codalan

It sucks Yubikey (or other hardware based auth) isn't more prevalent in the financial/banking world. It helps mitigate a lot of types of attacks:

- No tokens to exfiltrate off a computer

- Avoids keylogger style attacks

- More durable than cell phones

That said, for people that have high amounts of money in certain accounts (> 1m), it might also present physical dangers (e.g. kidnapping, home invasion) for thieves attempting to get access to the hardware key.

In an ideal world, I'd just use Yubikeys for everything. The problem is that it's not universally supported (or only supports a limited number of keys), so now I have a hodgepodge of 2FA app or Yubikeys or, even worse, phone/email 2FA.

The great thing about Yubikeys is that I can associate backup keys for accounts (when they are supported), so if I lose one key, I can deactivate the lost key and use a backup key in its place.

With heavily locked-down 2FA apps, I have to hope I can do a full recovery on a new device, or go through the recovery code process, or start all over again w/ new 2FA codes. If I'm lucky, the app allowed me to have it installed onto a backup device.

It's way more complicated that just swapping in a new Yubikey.

It's only a security issue if you don't secure the cloud storage that's used for backups.

Google Authenticator and some other 2FA apps allow the user to export their tokens to other apps so you don't need to redo TOTP on every website.

The most secure method is to only have tokens on the 2FA device and to avoid using TOTP backup/restore altogether (or manually copy the tokens on a secondary 2FA device). It's a tradeoff between security vs. convenience.

Just got off Authy. They've done everything to trap customers into their broken platform, primarily by never allowing the user to export their tokens, either to file, or to another MFA application.

They also stopped supporting their desktop app, forcing users back onto a single point of failure: the mobile app.

If Twilio isn't going to support Authy in good faith, they should stop holding their remaining users hostage.

Your post is reminiscent of Rogaway's paper "The Moral Character of Cryptographic Work"

https://eprint.iacr.org/2015/1162.pdf

Should this be under Show HN?

https://news.ycombinator.com/showhn.html

Kagi also seems to be built atop GCP. Not a great place to be if you want to compete against Google in the future.

Going to be pretty funny when pranksters start putting airtags into places where they can't be found just to annoy people with unknown tracker alerts.

The worst are the apps that will constantly bother you with an in-app popup to enable notifications, e.g. Goat. They make it come up randomly so you'll accidentally click on it.

Or apps that you pay for (Spotify Premium, Tidal) that will constantly bombard you with marketing in-app popups at random times. So instead of listening and enjoying my music, I can accidentally click on one of these landmines and get redirected to something I do not want.

I cancelled Spotify because of this. Will also cancel Tidal after my trial because they just copying the same ugly tactics as Spotify.

Already had my fill of Pixel 7 Pro problems. The screen failed to register any touches on it, twice. Once within warranty, once outside it. Best I could do is file a claim with my credit card company for a measly $300.

For a $1200 phone.

Had a bizarrely similar experience with the Pixel Watch.

The screen just failed to respond to touch. Wasted an hour figuring out how to get into fast boot mode. After a factory reset, it started working, but it doesn't get much more than 12-16 hours of battery time before needing a charge.

After losing a lot of money, time, and patience, I'm done with Google anything. Their hardware is garbage and they seem to have failed to address these issues with newer Pixel releases. Not sure what the point is of having 7 years of updates when the phone's hardware will barely last one of those years. And good luck with support.

Switched to a Samsung A54, and although it is slower and laggier in some aspects, the hardware is solid and I've been impressed at how clean OneUI is.

Tip: When your Pixel screen fails to respond to touch, you can at least plug in a USB mouse and recover what you can before tossing it into the dead gadget drawer.

Fun fact: So is the braking. There are no hydraulic backup systems in place.

Is there a plan to eventually switch over to self-hosting?

It seems like it might be bad to use a competitor for cloud services, although Kagi is small enough right now to not be on Google's radar...

On my iPhone 13 Pro, calendar notifications will fail, and the alarm clock will fail to ring. No idea why. I need to reboot my iPhone once a week to fix this issue, and it's been this way since I bought this phone a few years ago. No iOS updates has ever fixed this.

I also have issues with the sluggish interface. Some of my third-party email apps takes several seconds to just load the list of messages. They take milliseconds to load on a Pixel.

My lock screen can sometimes take a bit more than a second to unlock.

The browser dropdown will occasionally load the wrong page when I touch the URL.

The keyboard is more wrong than right, most of the time. Out of all the bugs and problems that make the iPhone almost unusable, it would be the terrible, auto-incorrect keyboard.

The analogy that comes to mind is when the auto industry consolidated to just three large players. Quality was never great to begin with, but it steeply declined after that. It took foreign companies to add real competition to the market.

Apple has been in decline for years now, especially since their only other competitors are Samsung and Google.

Sounds like you get it. It's unfortunate more people don't follow this mentality.

And there's no incentive to stop this. When email inboxes turn into marketing dumpsters, it just drives users to WhatsApp/Discord/FB Messenger/Slack/etc. for communication, which is good for those affiliated companies, but is bad for open platforms.

Sometimes I wonder if their mindset is, "Hey, even if only .05% engage w/ the marketing email, that's still > 0%!".

Maybe their mindset should really be, "Hey, we're annoying 99.95% of our users who did not consent to these emails, and > 50% will be turned off to our product and will associate our brand to that of a needy, attention-grabbing parasite".

If I wanted these emails, I would have opted in.

Instead, not only do they automatically opt you in, but they'll re-opt you in after you've unsubscribed. I've had it happen a year or two later; suddenly, I'm back on their spam list.

It's become so bad now that I can't even let a shopping cart sit anymore without getting a nagmail saying "HEY YOU NEED TO FINISH CHECKING OUT NOW1!!!".

That email is the reminder to empty my cart and never do business with them again.

Seriously, STFU and leave me alone. If your sales and marketing team insist on these tactics, you need to fire them and hire people who get it.

Yes

It's not just scrollbars.

It's the elimination of window borders. Aside from not being able to differentiate one window from another similarly colored window in the background, it's nearly impossible to click and hold on anything along the edge to resize the window.

It's the overloading of the title bar with so much shit like search boxes and extraneous buttons that a user has almost no place to grip to move the window.

It's the way that tabbing between text boxes either doesn't behave the way you'd expect, or doesn't work at all.

It's all the tooltips that interrupt and litter the interface and, at times, block out things that you are looking at. And 95% of the time, the information provided in these tooltips are redundant or useless.

It's amazing how much damage these cargo-cult UI/UX morons have done in the past ten years. They threw out several decades of usability pioneered by real HID experts for something that looks pretty but doesn't fucking work for a lot of people.

Applications like Postman, Teams (and pretty much all of MSFT's applications these days), Chrome, and Insomnia should be case studies on how to not design user interfaces. They are about as bad as desktop software gets.

The biggest sin is that this would be a non-issue if these things were configurable at the windowing system level and could not be overriden by app developers. But the trend has gone in the opposite direction; instead of providing more configurability, Windows and Gnome/GTK are actually taking away options that have existed before.

I was a total convert to the Pixel 7 Pro until two weeks ago (check my comment history). Now my phone goes black when the slightest amount of pressure is applied to the center of the screen. Spent over an hour in support hell (and 6-8 hours of backups/migrating to a spare phone/etc) to be told to go to an Asurion center to get my phone fixed.

Had a lot of hope and goodwill lost on this phone. I feel like I paid a premium price (over $1100) only to get shoddy service and a shoddy product that will fail just outside the warranty period. As much as I dislike the iPhone, at least I can walk into an Apple store and get support right away, and not the Google runaround.

Hooking up eGPUs to laptops.

I don't really game, but I would like to have a separate eGPU to hook up to my laptop for ML stuff, rather than have a GPU dedicated to a single box.

It's comparable to the Pixel 7 Pro (212g) or iPhone 14 Pro (206g), but it would be nice to see that number trend downwards. I had a Pixel 4a in the past, and that seemed like a good balance between size and weight.

I couldn't finish the W11 Home Edition installation on my parent's computer without having them create an account, so I just installed Xubuntu on it instead, and probably avoided a lot of headaches.

I'll probably revisit that computer and install Linux Mint with KDE Plasma, and do the same on their W10 machine.

If push comes to shove and they need some Linux incompatible app that I can't get to work with Wine, I'll just buy a used Macbook.

W10 is bad enough and W11 is not a viable option.

A big reason for me to start learning Emacs again is due to the inevitable rot of VS Code. I'm even playing around with Neovim a bit.

VS Code is like milk, but with an unknown expiration date. At some point, it will be spoiled by MSFT injecting their marketing garbage into the experience. This will take priority over improving performance and fixing bugs. And they've already added spyware into the software by default.

I've realized I would have been better off just sticking to Emacs/Vim entirely, where I can rely on my tools for decades to come. They're not constantly changing the UI/UX, because the maintainers of those products are actually doing useful work, rather than busy work.

Google and Apple do things similar on their devices.

I get nagged to backup my Android phone. It's a thinly-veiled upsell to their Google Drive product. There is no way to tell it to STOP ASKING ME. I have an alternative backup system that I use. I will never pay for Google Drive.

The same is true for the iPhone. If you forget to turn off the Apple iCloud stuff on your phone, you'll hit the free limit at some point, then get an endless amount of nagging to BUY THE ICLOUD UPGRADE.

How is this not any different than a popup in Windows nagging me to switch to Edge? Or to buy O365?

The worst part is that none of this stuff have a permanent opt-out. Everyone has adopted the dark pattern of only providing Yes or Remind Me Later as options. It's just endless harassment from these large, bloated companies seeking more rent, rather than actually doing any substantial innovation.

The Dell XPS laptop series (and older Latitudes) seem to be a solid hardware platform for running various Linux distros. I'm running Mint and Arch on some XPSes and Latitudes and they have been very stable. I think part of the reason Linux works so well with Dell machines OOTB was because they used to sell a line of dev-oriented computers to the public, and one of their options was to have Ubuntu pre-installed.

Running Mint on an old MSFT Surface Pro 4 has also worked out very well for me. I was pleasantly surprised when the touchscreen just worked after installation.

If I was looking for a new Intel-based laptop today, I would probably be looking at Framework or System 76. That said, I'm hoping to see more high-performance ARM platforms hit the market in the next 2-3 years, so I'm holding off for now.

Wouldn't a 200% export tax on high water items incentivize the same foreign investors to purchase more cattle operations in the US, ship their alfalfa to those ranches, then ship the meat abroad?

All I really want is cardinal points on the map. So simple, and yet Google doesn't know how to do this.

If I know the orientation of the map, then I can usually figure out what my starting direction is. Otherwise, I stuck with Google Maps fumbling direction until I start moving my vehicle, and by that point, it's already mis-navigated me.

I also hate the way their maps are constantly hiding information, like street names, unless you zoom waaaaaay in.

MapQuest provided so much detail at similar scales vs. Google Maps.

Its value seems to be rapidly declining. I was on lemmy.world and lemmy.ca yesterday and was a little shocked at how many people migrated over there. I don't see how this looks good to any potential investors pre-IPO. The fact that lemmy (the software) exists makes one question how much of a moat Reddit really has.

How is power consumption on Sailfish?

UML was (and still is) really useful when embarking on a greenfield design. Most people I've worked with know some basic UML notation, so when it comes to whiteboarding and refining the design, it makes sense to go with that.

In terms of artifacts for future maintainers? Maybe not as helpful. As previous posters have mentioned, the diagrams go stale very quickly if the engineering department isn't disciplined about keeping documentation up to date. But this is true for any documentation.

Some diagrams (class and activity, in particular) are less valuable as time passes. I can get the idea of the class structure by just looking at the code itself. The class diagram just ends up being a stale representation of the code.

It is unfortunate that UML has developed a reputation as being overly complex. Now I see more ad-hoc diagrams being created, with whatever notation/symbols make sense to author, rather than using a common diagram system that can be read by many.

I think Discord is a stopgap until mods figure out the next platform to move to (e.g. Lemmy).

I view it as more of an addition to Reddit, rather than a replacement.