made the process of installing alternative app stores obtuse enough that general consumers might not do it. It's not that obtuse, especially to readers of this site, but it looks as though it's enough. There's also the restriction that app installs and updates cannot be done in the background.

Another possibility, or perhaps in addition to the above, is that the general public never goes outside of default app stores to search for games, or is never persuaded to do so. It's the path of least resistance to only use the one(s) included with the phone. Fortnite is the one attempt at a massive enough scale that could have broken this pattern, but it didn't, even though they had Fortnite on all the other platforms to use as an ad, which targets exactly the people most likely to jump through the hoops.