Hacker Newsnew | past | comments | ask | show | jobs | submit | bananskalhalk's commentslogin

Uber is really interesting example, since they started as a legit upscale taxi service, got mad Lyft flaunted the rules and regulations. They finally pivoted to the success story they are now after seeing how toothless the check and balances actually were.


It's really interesting how much Uber was trying to do things the right way, only to then over-correct into being the most devious and underhanded app-taxi company.

But the other company that Uber reacted to was Wingz, Inc, not Lyft.


I am being pedantic and never worked for Uber but I always assumed it was sidecar, I vividly remember them all over the city with their side mirror covers--don't ever recall seeing Wingz, though I am sure the existed.

I would argue it was not even so much that they were doing "things the right way", they were optimizing black car service and pivoted because it was not as lucrative.


What they pivoted to wasn’t lucrative either. I ubered all the time when it came out because pricing was like $4-7 for most trips that would be $30ish or more now. It was fueled on vc money to prime a generation of people going to bars to use uber and it worked perfectly. Now people just reflexively call that uber even when its surging to $60.


It isn't defined in posix. Some bsd:s did split but doesn't anymore, other (which?) does still split. macOS does, linux doesn't. Sun probably did.


Being first might be very lucrative. I might remember wrong here, but instapaper was an iOS only experience (with a kindle addon), and they are still rocking on, and the founder cashed out a long time ago. Every browser seem to have an instapaper built in nowadays, Mozilla even bought a competitior (formerly read it later now pocket?)

So yeah, buildin inside someone's moat might give you a cap on how big you will be able to become and will make you a tenant, but it could still be worth your while.


There is a string replacement feature, and to my knowledge it has been there the whole time.

https://git-scm.com/book/en/v2/Customizing-Git-Git-Attribute... look under "Keyword Expansion" halfway down the page.


Or just the hash from the blob of the file.


You got any source for this? I am only asking since I got the impression rdp was a superior protocol to vnc, nx etc because of the complex handling of graphical primitives. But I know next to nothing about the real technical details.


I've not looked at RDP, but I've implemented the X11 protocol and the VNC protocol.

The problem is that the more complex the UI, the sooner you reach a threshold where "just transmitting the bitmap" is faster and/or less data.

E.g. consider rendering a simple button with X11: You'd "just" send a request to render a rectangle, maybe fill it, and send the string for the label. 2-3 small requests. But then the moment you have a UI with a gradient, a drop shadow for the text, a differently shaped border, a shadow for the border, you suddenly add on enough requests that it's very easy for the numbers to look different. Especially because compressing these bitmaps reasonably well tends to be easy.

Modern X11 clients increasingly render into client-side buffers already because even when using X, that's often better when on a local machine and too few of us use it over the network often enough for that to be optimised for.

Having the option in the display subsystem of picking either based on what will perform best is a good place to be, but the more complex the UI the less often the simple primitives will be worth it.


It's also a non-trivial part of why modern UIs often appear to have higher latency than old ones...


Chilling warm brewed coffee is definitely faking it. And I presume all places selling "cold brew" is faking it so this guy is losing money by not showing off doing real cold brew with his apparatus.


I’m not talking about chilling warm brewed coffee. All you need to make cold brew coffee is soak coffee grounds in cold water. Whether that is in a mason jar or through a thousand dollar complex laboratory setup is entirely an aesthetic choice.

https://www.loveandlemons.com/cold-brew-coffee/


My favorite route to camp coffee is running this GSI filter backwards:

https://gsioutdoors.com/products/h2jo-filter

Put a week's worth of grounds in the bottle, screw on the filter, pour in some cold water, steep for 24h, and transfer to another bottle. If somebody wants "drip" strength they can cut it with water, hot or cold.


The way I've seen it done is with one of those massive plastic commercial kitchen lidded containers, and a softball sized teabag of coffee sold by the restaurant supply company specifically for cold brewing like this. Then they put it in the walk in for a while to steep and sell it after a certain number of hours.


It’s a market for lemons at this point. Unless you can see an expensive apparatus or observe them soaking the coffee, there’s no way to know if it’s correct, and as a customer it means it’s risky to buy if you care about the difference between refrigerated hot coffee and cold brew.


Risky to buy? It's not real estate it's a cup of coffee. And if you're worried about people faking it, just buy a $2 mason jar and make some in the fridge while you sleep.

I don't get the fascination with paying exorbitant prices and constantly complaining when it's next to zero effort to make it at home, cold or hot. And the best part is you get to choose where your beans come from, you don't have to worry about the political slant du jour of the coffee shop, and you can do it all for a fraction of the price even when using the most expensive beans.


> you don't have to worry about the political slant du jour of the coffee shop

I can't say this has ever been an issue for me. Generally, they just want to sell me some coffee.


Yes, risky to buy. In the same way a slot machine has an expected value of 80-99% payout it’s still a bad use of money even if you only put in $5.

If you object to the word “risky” I used it in the sense of “uncertain you will get the value you expected”. Perhaps there’s a better word.


> In the same way a slot machine has an expected value of 80-99% payout it’s still a bad use of money even if you only put in $5.

Why is this a bad use of money? When I go to a restaurant and give them $20 for dinner, it’s not like I’m getting $20 worth of ingredients.

It sounds like you just don’t like gambling?


> It’s a market for lemons at this point. Unless you can see an expensive apparatus or observe them soaking the coffee, there’s no way to know if it’s correct

Presumably the taste should tell you whether it's correct. Otherwise why care if they fake it?


If they "fake it" and it tastes better... then why are you going out of your way chasing some marketing term that tastes worse to you?


I prefer to know what I'm buying before paying for it.


Unless I'm a visiting tourist I'm likely to go back to a good coffee shop many times. Being surprised my cold brew isn't cold brew - both the caffeine content and taste are tells IMO - for one visit isn't life or death here. I just don't get it again.


Caffeine content in the cup is not a good metric. It is one of the most easily extracted compounds and is roughly equivalent across brew types. The beans themselves are a bigger variable in this regard. Even if you are using a roaster's signature blend, the bean composition of that is going to change month to month and year to year. Even beans from the same physical trees will have varying caffeine content depending on agronomic factors.

In the same cafe on the same day, the reason different drinks have noticeably different caffeine content comes down to the different doses and concentrations they end up using. E.g. 20g coffee would normally produce either a 40mL espresso or 12oz drip. So putting that 40mL espresso in a 5oz cappuccino is much more concentrated than a 8oz filter.


*disable ssh agent FORWARDING.

Which honestly should always be disabled. There are no trusted hosts.


That's baby+bathwater.

Just use ssh-add -c to have the ssh-agent confirm every use of a key.


TIL. Thanks! Gonna do wonders when working at places where I can't use a hardware key with physical confirmation of use.

My assessment still stands. Use proxyjump (-J) instead of proxy command whenever possible.


What can also help is specifying the right options right in ~/.ssh/config for certain hosts and domains: E.g. do "ForwardAgent no" globally, use a "Match *.my-trustworthy-company-domain.com" block and add "ForwardAgent yes" there.

Also very good for other options that are useful but problematic when used with untrustworthy target hosts, like ForwardX11, GSSAPIAuthentication, weaker *Algorithms (e.g. for those old Cisco boxes with no updates and similar crap).

Another neat trick is just using a ""Match *.my-trustworthy-company-domain.com" block" with an "IdentityFile ~/.ssh/secret-company-internal-key" directive. That key will then be used for those company-internal things, but not for any others, if you don't add it to the agent.


Whenever possible, yes, but AIUI it's not always possible; the one use case for which I believe full-on forwarding is required is using your personal credentials to transfer data between two remote servers (ex. rsync directly between servers). If there's a way to do that I would actually much appreciate somebody telling me, but I have looked and not found a way.


Or use a hardware backed ssh key you have to tap once for every use, like a Yubikey or Nitrokey.


[flagged]


Sorry, English is not my native language. I know I sometimes sound strange because most of my use of the language is around the internet and at work, not that much casual "normal" conversation.


English is my native language and I have no idea what that person was talking about. Your post is fine.


I think that person was talking about having had 4 out of 5 squares in a line on their bingo card already, and stumbling across "baby+bathwater" earned them bingo. The card is metaphorical though... more of a mental buffer that just overflowed.


That makes more sense than my solution.

As far as I’m concerned the baby and the bath water is just a normal expression.

I thought it was something about the use of “confirm,” haha.


Mine too, and I think the post is fine also, but I have some idea of what that person was talking about. For a while, in some corporate environments, it was a recurring phenomenon to hear someone dismiss an urge to be cautious by saying "You're throwing out the baby with the bathwater."

So I can see where someone might count it toward buzzword bingo. But this post also offered an alternate solution when saying "baby+bathwater", so the bingo caller should refuse to score this one.


Your English is fine. That person was violating HN rules about snark (“Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.”)

Learned that rule the hard way. It’s crucial to the success of HN and I am grateful dang corrected me.


I don't see a rule where joking is prohibited. People sure love their buzzwords though. Must bring them a feeling of synergy in these unprecedented times :)

Glad that at least a few people above got the joke


Did I mention joking?


In your list of prohibited items? No. That's my point.


Default for the last 24 years according to https://github.com/openssh/openssh-portable/blame/385ecb31e1...


I've found myself to be much more comfortable to just define all my private keys in ~/.ssh/config on a host-by-host basis.


AFAIK, this doesn't solve the SSH agent problem - the problem is the agent has access to all of those keys regardless of the host you connect to.

So forwarding your SSH agent means an administrator of the system you're connected to could use any of those host keys loaded in the agent to connect to their associated machine.


> There are no trusted hosts.

...your own (headless) server that's in the same room as you, when you're using your laptop as a thin-client for it?


Depending on what it's serving, and how up to date it is, and who else is on that network and can access the server, and who else can come into that same room when you're not there, and from where you get the software that you install on that server... it might be less trustworthy than you think.


But if that's your standard then the laptop you're connecting from is not trusted either, and then you're not even allowed to use your own keys.

You're allowed to draw sensible boundaries.


With all these recent exploits, I wouldn't even be 100% sure of that.


But if I can't trust even that host, I also can't trust the host I'm working on and which doesn't need agent forwarding to access my SSH agent.


Trusting one host is safer than trusting two hosts.


This is where certs are nice, sign one every morning with a 8/12 hour TTL


Interesting idea. Does need some automation though to make it practical irl.



I was really hoping the next sudo replacement would borrow heavily on root as role[0] (if not being root as role). Feels like a missed opportunity to not use capabilities.

[0]: https://www.sciencedirect.com/science/article/pii/S016740482...


Capabilities aren't guaranteed to be present, and in a lot of high-security situations aren't available (though obviously you could say that about sudo too)


Sounds exciting and might be obvious, but where will I find systemd and not capabilities?


Containers


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: