Hacker Newsnew | past | comments | ask | show | jobs | submit | more angott's commentslogin

> most frustratingly I can’t send an SMS to any contact it believes to be on iMessage

You can long press on a sent iMessage blue bubble to reveal a 'Send as Text Message' menu item. It's quite hidden but it's there.


Only if the message didn’t go out to Apple’s servers. That doesn’t help me when I know the recipient won’t be able to receive it (e.g. because they are on roaming or out of mobile data).


If you know you want to send an SMS you can tap it right after you press send, there’s a small grace period. I just did it.


Because the Corolla Hatch already sells very little. The few units they manage to sell go to a very specific crowd looking for a sporty but affordable hatch.

At the Corolla price point, the hybrid versions are also meant for a crowd looking for good fuel economy. The sporty hatchback and fuel economy crowds do not overlap, because fuel-sipping hybrid engines have poor acceleration. And more generally the fuel economy crowd would prefer the sedan model, because it provides more interior room while using less gas than the hatch version.


I thought the sedan and hatch gas version has the same fuel economy, and isn’t the hatch useful for hauling large items?

If not a hatch, which model/car do I get for a cheap, reliable, fuel efficient car that can haul largish items?


I used to own a Kia Soul. It was very spacious to carry around items. It was also fairly reliable and didn’t require any repairs beyond standard maintenance. However fuel economy wasn’t as good as a sedan. The boxy shape really impacts that, it’s all about aerodynamics. It’s cheap enough that you might be willing to overlook that, though.


A utility vehicle like a Nissan cube or a honda element?


Both discontinued, the Cube was not rated as very reliable while the Honda Element has atrocious fuel economy.


This is not really necessary, there is no need to change any settings. Even when the device enters sleep mode, VPN apps can remain active, just like on iOS.


This blog post is a very good technical read (and the diagrams are really cool too): https://tailscale.com/blog/how-tailscale-works/


Tailscale dev here: yes, you can set up a custom coordination server in the settings, just like on the iOS app. Open the tvOS Settings app, then scroll down to Tailscale.


Genuine question: Does tail scale want people using headscale?

I'm a free-tier personal user, and a little too cheap to give a for-profit corp money when I don't need to just because "I REALLY like the product". If I use headscale does that just cause a headache for the team, or is it good because it reduces traffic to prod?

I'm to cheap to pay when I don't need to, but its such a great product (esp for free) that I'd gladly change how I use the product to be less expensive or problematic.


Thank you so much for that!! I wondered about this as well. Love how above and beyond you guys are going to support other OSS implementations <3


Is it possible to transparently embed Tailscale into a game to only talk to your self-hosted Headscale server?

Also, is it in theory possible to use WebRTC to negotiate Wireguard connections and not use any control plane?


> Is it possible to transparently embed Tailscale into a game to only talk to your self-hosted Headscale server?

https://github.com/tailscale/libtailscale

> Also, is it in theory possible to use WebRTC to negotiate Wireguard connections and not use any control plane?

you can write code to do whatever you want I guess, but that's nothing to do with tailscale


Which are respectively a performance car, a luxury electric SUV and a sports car. Ford is no longer making any regular cars like sedans or hatchbacks.


Meanwhile in the EU Ford offers 3 or so SUVs, and a myriad of regular cars.


In Europe you're not required to take off your belt because of an arbitrary rule like shoes in the US. They just tell you to take it off because most belts have metal parts so they will likely trigger the metal detector.


I thought the shoes being taken off wasn't arbitrary. I thought it was because of the shoe bomber(Richard Reed)


> the shoe bomber(Richard Reed)

Hmm, haven't heard that name in a while. I remember all the crazy press about him.

Fascinating details in his Wikipedia article - https://en.wikipedia.org/wiki/Richard_Reid :

> The explosive apparently did not detonate due to the delay in the departure of Reid's flight. The rainy weather, along with Reid's foot perspiration, caused the fuse to be too damp to ignite.

Seems his biography was that of a petty criminal whose journey to radicalism began in prison. Pretty sad to think about. One considers an alternate reality in which he would have been rehabilitated beforehand instead. Seems like he might have had some serious problems, though.


It's arbitrary because all they do is X-ray them. X-rays can't tell you whether there are explosives in the shoe, all you can do is look for signs the shoe has been altered.

I don't think that requirement would have stopped Richard Reid. Maybe someone notices that his shoes look a little odd under the X-ray, but with sports shoes coming with weird air pockets and Heelys existing, it's not that odd.

It also slows down people moving through, making the security line a bigger target, and forces people to sit down just past security to put their shoes back on. Again, making the security line a much larger target.

We'd be better off just forcing everyone to do the hand swabs. One airport I went through had some kind of machine that purportedly could detect trace explosives coming off your clothing or skin. Those would be way better, if they work.


> We'd be better off just forcing everyone to do the hand swabs. One airport I went through had some kind of machine that purportedly could detect trace explosives coming off your clothing or skin. Those would be way better, if they work.

I've gone through that machine six times, in one trip.

Something in my backpack set it off, so they kept running swabs over and over again until the light went green.

It was an utter waste of time for everyone involved. The fools patted me down five times, looked through all my things, ran them through the x-ray machines, and can clearly see that all I have is the clothes on my back, a laptop, and two changes of clothes. But they won't let me through the security line until their magical explosive scanning oracle shows a green light.

As if anything about the risk I pose to a flight fundamentally changed between the first swab and search, and the sixth.

The best part is they were asking me what is causing it to go off. Why are you asking me? I don't know a god-damned thing about your magical black box.


We would be better off, if they just left everyone alone and let people get on the plane.


>We'd be better off just forcing everyone to do the hand swabs.

That or detection dogs.


The fact that the shoe rule does not apply to precheck speaks volumes about how arbitrary it is...


This is the case.

The iOS APIs to obtain details about the current WiFi network environment are extremely limited. I suppose it’s because ad networks were using these to fingerprint the user or obtain their location using WiFi access points as a proxy for it.


There are thousands of TP-LINK routers whose WAN port 80/443 is exposed to the Internet, allowing access to their administration interface if you know the password (or a vulnerability is present).


And I'd bet a nice amount that most of them have the default passwords.

Some years ago I wrote a little tool to iterate all of an ISP's ip addresses and around 90% were using default passwords. Mostly homes, but some businesses.


According to a comment above, these routers require an admin password change when setup with no way around that.


Sounds like they learned their lesson


The ISP assigned a unique password and puts it as a label beneath the router - in my case. I kept it. I consider it save enough.


I was planning to host a simple website on my RasberryPi using Dynamic DNS - which I think requires me to expose port 80 to the internet. Is that safe?


It's as safe as whatever software stack you'd be using on the Raspberry Pi to serve the site, same as if you'd be hosting it on a VPS in someone's cloud (though in your case if there's a vulnerability of a particular kind, someone could gain access to your local network).

Since you're not hosting the site on the router itself, presumably you're forwarding port 80 from the router to the Raspberry Pi, so unless the security of the Pi ends up being broken, the router should be safe.

(Also I'd recommend using Let's Encrypt to get an automatically-renewing TLS cert so you can serve https on port 443 as well, and even redirect port 80 to it. It's not that difficult to set up, and you'll be improving the privacy and security of those who visit your site.)


I was considering self hosting at home. If the local network should be disconnected IMHO only a DMZ will help. My router doesn't support that so the setup will be:

ISP router (with disabled wlan) <-> firewall <- home router (with wlan)

and the firewall can then separate the network by port. WAN for the firewall is the LAN Port of my ISP router.

Is that a good setup?


If it's a static site? Probably safe-ish, I suppose bots and bored teens could DDOS it. You could also choose a non-standard port, that might cut down on the noise.


Thanks! I want to learn what could go wrong. Can you point me to any resource/book to study this particular matter?


It depends entirely on what technologies you are specifically exposing. If you are serving a page with a web server application like Nginx or Apache, you should read about securing those applications. If you are writing a NodeJS application, you should read something specific to that.

If you want something very general and comprehensive, you can read this, although it is probably too involved for a basic "website": https://owasp.org/www-project-web-security-testing-guide/sta...


I would recommend you put it behind Cloudflare, it will mask your home IP address and will absorb any attacks

https://skylar.tech/create-fast-websites-from-your-home-netw...


Please don't do that. It's a terrible idea because CloudFlare will then get to decide who gets to see your website or not (and CloudFlare hates privacy tech like Tor), and also because then CloudFlare will terminate the HTTPS (TLS) connection on their side so they essentially get to know all your passwords.

I've selfhosted on 64Kbit/s modem then xDSL for years without a problem (apart from bots trying default passwords). If you are really afraid you'll run into DDOS attacks and whatnot, consider using a small 2-5$/mo VPS as reverse-proxy instead of CloudFlare to retain control of your infrastructure.


If you disable the router's remote administration feature and/or change the router's default administration password, it should be safe.


> I was planning to host a simple website on my RasberryPi using Dynamic DNS - which I think requires me to expose port 80 to the internet. Is that safe?

See if ngrok can do what you want to do


With a more modern audio codec like Opus, which does better at low bitrates, a minute at phone-line quality would take around 80-120 kB, one third of MP3. Which makes it even cheaper.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: