HN user

starfox64_

61 karma
Posts0
Comments25
View on HN
No posts found.

4.2 Safety measures taken by the manufacturer

I would have hoped for Boeing to add a warning system in the case of dual input, like in Airbus aircrafts, but it seems they did the bare minimum here. Simple warnings were added to the pilot hanbook that basically amount to "don't apply opposite inputs".

It's kinda sad that the website doesn't prominently display which features have "universal" support across iOS and Android. The whole point of PWAs is to provide cross platforms apps so if a feature isn't available on all/most platforms, I don't think it's fair to say that it's really usable at all in your PWA.

I think it's a good initiative, it's obviously there for CAs to make a buck but it's finally a way to arguably curb phishing emails that rely on similar domain names or IDN characters all the while making your brand identity more prominent.

It seems to also have learned from one of Extended Certificate's shortcomings by relying on trademark instead of company name. I actually wish something similar was created to replace EV certificates as it's easier than ever to perform phishing attacks now that everyone and their grandmas has a DV certificate on their site (which is a good thing).

I've had a similar issue with MongoDB's ObjectIDs. They are generated using a combination of process id, UNIX timestamp and a counter that is randomly initialized during process creation. The issue when docker comes into the mix is that the root process id of every container is 1 so a decent chunk of entropy is removed from the ObjectID. Add to that the fact that the timestamp doesn't have millisecond resolution, the only thing saving you is praying the counter of any of your processes never overlaps during the same second.

It's unlikely to happen but still possible and it has brought down some of our parallel worker pool because once you have a collision, you are bound to keep generating the same id sequence until you restart your whole process to randomize the counter again.

I was very excited at discovering this protocol thinking it could solve a few pain points of our domain onboarding process.

However the fact that you need to go to every domain provider to get your template manually approved makes this completely useless, what even is the point? This barely adds any security too since I can just use each provider's official API and create whatever records I want this way.

It's really sad because the protocol is designed for auto discovery but then does a 180 by having this manual step.

This reminds me of when I took over a project after a developer that left they company.

They had just added SMS notifications to production but to my horror left some test code that would text you "Hey motherf**r" every time you would change your phone number.

To this day I still wonder how many people got that text.

Unless I'm reading this wrong, this lacks a lot of granularity. I'd like to be able to only give access to a subset of my vault, not all of it. I'm of the opinion that my accounts should just disappear with me, apart for some things related to real life like utilities and the likes. Come to think of it, my GitHub account could be worth preserving too but right now I can't think of much else being worth it.

I doubt many banks would refuse a charge-back considering this transaction obviously didn't use 3DSecure since it went through PayPal. You'd probably get your PayPal account shutdown if it went through though.

It's not stated clearly in the official publication but it seems that their medium term goal, beyond using this on government websites, is to also allow private companies access to the tool.

It'd be pretty useful as a way to standardize the way various companies do identity verification online.

I'm honestly pleasantly surprised to see such a thing coming directly from our government, as it can be sometimes quite outdated.

They have different pricing depending on the type of storage medium (Phone/USB Drive/Regular HDD)

https://www.copiefrance.fr/images/documents/tarifs_FR_2019_0...

Looking into it, it seems to not be considered a tax as it's not collected by the government, it also states that if you are importing a drive from a country that also collects such a "tax" you should seek to be reimbursed from the exporting country and pay the "tax" to the importing country.

Their FAQ: https://www.copiefrance.fr/fr/ressources/questions-reponses

Yes, you would probably then have to allow inbound traffic to these addresses in your ISP router's firewall or whatever you have.

If your router's default configuration is sane it should (by default) only allow returning connections and drop any other.