Hacker News new | past | comments | ask | show | jobs | submit | Boldened15's comments login

Don’t 2FA apps have the major downside that if you lose the specific mobile device you installed it on you’re SOL, unless you have backup codes that are too technical for most. SMS gets you more human support since you pay your carrier, I can walk into my nearest teleco branch with my ID if I lose my phone and change the SIM to another phone. So most of the time unless your SIM is hijacked it’s a good proxy for being actually you.

Plus having to download another app adds friction to the signup process and most users aren’t going to bother, so for most it’s SMS 2FA or nothing. Since apps often want your phone number anyway for bot prevention, and users are used to verification codes, it’s not a big deal.

Also a tail end of other issues with 2FA apps (and SMS 2FA predates the nice ones anyway); in other countries there are devices other than iOS/Android to suggest an authenticator app for, limited network speeds and device storage, etc. Heck, I know people in the U.S. with full device storage who can’t download new apps without deleting some stuff. If you’re a random app and not a tech company SMS 2FA is just going to be much easier to implement.


The whole point of 2FA is that once you lose possession of your physical second factor, you lose access. If you can maintain access after losing the hardware, you've just added a second password. SIM swapping attacks have proven very effective at showing how easy it is for someone to bypass SMS 2FA. It's better than no 2FA, but it's the worst second factor out there.

If you don't want to lose access after losing your second factor, you don't want two factor authentication. Trying to make 2FA something it's not only muddies the waters and makes things annoyingly confusing.

I don't think "I know someone whose phone can't handle a 2MiB TOTP app" is a good reason not to offer real 2FA on a website. Sure, offer SMS codes for people who don't care much about security beyond ticking auditor boxes.


>I can walk into my nearest teleco branch with my ID if I lose my phone and change the SIM to another phone.

And I can do the same pretending to be you, or simply bribe the minimum-wage cashier who doesn't really care.

Do they even have a flag for highly sensitive accounts, e.g. set off an alarm if someone tries to issue a new SIM for the President?


I would count is as decentralized enough if there are a few major players, you have Google, Microsoft, I assume Proton Mail works fine though don’t know as I only use it for burner accounts, iCloud Mail including Apple’s cool private email relay thing. (Maybe other countries have big providers I dunno.) You can use your own domain and switch between providers if needed, and use custom email clients… it’s all the benefits of decentralization to the end user.


Yeah I'm no expert in financial systems but since the money ultimately needs to be spent in the U.S. it doesn't seem that important whether the funds are frozen in the U.S. or locked away overseas and can't be transferred in for the next ~4 years.


It's much more than that, foreign banks will comply with US court orders, it's not just a blockade.

US courts shut down a series of Swiss banks that were trying to hide American's assets behind the swiss banking secrecy laws while also doing business on American soil (just having bank employees in the country did it).


> since the money ultimately needs to be spent in the U.S. it doesn't seem that important whether the funds are frozen in the U.S.

Of course it does. The hypothetical we're considering is the administration illegally freezing bank accounts. You don't need something legally impenetrable. Just complicated enough that it slows down the goons while you fight them in court.


The Wikipedia article has "deprival of the rights of individuals and parties from running for election" listed as a method. So I assume the prison/fine part of the sentencing wouldn't really be defensive democracy but barring her from office is. (Don't think I would feel positively about that in the U.S. but nonetheless the concept is there.)


At some point we have to trust the electorate whether we like it or not, or democracy is impossible. If the populace is easily brainwashed by the media to believe in the innocence of a corrupt and extremist candidate they could just as easily be brainwashed on any issue or candidate so what's the point of letting them vote at all?

> Usually these people are friendly to capital as well, and the opposition are the "little people"

Don't know if this is actually true, I assume capitalists generally prefer stable market-oriented politicians and not far-right kleptocrats in favor of protectionist trade wars. And plenty of wealthy people value democracy for its own sake, Kamala outraised Trump in the 2024 election for example.

Also I doubt traditional media spend plays as large a role in a nationwide contest with a lot of eyes, if I recall during Trump's 2016 primary candidacy Fox News tried to go against him but was rebuked by their own viewers (who fell in love with him on social media) and forced to bend the knee.

Cults of personalities are more dangerous than other types of brainwashing though, and the right level of protection from the state here should be other checks and balances on the office's powers.


I'm starting to think that current forms of democracy have become outdated and impossible due to the effects of social media and the levels of wealth concentration. When liars can spread their own truths through social media, and there exists such concentrations of wealth that they're able to buy the platforms, manipulate the algorithms, use bots etc. to boost the lies, it's become too hard for the average person to figure out what the actual truth is and base their decisions on that. The fact checking and bias in dispersed traditional media that we used to have was not perfect, but it was better than what we have now with the combination of concentrated traditional media and social media.

If we don't want to use the state to protect democracy by limiting it, then we either need to limit the concentration of wealth so that no small group of people has the power to spread the lies, or we need new forms of democracy that are resistant to such things.


That is all true but in this case she was sentenced to 2 years prison and 2 years house arrest, it's not exactly locking her up and throwing away the key for a minor infraction.

Letting judges bar someone from running for office is silly though, if French law allows that they should reconsider; if someone is popular enough to win a national election despite a reasonable criminal conviction they are popular enough to threaten the civil order if they are barred from office.


I mean that, in general, criminal laws can be interpreted to take minor wrongdoings and turn them into serious crimes. I’m not saying that was the case with Le Pen.

In fact, I think the conflict between law enforcement and politics in the Le Pen case is largely self-inflicted. There was no need to include the constraint on running for office in the punishment. And it seems like the wrongful conduct ended in 2017. Why did it take so long to work through to a verdict?


It is a funny fact though that Le Pen herself was pushing for automatic ban on running for elections for the stuff she did.


Some are kind to eng ICs, you’re not laid off from the company just given time to join another team. As you can still be a high-performer with context on company culture/tech stack while on a non-revenue-generating team.


Sorry I don't get the example, are both code blocks meant to be client-side code?

> It acknowledges the reality that a non-exhaustive enum isn’t really an enum. It’s just a list of things that people might type into that field.

I would say the opposite, the kinds of enums that map a case to a few hardcoded branches (SUCCESS, NETWORK_ERROR, API_ERROR) are often an approximation of algebraic data types which Rust implements as enums [0] but not most languages or data formats. Since often using those will require something like a `nullthrows($response->getNetworkError())` once you've matched the enum case.

The kind of enum that's just a string whitelist, like flavors or colors, which you can freely pass around and store, likely converting it into a human-readable string or RGB values in one or two utils, is the classic kind of enum to me.

[0] https://doc.rust-lang.org/std/keyword.enum.html


Since speedrunners who find glitches are obviously very technical, do they usually already have some sort of day job in tech? I imagine it might be easier and just as lucrative to work on some CRUD app 9-5 and devote the rest of their time to research/streaming, and may be preferable to overloading their brain with even more of the same kind of research.


I know a speedrunner who turned down a promotion beyond their data job because they were in a role that they already had automated a large chunk of, and wanted to stay in it so they could keep pretending to be busy at work while instead practicing speedruns.


As an n=1 data point, that was my exact situation for a while. Also a lot of the people who put out high effort stuff are college students, which works for the same reason.

More interestingly and more surprisingly, some of the people who work on exploiting games _don't_ do any sort of tech work and have no background in compsci - they're purely self educated just for the sole purpose of breaking the one game they're interested in. This was the case for some of the biggest contributors to ACE in Zelda Ocarina of Time.


Since Netflix never (edit: rarely) releases Blu-Rays for their original content, there's no source to produce high-quality versions of their 4K content right? Could be wrong but I thought webrips that screen capture are relatively low quality because they're reencoding a video that's already being compressed for streaming.

Don't know if I notice these things much personally but if someone already cares about 1080p vs 4K they probably would.


The scene has ways of getting the data without reencoding. Look for web dl.


This is still far less bitrate than the equivalent BluRay. Netflix dropped their 4k bitrate during COVID and never looked back.


This is the difference between “rip” and “DL”. You can certainly pull content from Netflix without re-encoding.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: