codysc

They defeat/bypass smog control systems to either boost power, or literally, just blow clouds of diesel exhaust on demand.

So by that logic, if a tv station chooses to broadcast content that propagates racist misinformation and calls for violence, but the station only does it because that's what they algorithmically determine gives them the most viewership, that it's fine?

While I agree with your points about the clear indication of covid deaths, unfortunately this will have no impact on the debate.

Facts aren't super relevant anymore.

Agreed. In my case, daydreams regardless, I'm not expecting to build a multi-billion $ exit. It's more about building something useful for people, that I can control the direction of, and guide to some kind of "success".

Success here can be a nice side-income, but also just making a solid, valuable tool for customers.

I just watched this last night. A lot of the content will already be well known to the HN audience. There was one big light-bulb moment for me. One of the speakers was clarifying the "If you're not paying then you are the product" idea.

He refined it to, (rough quote), "Changes to your behavior and actions are the product"

That distinction made the insidiousness much more clear than the former statement.

Very true and covid has made this so much worse.

Distance learning is manageable for my kids as they're a little older and I can work from home. But families with younger kids where both parents have to go out to work and can't possibly afford childcare are getting hammered.

As always, the poor get the worse of the effects, and children are really compounding that right now.

I don't think I exactly understand your points.

Using an example of IV reuse in AES-GCM:

The weaknesses resulting from this wouldn't be discoverable with a test like corrupting the password from the first example. If the developer wasn't aware that IV reuse introduced that weakness then they would be using strong primitives but in a way that dramatically undermines the actual encryption.

Not to put words in your mouth, but I assume your answer would be to say that this would be a matter of correctness. If yes, then where I'm coming from is that the majority of devs don't have the skillset to be correct and sometimes wouldn't dive deep enough to discover these kinds of pitfalls.

Yes, the goal was/is to start with a very high level example then get more into crypto specific concerns.

The audience is for devs without any real experience/knowledge of using crypto that might go into it too casually.

>Perhaps surprisingly, implementing cryptographic primitives & protocols requires little cryptographic knowledge.

That's a dangerous statement on it's own. Making proper use of primitives is not at all a simple concept. Developers can absolutely undermine their systems with poor choices/mistakes.

Self promotion: I wrote a blog up on a very high level screw up with type conversions to show just the very surface of how to screw up using solid crypto primitives. Time allowing I want to do more entries on topics within the crypto realm itself. IV reuse, etc.

https://pritact.com/blog/posts/crypto-mistakes-part-1.html

You're not alone. This has always felt scammy. It's a little more gray-area than some of the traditional vapor-ware which was more about driving competition out of business by large players, but still something I try to avoid.

I don't see PBKDF2 as a full footgun, but maybe as the minimally still-acceptable method. When I was building my system for E2E messaging (pritact.com) I started out with PBKDF2 but kept mentally revisiting the iteration count before biting the bullet and switching to Argon2.

Actually it looks like Argon2 is being discussed as of just a couple hours ago https://community.bitwarden.com/t/switch-to-argon2/350/24

Free is a big part of the problem. The existence of free tools in a space, that are paid for with data gathering, crowds out the market for paid competitors that operate in a more privacy friendly manner.

Re: Terms

I read through a good amount and I think they make sense. The short version helps, but that always worries me from a legal standpoint. If we summarize something in a legally ambiguous way have we undermined the original intent?

There are some inconsistencies with how you present the data that I think would help to smooth out. On your summary table. You start with the description being more of a goal for that section, than sporadically start switching to the "short version" of what your terms are.

For me I was hoping that it would be the short-version so I essentially get a comprehensive cliff-notes kind of view.

Also some minor issues with bolding some headers 4. Project Termination 4. Survival

As well as inconsistently formatting the short version. (I prefer the all bold version to help clearly show where the short part ends)

Privacy policies are much easier for me to wrap my head around. What you store, How you store it, and what you do with it.

This clause was a good idea that I will "borrow":

If our corporate structure or status changes (e.g., if we restructure, are acquired, or go bankrupt), we will notify all users so that you may choose to anonymize or delete your private data before we pass on any data to a successor or affiliate.

My version is here https://www.pritact.com/privacy-policy.html which I think follows along a lot with yours in spirit, but just has less ground to cover because of the nature of my platform.

This makes a lot of sense. Providing some kind of categorized/easily digestible format for the policy to fit into. When I was writing mine I tried to be very clear, but my startup is specifically focused on privacy, so I didn't really have much to disclose.

Yes, that kinda HSMish model of non-extractable keys is a very nice touch. I really wish they would add Argon2 though. PBKDF2 is still a valid choice but there are a lot of HW optimized solvers out there for it.

I agree that Web Crypto has a lot to offer. I use it in my latest project.

In terms of it being easy to misuse, I think that applies to cryptography in general, but there are some gotchas lingering in javascript.

Self blog promoting. I just put this out a few days ago on this very subject. https://pritact.com/blog/posts/crypto-mistakes-part-1.html

I've been following your activity because of your strong stance on privacy and very much agree with this post.

In fact SimpleAnalytics is my only 3rd party call from my SaaS site (pritact.com)

What I take from this post is the importance of considering, even on basic web interactions, how much you can chip away at your client's privacy by making easy choices with "free" platforms.

I'm in the same boat with my communication based startup. I'm being very cautious about any third-party interaction and the heavy activity from the stripe JS wasn't compatible with that. I had to take some goofy steps to ensure that the Stripe components were limited to just the payments page and didn't bleed over into anything else.

I've noticed this in myself and others. There is so much novel (no pun intended) stuff happening to everyone now that, I think, there isn't the downtime needed to effectively pay attention/think the way we're used to.

At the end of my day I can usually switch out to side projects pretty easily. But now, that's MUCH less productive.

I carry this thought process over into my current life. When I start with a new technology/language/etc. I try to start barebones command line, text editor.

I transition quickly into more visual / abstracting tools, but that first foray into the guts really helps ground me with a better understanding of what's actually happening.

I think any sufficiently complex system is hostile to reform just through its natural inertia, which in a huge system is a complex and fascinating topic itself.

But when you have truly enormous amounts of money and power at stake and a system that has settled into a certain posture that has concentrated those resources into certain hands...of course it would be very hostile to any change.

As the article states it takes shocks to bring about significant changes and hopefully we can move things forward some as a result of the current situation.

I think that's mostly to build familiarity with the tracks. Many games have done excellent jobs of mapping the tracks to high precision including the backgrounds. So, all the visual cues will translate well to real life.

I've done this myself for some track days (not races) and can tell you it absolutely helps even at my tragically amateurish skill level.

The bit about the lack of a mobile app, and the over-compensating for it was a great illustration of guessing at the importance of features to users. Something I'm dealing with a lot right now as I strip out incomplete features to get to a better MMP. Thanks for posting.

"Azure Dev Ops" is up there too. It turns out searching "Dev Ops" gives a lot of responses not relating to the product. Who could have possibly anticipated that?

Side note, I like ADO. I just hate the name.

I agree with the sentiment entirely, but reflecting on what you wrote it's so strange that we have to call this out as a slightly novel way to do business.

Thanks for posting this. I'm getting close to needing this for a new offering I'm building and have collected a few in my own notes. This is much more comprehensive than what I would have gotten on my own.

Couldn't agree more. I'm continually disappointed in the way enterprise focused vendors deal with their customers.

The big shops have managed to find the optimal way to influence decision makers enough to overcome the damage done to the customer as a whole.

As long as the proper extractable=false options are set.

I'm doing a project utilizing subtle crypto and I'm, right now, doing an audit to ensure I've got that setup correctly everywhere.

I recommend watching The Search for General Tso. It's a documentary following the Chinese in America with the lens being on the the General Tso dish, in a very similar line to the article.