Hacker News: fvargas

New comment by fvargas in "FastMail loses customers, faces calls to move over anti-encryption laws"

fvargas — Mon, 25 Feb 2019 05:50:09 +0000

I only took a brief look, but I like the premise. The service seems far from something I would trust with handling my email. I still trust Fastmail (for reference). But I strongly welcome more alternatives to Gmail and services which prioritize user privacy. The attempt at monetization strikes me as extremely premature, given the competition. But I hope to see more.

New comment by fvargas in "FastMail loses customers, faces calls to move over anti-encryption laws"

fvargas — Mon, 25 Feb 2019 05:24:20 +0000

Protonmail has also given in and paid out thousands* to criminals who DDoS their systems, no?

*In my original post I mistakenly wrote "millions"

New comment by fvargas in "FastMail loses customers, faces calls to move over anti-encryption laws"

fvargas — Mon, 25 Feb 2019 05:16:48 +0000

> Your 1-year Standard subscription expires on Sunday, February 24, 2019.

Good timing?

Netflix JavaScript Talks – Making Bandersnatch [video]

fvargas — Sun, 03 Feb 2019 03:21:56 +0000

Article URL: https://www.youtube.com/watch?v=WLqc0EX8Bmg

Comments URL: https://news.ycombinator.com/item?id=19067616

Points: 2

# Comments: 0

Basis, with $133M in backing, is shutting down and returning the money

fvargas — Fri, 14 Dec 2018 13:33:21 +0000

Article URL: https://techcrunch.com/2018/12/13/basis-backed-with-133-million-from-top-vcs-to-build-a-price-stable-cryptocurrency-says-its-shutting-down-and-returning-the-money/

Comments URL: https://news.ycombinator.com/item?id=18680649

Points: 1

# Comments: 0

New comment by fvargas in "The Resistance Is Real – Why Side Projects Are So Hard"

fvargas — Sat, 24 Nov 2018 20:33:34 +0000

Thanks for sharing, this looks neat and useful! The pagemarks are an interesting concept. It would be cool if the top progress bar above the document showed, not cumulative progress, but the progress as it maps to the areas marked on the document, which aren't necessarily contiguous. Kinda like the progress bar you have for a torrent as non-contiguous chunks are downloaded. This provides spatial information about what parts of the document have been read.

New comment by fvargas in "His Body Was Behind the Wheel for a Week Before It Was Discovered"

fvargas — Tue, 23 Oct 2018 23:10:52 +0000

Based on the phrasing of the title, I half expected the "wheel" to be that belonging to a Tesla that somehow managed to remain engaged on autopilot for a week... would have been impressive.

That said, what's to stop a situation like that from arising as autonomous vehicles become more sophisticated?

New comment by fvargas in "Ask HN: Best alternative to Gmail?"

fvargas — Mon, 24 Sep 2018 05:51:28 +0000

Fastmail has worked well for me with custom domains. It's nice being able to create custom aliases for when an address is publicly visible e.g. GitHub so I know through what funnel emails are coming from.

Like others have said, the Android app is not worth installing unless you're okay with limited and, in some cases, poor functionality.

I suppose you can set it up with the Gmail or Outlook Android apps? I've never tried, as this defeats the purpose of not having those companies as your email provider :)

Still searching for a good Android mail app...

New comment by fvargas in "Show HN: Fileshifter – Easily convert files and videos between different formats"

fvargas — Sun, 08 Apr 2018 20:28:32 +0000

Yeah, the primary benefit I see is if one fully audits the code and any future updates. Otherwise, self-hosting doesn't confer much in the way of guarantees for security or privacy.

New comment by fvargas in "Show HN: Fileshifter – Easily convert files and videos between different formats"

fvargas — Sun, 08 Apr 2018 15:33:24 +0000

On what are you basing these expectations? Uploading means transmitting data to a third party. One could write a CLI that does just that. One could also write a web app where the processing takes place in the browser and the data never leaves the machine.

The difference is the web app runs within the browser sandbox while the CLI executes with user permissions.

New comment by fvargas in "The dots do matter: how to scam a Gmail user"

fvargas — Sun, 08 Apr 2018 05:56:15 +0000

Why would you broadly assume an incorrect rule? Email address parsers correctly implement canonicalization rules that consider the domain e.g. gmail. It doesn't require any extra work as a developer and the logic is hidden behind the abstraction. But certainly, you shouldn't go implementing arbitrary rules that aren't reasonably applicable.

New comment by fvargas in "Show HN: Fileshifter – Easily convert files and videos between different formats"

fvargas — Sun, 08 Apr 2018 05:22:57 +0000

The creator mentions in another post that the service does indeed upload the data to a server for processing. But, in general, it being a web app doesn't mean it uploads your data any more than a locally run application might. A web app can just as well do the processing in the browser without it ever leaving your machine.

New comment by fvargas in "The dots do matter: how to scam a Gmail user"

fvargas — Sun, 08 Apr 2018 04:54:41 +0000

By canonicalization I'm not saying any arbitrary practice by Gmail or any other email provider should be considered as standard. I haven't looked at the RFC in some time, but I don't believe the use of plus suffixes is standard either. Nonetheless, I believe plus suffixes are more commonplace, generally permitted, and serve a reasonable purpose. For instance, sending email to a user using their email address as provided is a good practice in order to preserve a plus suffix which may aid the user in organizing their email. At the same time, canonicalizing email addresses in a sensible way, e.g. stripping plus suffixes, can be an aid for preventing unintentional, duplicate sign-ups. Just consider a sign-up form on the homepage of a website. It's not uncommon for people to enter their email and password into that form by mistake thinking they're signing in. Additionally, if the website compares canonical email addresses when checking login credentials, then a user who signed up with an email address containing a plus suffix can sign in using their base email. These two situations combined could lead to the accidental creation of a duplicate account if canonical email addresses are not compared during registration. There are some trade offs with this strategy, but as long as the canonicalization is implemented reasonably, I see it as an aid to the user. Note that reasonably doesn't necessarily mean stripping dots.

As for the second point, I consider it a privacy breach if a service publicly associates my email address with their service without my consent. Sign-up forms do this when giving different responses when an email address is registered vs not registered.

As for how to handle it, if a user signs up with a new email address, you send them an email to verify their email address and instruct them to check their email. Similarly, if a user attempts to sign up with an already registered email address, you send them an email letting them know they already have an account and instruct them to check their email, which will provide them with a link to login.

In the latter case, if they enter the correct password, you can just directly tell the user they already have an account, as they've proven their identity.

New comment by fvargas in "The dots do matter: how to scam a Gmail user"

fvargas — Sun, 08 Apr 2018 00:09:15 +0000

The article shines light on three separate failures on Netflix's part:

1. Canonicalize email addresses

Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups.

2. Never leak information through sign-up forms

A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email address exists or does not exist is a privacy breach and a security breach as demonstrated in this article.

3. Never assume ownership of an email address until it is verified

Some services verify email addresses at some point in the user flow, some never verify, and few verify at the right point. The best sign-up flow I've seen is Slack where setting a password is part of the email verification flow and a user cannot set a password and own the account until they have verified the email address.

Thus, sending transactional emails beyond verify your email or reset your password before the email address has been verified opens one up to security breaches as in the case of Netflix.

New comment by fvargas in "Show HN: Fileshifter – Easily convert files and videos between different formats"

fvargas — Sat, 07 Apr 2018 23:25:32 +0000

Just curious, why would you want to self-host it?

One of a Kind, Futuristic, Machined Metal Sculptures by Chris Bathgate

fvargas — Tue, 06 Mar 2018 21:17:59 +0000

Article URL: https://www.chrisbathgate.com/sculpture-works

Comments URL: https://news.ycombinator.com/item?id=16532189

Points: 1

# Comments: 0

Korean internet giant Kakao is launching a blockchain company

fvargas — Tue, 06 Mar 2018 06:50:24 +0000

Article URL: https://techcrunch.com/2018/03/05/korean-internet-giant-kakao-is-launching-a-blockchain-company/

Comments URL: https://news.ycombinator.com/item?id=16527323

Points: 1

# Comments: 0

Another small business complains of counterfeiters on Amazon

fvargas — Sun, 04 Mar 2018 08:56:53 +0000

Article URL: https://techcrunch.com/2018/03/02/another-small-business-complains-of-counterfeiters-on-amazon/

Comments URL: https://news.ycombinator.com/item?id=16513853

Points: 2

# Comments: 0

AR Planes: Discover nearby planes in augmented reality

fvargas — Mon, 05 Feb 2018 12:28:19 +0000

Article URL: http://www.calstephens.tech/blog/announcing-ar-planes#main-wrap

Comments URL: https://news.ycombinator.com/item?id=16308360

Points: 35

# Comments: 8

New comment by fvargas in "Show HN: Online web tools to get your work done faster"

fvargas — Mon, 05 Feb 2018 02:42:34 +0000

Perfectly reasonable. I would then suggest changing it from "Contact Us" to "hello@hreftools.com" to prevent any confusion (Principle of Least Astonishment) :)