Hacker News new | past | comments | ask | show | jobs | submit | immibis's comments login

One service at a time.

I set up Postfix to catch *@immibis.com. I use it for some less important things - first mailing list subscriptions, then I even used it to buy festival tickets. These are lower-risk things. If they don't work then it's not a big deal. In the latter case I'd be out $200 and not be able to go to that festival (which did actually happen, but not because of my email server, but because they tried to invent a hidden fee after I already paid, and I'll have to go to small claims court to get a refund). Now that I know it works, I use it by default for new less-important account signups. (And nobody's questioned me yet why the local-part of my email address is the name of their business)

I still wouldn't use *@immibis.com for my bank account. I'd use gmail for that. The bank is a corporation. If there's a problem between them and my email server, they'll tell me to suck it up, then delete my money. If there's a problem between them and Google's server they'll be forced to fix it. If there's a problem with my Google account, I can go to the bank office and say "Google banned me from Google, so I need to link to a different account" and they'll have a procedure for that. They won't have a procedure for "your mail server sends LF when it should be CRLF" or whatever weird issue could occur between them and a self-hosted mail server. But if my bank account was the last thing remaining on Google, in practice, it would still be a successful email de-googling. 99% is a pretty good success rate. The bank app runs on Android, anyway. Could switch banks and only do banking in person.

I find Youtube a good source of entertaining and informative content (certainly way better than something like Instagram) and I haven't replaced that yet.

After Mozilla jumped the shark and declared they hate privacy, I've been gradually moving things over to Zen Browser, which is based on Firefox. (I don't care that Zen isn't significantly more private than Firefox; I care there's someone in between me and Mozilla and that isn't Google)


A mailing list is just a kind of public group chat. You're probably in many public group chats, including this one right now. Mailing lists, IRC, traditional web forums, Discord, WhatsApp are all implementations of the same basic concept.

Like any implementation, it comes with certain affordances which differ from other implementations.

Messages feel "heavy" for several reasons: sending one involves a lot of clicks (or keypresses); if you send a very high number you may be banned from your email provider, and unable to communicate with anyone.

Messages often arrive instantly, but can be delayed up to hours or days, so conversation round-trips are kept to a minimum.

Messages are all the same - there are no "lite messages" such as emoji reactions - so any message must contain enough content to justify being a full-fledged message, or it won't be sent at all. (Sometimes an "emoji reaction" is felt to be enough content to justify a full-fledged message, which is sent.)

Being off the web increases the barrier to entry, reducing the eternal september effect (ironically, Usenet is one of the least eternal-september-ish of the public discussion boards currently in existence).

Overall, the feel of the system tends to somewhat discourage quantity and encourage per-message quality.


> Messages are all the same - there are no "lite messages" such as emoji reactions - so any message must contain enough content to justify being a full-fledged message, or it won't be sent at all. (Sometimes an "emoji reaction" is felt to be enough content to justify a full-fledged message, which is sent.)

Haven't you heard about the abomination which is Office365? They recently bolted emoji reactions onto email!


Open source does have a problem with inertia whenever one piece of software ends and another piece is created to replace it, but there's no immediate incentive to switch, because it is a switch, not an update.

Though conversely, when someone buys the trademark for an existing piece of software, and replaces it with something entirely different, like what happened with Audacity, that's also bad. So there's no good solution.


> Though conversely, when someone buys the trademark for an existing piece of software, and replaces it with something entirely different, like what happened with Audacity, that's also bad. So there's no good solution.

I've followed the Audacity situation over the last few years. Before the Muse Group bought the rights to the trademarks and took over development, Audacity development had pretty much stagnated.

The new developers did not replace it with something entirely different. What they did was fix longstanding bugs and add new features/enhancements (and changing the way some things work, for better or worse). Sure, they introduced new bugs here and there with the new features/enhancements, but last I checked they fixed those. And yes, they could have done a better job at marking new versions as "beta" rather than pushing them out as stable releases (old hands know to avoid a new version until a couple minor versions later). That's really my biggest gripe with their development/release process.


They are completely redesigning the UI to such an extent that it may as well be a completely new project.

Also, how come open source names can even be bought? They should be open, of course, so I think it'd be fair enough if they wanted to call theirs "MuseScore Audacity" or something like that.


The good solution is rock-solid, backwards compatible APIs on all levels. That way the work to maintain software would be much lower, making it possible to focus on doing some rare bug-fixing only. In open source in particular this should be a no-brainier, instead of all projects ruining things for each other by ignoring backwards compatibility.

The rock-solid backwards-compatible API would include, for example, being invoked with the command "screen -x", and being installed with "apt install screen" - at which point it's the same screen project under different management, not a new project.

I was referring to the APIs required by screen itself to run. If screen is anything like any software I know anything about a fair amount of limited developer time has to be wasted on keeping up with random third-party stuff changing/breaking. Even if that is not the case, if we get more stable software in general that would mean maintainers of free software could take on more projects each, meaning there would be a higher probability that someone could be around to fix bugs in screen.

Isn't this what distros are for? So e.g. Debian could decide to replace screen with tmux, possibly with some sort of compatibility package that takes all the same command line arguments as screen but uses tmux under the hood. (I've used screen very little and have never used tmux so I'm not sure if that would make sense in this context).

You generally can’t transparently replace a tool by a different one like that, siblings are giving examples of where there would be incompatibilities. There would also be much upheaval among users if a distribution would try to underhandedly perform such a replacement. If anything, a package “tmux-as-screen” could be provided for those who want that.

> If anything, a package “tmux-as-screen” could be provided for those who want that.

To be clear, that's what I was imagining. If you had a shell script that called screen, it would now work via tmux, but no one would be "tricked".


In that case, nobody would be tricked because they would have to explicitly select that package. Those already having screen installed, or selecting screen for installation, wouldn’t automatically be upgraded to tmux-as-screen. So what the comment you replied to mentioned as a problem of inertia and there being “no immediate incentive to switch” would remain largely unaddressed.

Well, I guess the other part would be removing screen from the official repo. So the original utility is gone, but we have a compatibility package you can install that should make things work like they used to. (Of course, if you really still want screen you can build from source or some such.)

A smooth transition from GNU screen to tmux, will be appreciated for potentially 60K users.

https://qa.debian.org/popcon.php?package=screen

I note that tmux has only 40K users (of debian popcon users)

https://qa.debian.org/popcon.php?package=tmux

I am considering to try the link shared previously:

https://github.com/grml/grml-etc-core/blob/master/etc/tmux.c...

Now I miss a way to translate CLI options and batch files


You can reconfigure the key-bindings, that I guess would be the largest annoyance for a new user. But there are many fundamental differences between them that you just can't hide.

Tmux doesn't support serial ports.

I'm not sure what made "screen" integrate the two separate pieces of functionality - you can use something minimal like "tio" for serial port access and it's much more elegant.

It's not separate functionality. The back end (so-called "master" side) of a pseudo-terminal is almost (bar initialization of line speed, hardware flow control, and framing settings) indistinguishable from a "null-modem" call-out serial port or parallel port terminal device. Write a software terminal emulation program for the former, which of course is what screen has, and you already have one for the latter.

It isn't separate functionality. Terminals connected via serial port is a valid use case for a terminal multiplexor.

In theory you're correct, but by that logic you'd also have to add ssh (probably by far the most common way of connecting to a remote terminal today). I guess you'd end up with something like mobaXTerm which is a valid approach for sure, but doesn't compose as well.

Personally I live by the maxim "if it can be separated without significant drawbacks, then it should be separate" but GNU tends to see it differently.


What is a serial port and what do you use it for?

When most people use the term "serial port" they're referring to a DB-25 or DE-9 port you find on older computers or USB dongles. It's also seen in 8P8C (aka "RJ45") form sometimes, especially in industrial equipment. It can send and receive "characters" (anywhere from 5-8 bits each) one at a time at a fixed rate, either half duplex or full duplex. They usually implement one or more of the RS232, RS422, or RS485 standards.

Originally, you communicated with the computer using a teletype or video terminal connected to a serial port. Whatever you typed went to the computer, and whatever the computer sent back was printed on your terminal screen (or paper in the case of a teletype).

The UNIX (and thus, Linux) command line environment still works this way, except the serial line is virtual.


It is a port that has two data lines, RX and TX, and data is sent in a serial fashion across those data lines. It is used today for embedded systems, routers and switches et al, and getting a console on any machine that doesn't have a gpu with a monitor attached.

USB is a serial BUS, which allows multiple devices; serial ports are single device (if my memory serves).


console=ttyS0,115200

I'm sure a rewrite of screen in Rust will be 105% secure. And won't support serial ports either.

I am banned from GitHub because I didn't want to give them my phone number. They ignored a legally binding GDPR request to delete all my data. I haven't got around to suing them yet.

Recently I also got "rate limited" after opening about three web pages.

Microsoft can do something to you, and that is to arbitrarily deny you access after you've built a dependence on it, and then make you jump through hoops to get access back.


> Recently I also got "rate limited" after opening about three web pages.

People who haven’t used it logged out recently may be surprised to find that they have, for some time, made the site effectively unusable without an account. Doing one search and clicking a couple results gets you temporarily blocked. It’s effectively an account-required website now.


Just opened a private window to try this, I did one search and clicked on four results, then a second search and got a 429 error. That is wild. I guess it's an anti-scraper measure?

Given the occasional articles that crop up showing the sheer volume of badly-behaved (presumably) AI scraper bots this makes all kinds of sense.

I can't find it now, but sometime in the past week or so I saw something that (IIRC) related to the BBC (?) blocking a ton of badly-behaved obvious scraper traffic that was using Meta (?) user-agents but wasn't coming from the ASNs that Meta uses. The graphs looked like this ended up reducing their sustained traffic load by about 80%.

Items where I'm doubting my recall (since I didn't find anything relevant doing some quick searches) are marked with (?)


Thanks. I didn’t realize that. Migrating repos tonight.

They no longer allow sorting by number of stars in the search without being logged in either.

I have never noticed that and am rarely logged in.

Weird. Maybe it just hates my last two ISPs (Google Fiber, Frontier).

The usual way I notice I'm not logged in is by getting blocked after interacting with ~3 different parts of the site within a minute. If I search, click a single repo, and stay in that repo without using search, it seems to go OK, but if I interact with search and then a couple repos, or search again, temp-banned.


You don't need a Github account to `git clone https://github.com/some/repo`

At least you had the choice. Many potential contributors live in countries to which GitHub does not support SMS verification but still requires it. So there's a second tier of effectively blocked countries besides the officially sanctioned ones.

When did they ask you for a phone number? Last github account I set up back at the end of February didn't ask for one and does the mandatory 2fa step using a code sent via email.

This might be a country-dependant thing.


They nagged me for a year for a phone number, threatening lockout. I finally gave in, so they almost immediately started nagging me to disable SMS 2FA because it is insecure.

This is kind of a weird hill to die on, but you’re well within your rights, so you do you.

However, it is clearly not correct to say that you were banned from GitHub. It’s like saying “I was banned from Google because I refuse to use computing devices.”

Not really a ban, just self flagellation, which, again, whatever works for you.


Give me your social security number or you may not reply to my comments. If you don't give me your social security number, choosing instead to die on this weird hill, it's not correct to say you're banned - you're merely self-flagellating.

This seems like a poor argument. I don't like much either having the obligation to give GitHub my phone number, but it's not the same thing as a social security number, now is it ? Would you argue otherwise ?

Not US but phone number is arguably worse: You can't legally get one without tying it to govt ID anymore and tends to be tied to your current physical location.

A phone number given to a generally reputable company is hardly equivalent to giving a rando your social security number.

I mean, obviously you disagree with them being generally reputable, but you must realize that’s not a broad opinion, and they are certainly better at preventing data breaches than the average company that stores phone numbers.

Sincerely though, I hope you get your GDPR request sorted.


> generally reputable company

Are you talking about Microsoft here? https://en.wikipedia.org/wiki/Microsoft#Controversies


Hence the qualifier “generally”. I’m not saying they’re above reproach, but I am saying that companies that care far less about data security already have my phone number, such as most/all of my utilities - including my phone company. And those aren’t realistically optional.

> but I am saying that companies that care far less about data security already have my phone number

Not mine and it sucks that this means I'm not welcome as FireFox contributor anymore unless I move countries just to register a monthly contract for a dedicated GitHub-accepted SIM card.

Once you trigger phone-number verification requirement your account is globally shadowbanned and support blocked pending SMS code verification. Aside from the privacy issue it's completely blocking people in the several countries (beyond the ones offially totally banned due to sanctions) to which GitHub won't even try to SMS/call.

Remember that registering a second account would be violating GitHub ToS.


> companies that care far less about data security already have my phone number ... including my phone company.

Far less than these?

https://news.ycombinator.com/item?id=40592789

https://news.ycombinator.com/item?id=12305598

https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Privacy...

This is unlikely.


The bar is a lot lower than you think.

Programmers haven't been able to rely on CPUs getting faster for the last decade. Speeds used to double every 1.5 years or so. Now they increase 50% per core and double the number of cores... every 10 years. GPU performance has increased at a faster pace, but ultimately also stagnated, except for the addition of tensor cores.

Just yesterday I applied for several job postings for building European Sovereign Cloud at AWS as well as other companies doing a similar thing. The tariff disaster was a global wake-up moment. Don't expect all of these things to remain US-only.

BTW Europe is already the center of the Internet at layer 3. Servers are cheaper in Europe. Bandwidth is cheaper in Europe. So I assume all those services, especially the free ones, are only hosted in the US because of latency or national pride.


Is self-destruction a soft transition?

Because if it had redundancy, that would be a sign to the FAA that it was important. If it was important, the FAA would make them teach their customers and pilots about it.

Obviously the problem here is the fact that aeroplanes are regulated.


Protests do not accomplish political change, have never accomplished political change, and will never accomplish political change. They are good for one thing and one thing only: meeting other people who are just as angry as you about something. From which you might decide to take actions that actually cause some political change.

Is there any reliable way for political change that doesn't require sharp metal surfaces ?

> Protests do not accomplish political change, have never accomplished political change, and will never accomplish political change.

France's "yellow vests" or Germany's "Pegida" might disagree with you on that one. Both were pretty darn effective.


Citation needed on their effectiveness.

yeah sadly i think they couldn't reach very high, at least materially, even though a lot of people gave a lot of themselves to do so. they achieved a lot of recognition socially though

As I said

> They are good for one thing and one thing only: meeting other people who are just as angry as you about something

Also, Pegida was Nazis protesting that there wasn't enough Nazism happening, so I don't know why you bring them up as an example of a successful protest.


I only meant it for french yellow vests, not pegida (i didn't even knew about them before this)

Correct: the article has not been written, and therefore, need not be read.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: