Hacker Newsnew | past | comments | ask | show | jobs | submit | scottmotte's commentslogin

Encrypting your .env file with dotenvx, or something similar, can help mitigate this need for trust.


> developers could still potentially commit private keys the repo or commit the decrypted env file

to prevent this, use:

$ dotenvx ext precommit --install


I've tried all four, and Render is the closest experience to Heroku. It still isn't as easy to use as Heroku, but it is close.


> people are most comfortable being around people like themselves

Inertia. This is everything. It takes effort to be around people unlike those currently around you.

We all have personal biases against the strata economically above us and below us. I think most of the individuals that move up economically are able to get beyond these biases for one reason or another. Otherwise, even the most hardworking individuals tend to self-sabotage when they start to feel out of place.


I love the look of the Punkt. I ordered one 3 years ago but because of delays, and then Covid, gave up on receiving it. They issued me a refund but I'd still like to get one - in a reasonable amount of time.

Anyone have one and like it? Or recommend a different dumb phone?


1. On twitter

2. Start building. It will attract people. Don't go out and find them.


I posted this myself as well a couple days ago.

I was personally interested in HCQ before Trump ever tweeted it - turning it political. It was looking promising and still does.

After further personal study, I would like the conversation to continue.



Yeah it would be great to see some numbers from anyone who might have them. I'd put money on SPAs being slower, inside the bell curve than, than the average traditional page load app.


It's a shame more companies don't keep the old version of their website around when they launch a redesign. It's pretty easy to visit https://i.reddit.com/ and https://m.reddit.com/ on your phone to see which one feels faster.


Forget “feels faster”, I use that for stability every time new reddit hangs - usually 2-3 times a day I have to do that because they don’t handle errors yet, and they recently added a new bug where you can’t tell whether a reply was sent.


SPAs don't make sense if it's not an 'application', but wouldn't a SPA be faster over time not having to reload the whole page and all that duplicate markup? Wouldn't the simple JSON calls be smaller than refetching and rerendering all of the HTML? Front-end application offer more than just no-reload though, like push notifications, real-time data, and offline caches.


It’s not that simple: you need to factor in size and latency, too. If my SPA loads 2MB of JavaScript and then makes 50 API calls, it’s going to be a lot slower than the server sending 20kb of HTML in a single response.

JSON may or may not be smaller or faster: if you have to load data you don’t need or, worse, chase links it’ll be worse. GraphQL may help but that’s bringing it closer to server-side performance, not exceeding it.

Things which aren’t possible otherwise are the best argument for SPAs, but another approach is progressive enhancement: you can load quickly and then load features as needed rather than locking in a big up-front cost if all you need are real-time updates or push notifications. There’s a spectrum of capabilities here and there won’t be a single right answer for every project.


It depends, as always. (Compressed) JSON is probably smaller than (compressed) HTML, but that doesn't necessarily translate to more round trips. And browsers are pretty good at rendering HTML, and at the same time SPAs will get in the way of translating the JSON to rendered HTML on screen.


Why hasn't someone built an email system that only accepts signed payloads?

Email would only be allowed into my inbox if it was signed. Then, layer 2, it would only allow signed emails from senders whom I've accepted their public key.

A separate tab would show me all incoming request to accepts public keys (request to send email)

Now to opt-in to a marketing email I first accept their public key. To opt-out I delete their public key. Their email now goes to /dev/null.

Senders wouldn't have to re-implement unsub/subscribe, spammers would be /dev/nulled, and we could later add encryption on top of signing as a requirement.


> Why hasn't someone built an email system that only accepts signed payloads?

Because it requires both parties to play along. Lets say I had such a service and I signed up for an account on Github. Github would have to implement this and give me a key. OK, maybe they do; but Stack Overflow don't. Then I end up reverting to Gmail or Fastmail.


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: