Hacker Newsnew | past | comments | ask | show | jobs | submit | notemaker's commentslogin

My condolences. I don't have any advice, but you may be able to learn something from my very similar experience.

https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...


> I still love many of the products that Apple make...

The Stockholm syndrome is real.


I've had a similar idea on my backburner for two years, as a fun project to dabble in Elixir, but this is just so much more _fun_ than my version which looks like an admin page that just happens to have a Vim canvas on it.

Well done!


Elixir is really fun. It hits the same spot for me as Ruby does for many others, bringing joy when writing it.


Can someone explain why this issue deserves a 24h notice?

Seems more reasonable to me to have a much longer deprecation notice.


As far as I can tell, this issue would be a problem where all of the following conditions are met:

1. Tenants are allowed to create arbitrary subdomains with arbitrary CNAME values 2. Tenants are not authorized to act on behalf of the TLD directly, only on their respective subdomain 3. Tenants are ostensibly prevented from TLD cert issuance by being explicitly blocked from creating subdomains that start with underscores

For most entities these conditions probably do not hold true anyway. But it could conceivably apply to certain free/dynamic dns providers, for example afraid.org and noip both allow arbitrary CNAMEs (though I checked my noip account and it wouldn't work anyway because of length limits on subdomains).

I would guess that in act fact there are very few entities in existence for which this actually represents a potential threat against them, since it requires a very specific delineation of zone authorizations, but there might be a few.

For most of Alegeus customers I doubt any of this applies, though, they're probably lucky to know their GoDaddy login to add any sort of DNS record, let alone have a whole system in place for less privileged users to create arbitrary CNAME records subject to controls over the use of underscores.


Really impressed with how thoughtful _and_ fast they are delivering on their type system.


I'm really curious to know if many people with large Elixir problems are finding any issues with the new type system. This is pure curiosity, I don't have a dog in the fight!


José Valim already caught two bugs (one in Phoenix, one in Livebook) because of the type system: https://x.com/josevalim/status/1791409843888111667


With risk of being spammy, this is probably the most relevant discussion I've seen so far on HN w.r.t my experience of being locked out from my Apple ID.

I hope legislation will force Apple to step up and be more transparent / helpful.

https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...


From the timeline:

> got my Macbook Pro from work and signed in to my Apple ID on it.

Wouldn't this result in unintentional data sharing from the work device to your personal devices? (and vice versa)


In hindsight, yes that was a bad move (especially considering that my work laptop is still locked to my banned ID…)

As an Apple noob at the time, I assumed that if my MDM-managed device prompted me to log in with my Apple ID, that it of course would be an allowed action.

With regards to data being shared, the only thing I noticed was wifi passwords and peripherals pairing (apple keyboard).


Yes, do not do this.


It's enabled in some corpos. Allows one to make AirPods auto-jump between one's iPhone and work laptop etc.


Yeah, I would never do this. My work iPhone is on a whole separate Apple Id than my personal phone.

Never mix work and personal. It isn't worth it.


This is why I don't sign in or enable 'find my' on any of my devices. Apple even has a backdoor which bypasses the encryption, allowing them to wipe a device in store.

Logging in takes control of your device out of your hands.


Why would you need to bypass encryption to wipe the device?


Because that is the way apple designed it. Try wiping a locked apple device without the password or recovery key.


I would expand to cover not only Apple, but Google and Microsoft.


You don't have a requirement to have an email account to login to Windows. MS is pushing it hard, (deceptive trend in big software) but the user can still push back.


I don't know if its still true today, but last time I setup a macOS machine (2020), it didn't require, but pushed, an Apple ID. My Pixel phone I setup this February also didn't require, but pushed, a Google account. I think iOS did require an AppleID, though.


macOS doesn't require Apple ID, although you wouldn't be able to use the app store without it (but pretty much everything worth installing is available as direct downloads anyway). This is similar to the current state of affairs with Win11, except that the latter very aggressively pushes you to use your online email/password as Windows login, whereas macOS insists on having a local account even if you do also set up Apple ID.


Don’t want to sound like I’m victim blaming the author. But I can tell you exactly the issue with their account: registering with an email on a self hosted .xyz domain. Using sketchy tld’s is just asking for this kind of trouble.

https://news.ycombinator.com/item?id=28554400


Nothing sketchy about self hosting your email. Sure, that is what the big tech cartel wants you to think so you're forced to let them handle your correspondence "for your own safety". Don't believe their lies.


