Hacker Newsnew | past | comments | ask | show | jobs | submit | wartijn_'s commentslogin

It’s always interesting to see how fast someone takes a proposal and takes it to some ridiculous extreme.

Websites don’t know your account is a throwaway one, and making an exception for those accounts doesn’t make sense anyway.

Saying “ I accept full responsibility for the fallout” obviously doesn’t work on a large scale and here exceptions don’t make sense either.

Just use a password manager that generates and fills your passwords, and never worry about your passwords for those sites. Don’t tell web admins to drop basic security measures because you don’t know how to manage passwords.


I'll repeat what GP wrote:

> Seriously, many web admins need to hear this message: "Chill. Your site is not that important."


No site is important until it is, but by then it's too late to overhaul your security architecture.


No, the site doesn't become important if it wasn't from the start. This is not conditioned on individual use cases. Government sites, your bank, your healthcare provider - they have the important sites. Your e-mail provider is important too, because by accident of Internet history, your e-mail is your backup key to everything in your digital life.

Beyond those, nothing is that important. Your random e-commerce site or discussion board are not that important. Neither is your ISP or the service where you fix your appliances (or phones). And especially not the random fly-by-night startups that want you to register before you test their "game changing" SaaS.

The sad irony is, the smaller and less important the site, the more stringent security measures they tend to deploy, because security theater is trendy nowadays. 2FA is so 2025, if you're not demanding passkeys, you're a dinosaur.

(A good heuristic to use: if your site has harder security than your government's core services, especially when it comes to recovering access, it's worth asking whether there's any actually sensible reason for it.)


Your site is non trivial.


I think they meant watches that can show actual maps, not just a line or arrow with your route. That feature has always been reserved for the more expensive watches.


The more expensive watches (Fenix) also have long battery lives: lasting up to a month on a battery that can fit in a watch. The processors still have to sip power.


The Coros watches are less than half the price, have 22 days of battery life in smartwatch mode (in the Nomad) and render maps extremely fast. If they added solar, they could probably also last a month (the Coros Apex 4 does 24 days, also without solar).

The funniest thing is that earlier versions of the Coros even used the Garmin map format (though as many small files and not a single/small number of .img). Though they have switched to the open PMTiles format in later versions.

BTW, I had a Fenix 7x solar (before a Fenix 8 AMOLED) and it would usually 'only' last about two weeks. I think you can only reach Garmin's stated time if you disable a lot of functionality.


> The Coros watches are less than half the price, have 22 days of battery life in smartwatch mode

Garmin gets almost 30% more battery life in exchange of not being as fast (30 days)

> I think you can only reach Garmin's stated time if you disable a lot of functionality.

Turning off always-on Pulse ox gets you there. Turning everything off except telling time gets you 2.5x the battery life (69-71 days)


My Instinct 3 Solar shows 34 days remaining in the battery. I charged it sometime last week, so we're talking about upper 30s at least.

That's with running activity tracking including GPS for about an hour a day, and continuous heart rate monitoring.

At least on my device (and my body) the spo2 sensor is very finicky, requiring absolution stillness, and even at that I don't think it's accurate. So I don't use that.

I also discovered recently that simply using a custom watchface - even one built with an eye toward efficiency - lowers my battery life to about 2 weeks. The native faces enjoy privileged operations and are thus highly efficient. But custom-coded stuff apparently runs in a sandbox that has the effect of costing much more power. That's unfortunate, because my custom face used custom high-legibility fonts (derived from what's on interstate signage), making it noticeably easier on my aging eyes. The built-in fonts aren't great for this.


My Fenix 8 only gets two weeks at most with pulse ox off. Yes, it's the AMOLED version, but I have the screen off by default (which should be similar to MIP). I got similar runtimes on my 7 Pro Solar without pulse ox.


Err.. my 2yo Fenix 7 Solar definitely lasts 3-4 weeks. Not AMOLED (because.. that's why), but MiP. In summer.. it can last >month. Pulse on, GPS is generally only on in solar. Screen is never off. I can obviously make it a worse UX/last longer, but I'm not sure I see the need.. even when I'm back country.


I wish my 7 Solar had battery times like that. It's possibly because I frequently use mapping on longer bikes.


In retrospect, the difference between the batteries on 42mm/47mm/51mm are probably relevant (I'm using the X/51mm). Longer rides is my highest usage :D Next you're in Canada, let's ride (mine's an FSR)


For me coros are non started because of lack of the NFC payments. I'm not even looking beyond that, it's a dealbreaker.

It's brilliant coros sticks to MIP though - the moment I cant buy MIP Garmin when I update the watch next time, I don't buy Garmin.

Good watches, Coros, though, I wish them success.


I don't think I've ever heard anyone complain about that, and I know a good amount of people who use Garmin watches. My own forerunner is still going strong after 5 (I think) years of use, with multiple runs a week for most of that time.


I've had my Fenix 5 Plus swapped once during warranty because of this. And the replacement's contacts started to corrode again when I sold the watch. It might not happen to all models, but some are very prone to it.

Just have a look at Google results: https://www.google.com/search?q=garmin+watch+contacts+corrod...


They make little ~rubber caps to cover the charging port when you're not using it. That, and make sure it's dry when you charge it to rule out galvanic nonsense.


I know someone whose garmin watch refused to charge after a few years, not sure if it was caused by sweat. Mine is starting to get wonky after a few years. I keep worrying I'll plug in some time and it will stop. anec-data is not that reliable of course.


Why did you create an alt account for this comment?


I create a new account for every top-level comment, and have for years.

The moderation is so childish on this site I just take their power away.

They are not actually good enough to fully ban by IP or anything else.


Thank you. You've articulated a common flaw in almost the entire comment-based internet. I'm an idiot and come here to learn, from a genuine curiosity standpoint - that doesn't stop experts behaving childishly though. It's simply far too easy to chide or downvote whilst 'hiding' behind account names, pseudonyms, and by the same token a flood of mob-rule can decimate curiosity in a matter of seconds. It's worse for kids. The best of the best is out there too, the well meaning, the guilty, the innocent, all at once.


Are there really? I don't think I've ever encountered such a service in all the years I've been using an email address under my own domain. And blocking every email address that's not from a big provider means blocking basically everyone who tries to sign up with their company email, which might not be great for business.


I've been running my own mailserver on a firstnamelastname.com domain for nearly 15 years.

As far as I can tell, nobody blocks it. Google sometimes rejects emails where the from address doesn't match the real sending address, which is fair.

I guess the first couple of years were rocky, I hadn't figured out DKIM and SPF and all the other blood rituals yet. Back then I got blocked by Steam and banks. But ever since I set up the correct security it's been fine. Been my primary email for a long long time. All my online accounts are tied to it.

Incidentally, I also have free and unlimited aliases. But I don't usually bother because I have a rule to route all messages to unknown addresses into a special folder. I can give out any random address at my domain and it will always make it back to me. So much more convenient than logging into the website to generate an alias.


I did that too years ago, but the management of it was kind of annoying. DKIM was just getting introduced when I stopped using it. SPF had controversy. I understand both of those are awesome now.

The biggest issue was if your ip address got listed in a RBL (Realtime Blackhole List), and then nobody would talk to you. Some were easy to get off, others were permanent blocks, and I found those to be constantly interfering with the delivery of mail. At least the rejection would usually tell you which RBL blocked you.


Most RBLs are scams. No competent mail admin uses them to block mail ever.



Honestly those are used as weights now in some kind of obscure calculation (or maybe not so obscure calculation but I still don't understand it).

What I really learned during that time is that mail servers have well known IP addresses and reputations. And you can say all you want SPF/DKIM fixes that, but the reality is when google sends your email (even with your custom domain) it gets received.


Yes, espacially exotic tld. I have a ".email" domain name, and I get 2 to 3 instances a year of either rejected forms, or sneakier, just confirmation email that never come until I use a .com address.


I have a 3 character .com as my primary email... it gets rejected more often than I'd like... including at my bank :) I've got a longer more normal domain that I alias, but it annoys me none the less.


Have you got this lot sorted out:

  MX->A->PTR->A->MX
  SPF
  DKIM
  DMARC
  mta-sts - DNS and webpage
Also your IPs must be squeaky bum clean, ideally for several years. DNSSEC might help too. In the UK getting as far as DKIM is usually enough (plus clean IPs, even FTTC connections will work if static).


https://sys.4chan.org/signin has a short list of approved email domains:

> Allowed domains are: gmail.com, hotmail.com, yahoo.com, proton.me, protonmail.com, outlook.com, live.com, icloud.com, yandex.com, tutanota.com, tutamail.com, tuta.io


I recently tried signing up for DeepSeek using my custom-domain e-mail address and the website said the domain is “not supported”.


I know a few. Heck, I’ve worked at such a place, we strictly checked MX records to make sure the email would be reachable, and catch-alls usually wouldn’t pass validation.

(I’m not saying we should have been doing that, but the company was in insurance and wanted to be extra extra sure.)


Camel camel camel wouldn’t send notifications to my hidden email. Works fine for my regular vanity domain.


in asia it is frequent that email domain is a dropdown not a type in


Asia is huge. Please be more explicit (if you can).


I have seen sites in both Japan and China limit signups to not only mobile-only provider-specific email domains, but also IP block everything but domestic mobile traffic as well.

Most of those services (mixi was one in particular I remember doing this) stopped this practice close to 20 years ago though, but some still remain.

I think it was partly due to the "Galapagos phone" era of pre-smartphones, where each carrier used slightly different mobile web standards (think WAP and custom emoji).

Here is a current help page for Mitsubishi UFJ bank that lists approved domains for both desktop and mobile use: https://faq.cr.mufg.jp/mufgcard/detail?id=4402

Here is a user complaining (with screenshot) that the mail magazine for tabelog only supports mobile provider email domains: https://king.mineo.jp/reports/13368

Another recent one is the login page for gravity.place has a dropdown for country codes (for mobile login) with only 6 options.


China, Japan ish are where I have seen it the most.

Weibo, Sina you get "Failed registration (mail not supported)" if you enter non-major provider. In china nearly everyone is using qq, 163, 126, sina. Probably >99%


Within the last month both Mapbox and Etsy blocked my attempts to signup using a Proton Mail alias. How many services do you sign up for in recent years, on average? The practice is becoming incredibly common and more than likely you're just grandfathered in.


are you sure they're not just blacklisting protonmail vs. whitelisting known providers? ime a lot of sites block "temporary" or "anonymous" email providers


Etsy blocks my entire ISP (I know because my IP rotates almost daily) so I cannot even view their site at all, it just gives me a "you are blocked" page.


In theory that’s true (although observables are for reactivity too), but Angular uses observables for its http library and http requests are very much not streams. It’s one of the main downsides of working with Angular, the http library is mediocre and does come with the added overhead and complexity that rxjs brings.

Until this release (if you only use stable features) using forms meant dealing with observables too, even if you just want to read data when submitting a form and validating some data on change/blur.

And often you’ll find that your data from promises, observables and signals need to interact with each other, which can be annoying.

Fortunately the situation with signals and their async usage is improving, and iirc the Angular team wants to make rxjs optional, but until it is Angular can be a confusing mess on some points.


I partially agree, there is an overlap between signals and rxjs, however the core business is different- observables are about data manipulation, while signals are about efficient state management.

Regarding angular I agree, rxjs was a bad choice for data management, and before signals arrived I abandoned rxjs in favor of mobx in my angular projects. However you could roll your own http client, we used axios, and using DI it’s a drop in replacement.



> This isn't anecdotal or “vague opinion” CVEs are facts

No they aren't, they're data. Your source shows the amount of Linux CVEs in 2024 are an order of magnitude higher than the amount of Linux CVEs in 2023. Does that mean Linux became way more insecure in 2024? You imply it does, but that's obviously not true. What happened is that Linux changed how they report CVEs [0].

Just like your source doesn't say anything useful about the difference in CVEs in Linux, it doesn't say anything about the difference in CVEs between Linux and OpenBSD.

Lies, damn lies and statistics.

[0] https://www.suse.com/c/linux-kernel-cve-increase-suse-explai...


This announcement thread really isn’t the place to discuss or debate the data.

The OP stated they couldn’t find any data to compare the relative security of Linux vs. OpenBSD.

CVEs are independently, objectively verifiable and provable data. This is the dictionary definition of a verified “fact”. It’s not anyone’s opinion. You don’t have to like it or me.

Love you all.


It’s not the most interesting Node release ever, but Temporal being enabled is nice. Hopefully Safari and Bun will follow soon, so it’ll be a viable option for personal projects without using polyfills.

The removal of --experimental-transform-types[0] is interesting too. With type stripping being enabled by default (in a patch of v25 I think), and Typescript getting the setting erasableSyntaxOnly, we might see older typescript features like enums slowly getting phased out.

[0] https://github.com/nodejs/node/pull/61803


In Node 26 it will be removed

https://github.com/nodejs/node/pull/61803


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: