scottmotte

Cryptographic systems are mostly designed for machines, not humans. We end up staring at long strings. I wanted to experiment with how to better visualize them - in a more human way. The result is KEYSEE⎔. Try it out and hope you enjoy! There is also a whitepaper that goes into more details (under the /api section).

If you did 'dotenvx run -- env', all your secrets would be printed right there in plaintext

Same for sops.

The equivalent in vercel would be encrypted in the database (the encrypted '.env' file), with a decryption key in the backend

The encrypted .env file is actually committed to source code, and the decryption key is placed in Vercel's environment variables dashboard. The attacker only gained access to the latter here if using dotenvx so they can't get your secrets. Unless they also gained access to the codebase in which they have terabytes of data to go through and match up private keys from the database with encrypted .env files from the source code exfiltration - much more effort for attackers.

Creator of dotenvx here.

There is no silver bullet, but Dotenvx splits your secrets into two separate locations.

1. The private decryption key - which lives on Vercel in this example 2. The encrypted .env file which lives in your source code pushed to Vercel

Attackers only got access to the first (as far as I know was reported). So your secrets would be safe in this attack if using Dotenvx. (A private key is useless without its corresponding encrypted .env file. Attackers need both.)

The whitepaper goes into the problem and solution in more detail: https://dotenvx.com/whitepaper.pdf

Encrypting your .env file with dotenvx, or something similar, can help mitigate this need for trust.

developers could still potentially commit private keys the repo or commit the decrypted env file

to prevent this, use:

$ dotenvx ext precommit --install

I've tried all four, and Render is the closest experience to Heroku. It still isn't as easy to use as Heroku, but it is close.

people are most comfortable being around people like themselves

Inertia. This is everything. It takes effort to be around people unlike those currently around you.

We all have personal biases against the strata economically above us and below us. I think most of the individuals that move up economically are able to get beyond these biases for one reason or another. Otherwise, even the most hardworking individuals tend to self-sabotage when they start to feel out of place.

I love the look of the Punkt. I ordered one 3 years ago but because of delays, and then Covid, gave up on receiving it. They issued me a refund but I'd still like to get one - in a reasonable amount of time.

Anyone have one and like it? Or recommend a different dumb phone?

1. On twitter

2. Start building. It will attract people. Don't go out and find them.

I posted this myself as well a couple days ago.

I was personally interested in HCQ before Trump ever tweeted it - turning it political. It was looking promising and still does.

After further personal study, I would like the conversation to continue.

Generic drugs [1]

[1] https://energycommerce.house.gov/sites/democrats.energycomme...

Yeah it would be great to see some numbers from anyone who might have them. I'd put money on SPAs being slower, inside the bell curve than, than the average traditional page load app.

Why hasn't someone built an email system that only accepts signed payloads?

Email would only be allowed into my inbox if it was signed. Then, layer 2, it would only allow signed emails from senders whom I've accepted their public key.

A separate tab would show me all incoming request to accepts public keys (request to send email)

Now to opt-in to a marketing email I first accept their public key. To opt-out I delete their public key. Their email now goes to /dev/null.

Senders wouldn't have to re-implement unsub/subscribe, spammers would be /dev/nulled, and we could later add encryption on top of signing as a requirement.

I wish there was a standardized or common methodology for classifying notifications. App developers could adopt this and consumers could take the pattern with them across all types of interfaces - desktop, smartphone, speakers, tv. Maybe someone knows if any government entity or force has a methodology for this?

That's a novel thought. I imagine then the native mail apps would expand in settings in order to block some bad senders from abusing that email header.

Tangentially related, iOS mail app has a VIP setting.

[1] https://support.apple.com/lv-lv/HT207213#vip

I believe that is for the all-in-one option. And I do not believe Authorize.net offered that a decade back. Anyways, if you already have your merchant account, it is only 10cents a transaction.

That brings me back. I remember Authorize.net before there was the ActiveMerchant gem (ruby).

Have you used Stripe as well? Authorize.net always got the job done. Then Stripe came along. I was honestly surprised of its success at the time. It was mainly just more of a joy to use - not cheaper or much easier. Just 'fun' as I remember it.

Doesn't Google Analytics support this using user IDs?

Novel and I like the mental model. It seems like this pushes more of the management to the user - to manage the key. Or providing the user nice consumer tools to manage the key - adjacent to your core product. The hard part here is probably getting consumers to use/download/install that tool.

my mistake. this was already posted 2 days ago here: https://news.ycombinator.com/item?id=22119832

Let's say I'm the NY Times and I host a page on my server at nytimes/2020/01/22/some-article. 1 hour later I realize I got one of the facts wrong, so I modify that hosted page on my server.

I'm not making HTTP requests here, but, to your point, I am mutating the document at that url.

Maybe the protocol would somehow store the diff between those 2 documents somewhere. There could be an organization, similarly structured to ICANN, that stored and surfaced those diffs long term to users.

I wonder if it could be even more effective to release a new search engine that searched only pages inside this definition?

Daniel's sentiments resonate with me. I would add 1 additional restraint:

4. Every document is version controlled

That way, as Daniel puts it, "[the document] will not magically alter its contents tomorrow". Or if it does, I can see a history of what was altered. Ideally, this would somehow be built into the protocol/browser rather than be a burden to the publisher.

Also, maybe after a certain amount of time I can no longer modify my document. If I'm the New York Times, this means when I publish a news article document, and it contains an advertisement, that same advertisement forever lives on that document - just like physical newspaper.

automatically increase the prices of requests by a fraction of a cent to compensate

Great concept.

CPU, bandwidth, electricity, it's all just energy. And to a significant degree, money is just energy stored. I generate energy with my own work, store it in the form of money, and then transfer that energy to someone else, maybe to heat my home or cook me a meal.

Before money, I had to barter for those things. Maybe conceptually the internet is in a similar state at the moment. It doesn't have 'money'. Why can't I put CPUs in my wallet and then spend them? And why can't I charge visitors to my site by the CPUs they are costing me?

Instead, I have to, in a way, barter. For example, maybe I use ad revenue to earn my income, so I generate all this content, I barter that to the search engines, which barter with the advertisers, which barter with me, and I barter back to security guards to protect me from 'bad' actor bots. I'd really just like to receive CPU and bandwidth payments from them.

I've been using MindNode for this.

I've found it very good at letting me quickly transfer my system ideas to paper. It gets out of the way and works with quick keystrokes.

But it breaks down when trying to use it for presentation. It is too difficult to show and hide different states of the system when presenting to others. It's slow changing between each state by showing and hiding different nodes.

I'm looking forward to trying your tool for this reason. I just wish it was a local program.

take on stress

What a wonderful mental model. Thank you for that phrasing.

My tendency, and I think most people's tendency around me, is to discuss stress in terms of how to limit it.

Taking it on changes my relationship to it (at least in my mind). Taking it on, gives me control over it.

  Location: Los Angeles
  Remote: ok
  Willing to relocate: no
  Technologies: Ruby, Rails, NodeJS and much more
  Résumé/CV: http://www.scottmotte.com/assets/resume.pdf
  Email: scott@scottmotte.com

  Your cross-functional engineer. $150/hr.

I'm pioneering a futuristic alternative. The user donates their CPU cycles -> to generate hashes -> to mine crypto currency on behalf of the open source project.

http://opensourcecitizen.org

If you need a way to accept donations worldwide - without a merchant account and without the donor even needing a credit card or bank account - it might be worth a look.

Nice. And for yet another less abstracted approach, check out: http://github.com/rebelmail/node-lambda (also with accompanying blog post: http://www.mot.la/2014-12-07-amazon-lambda-best-practices-de...)

"The funny thing about this proposal is that it is exactly the way my non-technical family members use every service."

+1 to that. My non-technical family and friends do the same.

I spent a month experimenting with this approach myself vs using LastPass. It was actually pretty comfortable - easier than 2 part auth - excepting that sometimes the forgot password links were difficult to find.