Issue isn’t self hosting email, it’s self hosting it at .xyz.

They had one of the cheapest registration costs. And so ended up with a high concentration of spammers compared to older established tld’s like dot com. Using the tld for legitimate purposes is really challenging due to the high number of systems that flat out blacklist it.


Making assumptions on someone's right to communicate based on their choice of email domain is discrimination, and only serves to drive people to their walled gardens.


I'm not the one making assumptions, it's thousands of independent hosts, and all big tech orgs (including specifically Apple in this case) who are making that assumption. I didn't say the assumption was right, just that it's trivial to avoid falling afoul of it by choosing to use a different TLD.


"Sketchy tld"? Even google's parent company uses it for its corporate website.


I babysit a few corporate mailfilters and have more spam from .xyz than from all other TLDs combined. I dont block on that (most get disappeared due to 'new domain') but that's the cohort all .xyz pages are sharing.

xyz has been accomodating to scammers ever since its inception. After a decade I think we can say that it is on purpose.


FWIW, it's not self hosted. I use Fastmail. Thanks for the link about .xyz though, I was not aware it is associated with spam.


I would say that SMS and invasive email services are sketchier than using .xyz.


You end up fighting an uphill battle against every third party that blacklists .xyz, It’s not worth the fight just to use a cute tld and save a few dollars on registration cost.


It seems to be extremely rare, but do bear in mind that if Apple bans your account (Apple Id) you will lose access to your icloud files irrevocably.

See my previous posts on the matter for more info.


That’s true for all providers isn’t it? Unless you have your own server setup.


True, but Apple specifically in my case was abhorrently indifferent to the consequences and their support structure is entirely unable to help you. If you have a dedicated storage provider, you lose their single service only. With Apple, you lose everything you have attached to your account which carries a much higher risk.

See https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket... for more info.


I'd recommend moving to development that interfaces with ML instead of moving to being an ML practitioner. You have much faster feedback cycles, your work is predictable (engineering, not science), and you don't feel the pressure of never reading enough papers.

To do that you only need to understand the fundamentals of tensors, some basic knowledge on what the big no-nos are within ML development so you can course correct your peers if they break them, and either focus on the operations side of things or deployment. In both cases, having a knack for optimizing bottlenecks will be very helpful since they will be present during both training and inference.


As a designer/developer with a lot of expertise in UX and front-end technologies, I would love to go this route. Do you have any suggestions on where to start in terms of tutorials, tech, books, etc?


Read Deep Learning with Python [1]. It's ok not to understand everything, but doing the labs will be invaluable.

That book should set you up with the fundamentals. Pytorch is the defacto standard right now for training; during deployment you will use whatever your deployment setup allows (e.g. embedded devices typically have their own inference frameworks).

Python is the lingua franca for anything in machine learning, but other languages are used where necessary for performance or for ecosystem benefits.

[1]: https://www.manning.com/books/deep-learning-with-python


got any good resources you can share?


I've never found this style readable unless with pipes (bash / elixir), where I love it. With any other syntax, I find it just adds mental overhead. Maybe because you have to read it backwards?


Pipes in both of the languages you specified do function application, not composition, so they’re very much point-ful (you see the arguments you pass/get passed).


I assume they're talking about code like

    x
    |> f a
    |> g b
    …
… where everything after the first |> is essentially in point-free style.


Clojure (and I'm sure other lisps and programming languages) have a nice solution to this, the `->` macro ("threading")

You'd do something like:

  (save (transform (fetch))) ;; calls fetch, then transform, then save

  (-> (fetch)
      (transform)
      (save))
Not that the non-threading version was hard to read, but once the function names start to be a bit longer and involve arguments, the threading version tends to be a lot easier to read.


Automated account suspension is anti-consumerist for the % of false positives. And since that % likely is low, companies get away with ridiculous processes for recovering your account.

I recently encountered this with Apple (https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...). After 2 months I'm still fighting them to recover some of my devices.


Take them to whatever the Swedish equivalent of the small claims court is. You are in the EU, the court will have a field day.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: