Hacker Newsnew | past | comments | ask | show | jobs | submit | homakov's commentslogin

Is it a blockchain though? Or anything that remotely resembles block creation in some concentrated datacenters with Tempo's "design partners" gets to be called that.

Something claiming over 20-30 tps onchain is usually a big blocker. Big blocker design is well recognized as insecure: no end user is able to run a full node locally, only datacenters are able to keep up with 100k tps load. Which diminishes entire purpose of creating a blockchain. Could have been a database with 100k tps or 3-of-4 validator multisig like Hyperledger, wouldn't matter.


IMO OAuth2 is very poorly designed. It has several structural issues: "Connect this OAuth provider" hijack your main account, redirect hijack allows to leak either auth codes through Referrer or access_token through #hash passing, "state" CSRF token is optional and usually ignored etc

I have an old writeup on that and solution to it https://sakurity.com/oauth - better analyze it with LLM if interested in authorization protocols


Your comments are so highly abbreviated as to be nearly impossible to understand. I suspect that unintelligibility is leading to it being heavily downvoted.

The addition of the comment about LLMs isn't really helping.


His comments are also outdated. Browser binding with a separate nonce is standard practice by big identity providers, redirect uris are typically strictly validated, implicit flow without pkce is being phased out, and most browsers protect against a lot of would-be csrf attacks with strict samesite cookie headers.


I wasn’t criticizing the guide — just pointing out real OAuth2 pitfalls that still affect users.

The spec itself made mistakes:

• Silent account hijack via “Connect this provider.”

• Redirect leaks of code (via Referrer) or access_token (via #hash).

• CSRF because state was optional and often ignored.

The point is: these aren’t obscure edge cases, they’re structural issues baked into the protocol.


Every psychodelic experience is unique & random, even if the title was the opposite and in their study SSRI turned out to be better doesn't mean it will be better for you.

From my personal experience, SSRI (zoloft) felt like a temporary coffee-like stimulant. Psilocybin (or easier to handle synthetic analog 4-aco-dmt) provided short-acting relief from depression and some new perspectives. But ketamine is truly a magic pill if done right. After glow is about a month, and the trip takes 2-3 hrs max. FDA-approved, see Spravato. I feel like at some point ketamine therapy at scale would make SSRIs obsolete, it's just better and faster.


(on an unrelated note): I tried to move to Berlin for summer but quickly discovered almost no apartments have AC, I mean strong South Asia-level AC. It was a major no for me as I cannot sleep with temp above 20C, 18C is perfect. Any idea how to find an AC apartment next summer on local estate apps? Any "checkbox" somewhere to tick?


Maybe a hotel will do? You can also rent an apt and buy a mobile AC yourself. Which i did this summer, for the few days it gets really hot.


A hotel is temporary, i wanted to stay May to September.. Yes mobile AC is the best plausible option but it's quite weak compared to split-AC and requires a partially open window.


There are mobile split-AC. I took one meant for camping. And the wiring between the units is small enough, so that an opened window is not a problem. Worked well enough for me.


Why jailbreak? Just use internal kindle browser to stream screenshots of your desktop.


That would indeed be much simpler! I'm skeptical that the browser is powerful enough to handle a usable frame rate since every frame would have to go from the network -> DOM -> browser app memory -> frame buffer. The browser can barely keep up with the Kindle store / Goodreads, but it'd be nice to be proven otherwise since it'd make it much easier to get this working ootb on brand new Kindles.


i had similar idea to turn kindle to second monitor

https://www.youtube.com/shorts/6dcc0hLe0mc

frame rate was too bad so i just bought dasung paperwhite :)



Bitcoin dominance is fading this year only because it has bet on LN with fundamental inbound capacity problem. LN rejected my proposal to solve it and extend channels with credit lines: XLN https://medium.com/fairlayer/xln-extended-lightning-network-...


It looks like you are explaining some good stuff in that blog post, but the overall arrangement and writing style of the post reduces it's impact.

Your post could be more influential if you refined it through a technical writing type process - perfecting the ordering of presenting information for the audience you hope to persuade.


This is true, but that's not the only post I had on the subject, just the earliest one. Anyway, I gave up on btc and now implementing xln on eth https://github.com/homakov/xlncontracts/blob/main/contracts/...


Bitcoin dominance always goes down in altcoin season and then comes right back up.


I was a 100% bitcoiner 2014 to 2020, but after exploring defi and L2 projects in pipeline, i decided this time is different and converted to eth. That's just my opinion.


To me, it's like gold=Bitcoin, I can fully trust it and know that it will be here in 100 years from now, functioning just the same and that my wallet from today will be perfectly functional, and oil=Ethereum, it's an awesome platform that allows me to run a variety of different financial operations with different assets (including Bitcoin), but it's much more nimble, things are a lot less set in stone and I frankly have no idea what it'll look like in 100 years from now or even if it will still be the dominant defi platform.

A parallel is like, today we only have 1 thing that's gold and many banks/financial institutions that provide variety of services. All these institutions combined are worth a lot of money (the largest banks combined have roughly ~2T$ in market cap[1]), but gold market cap is like 11T$.

Just my 2 cents, I own both and hope both succeed.

1: https://www.statista.com/statistics/431751/leading-banks-usa...


But do you hold BTC or WBTC? Among people I know, actually havinf a BTC wallet is pretty rare.

The ethereum ecosystem is just so rich that there's no reason to leave it, well, maybe bsc and solana, but that's it.


Meanwhile, crypto indexers beat Bitcoin maximalists. But, the evidence for indexing performance will never see the light of day . :)


Not sure what you mean by crypto indexer, you mean people who buy a basket of crypto? Sure, in the short term, they might outperform BTC, over long term 70% will die, 90+% won't recover to their ATHs. If you indexed back in 2017 into top 10 coins, only like 3 of them crossed their old prices from 2017, rest are as good as dead.


Usually you'd rebalance periodically.


Seems like stuff folks say in a bubble. 90% of it will disappear once ethereum fixes this/that.


Where did you get these numbers? I assume this is a post-hoc rationalization?


I mean you can pull up the numbers for yourself if you don't believe me, people have also done the math themselves [1][2].

1: https://preview.redd.it/c21qium7jyr61.png?width=1113&format=...

2: https://www.reddit.com/r/CryptoCurrency/comments/mmstrt/i_bo...


This is useful. Good numbers. Thank-you.


>But, the evidence for indexing performance will never see the light of day . :)

Why not? If such evidence exists why aren't you presenting it?


You'll note that my comment was downvoted. This evidence is immoral. Thus, it won't be aired.

You can go to pandaanalytics.com if you'd like, and play with their index options. See what strategies have worked well. (I weight by market cap, top-10, no stablecoins)


Your comment was downvoted, likely due to claims with no evidence but instead a story about how you're about to be silenced. You could've just posted something to support your position instead and we'd skip all the drama in this exchange.


Is this really drama? I don't actually care if I'm downvoted. People will always upvote iced cream, and downvote brocolli. It's not hard to see that, or understand why that would be the case. Mostly I find it funny.


Your proposal isn't trustless anymore. At that point, why not just have normal centralized bank accounts?

You wrote that article in 2018 too, what do you think about the state of the LN now, where its no longer common to get payment failures?


> Your proposal isn't trustless anymore

not black and white. I didn't say to drop collateral channels to have credit, but to use credit in addition to collateral on receiving side. Also, on ETH those credits are enforceable (as i answered below) so it is far better than a custodial balance.

> where its no longer common to get payment failures?

nothing changed, the inbound capacity flaw is fundamental. Download a wallet - you can't receive a payment - full stop. Until this is solved say goodbye to adoption. With credits on both sides the total capacity of the network skyrockets. And somebody is taking the risks anyway, either liquidity providers as in delusional LN model, or users themselves as in XLN.


> where its no longer common to get payment failures

Sorry but they're still incredibly common


Payment channels ARE credit, generally - I'm sorry this proposal was rejected. Was there a reason for the rejection?


Payment channels, in traditional sense, are fully collateralized credit. I suggested to leave collateralization ratio up to users themselves. Some could have 100% collateral, some 0%, some 50% etc.

Rejection reason: unclear, doesn't fit the narrative.


Payment channels are not at all credit. Credit means you're relying on someone to pay you back, and have a risk that they won't pay you back. Credit relies on trust. Payment channels do not rely on trust. You can always retrieve your money even if your channel partner doesn't want to give it back.


Unless you value the time your money that is locked up at zero, they are definitely credit - as GP said, fully-collateralized loans.


Interesting.

> Also, uninsured balances are enforceable onchain, which is very different from a trusted balance.

Does this mean XLN is implemented with a smart contract that withdraws the money from an address if you fail to pay? Or automatically cancels the channel if you withdraw more than what you have in the channel?


It's better explained in solidity:

https://github.com/homakov/xlncontracts/blob/main/contracts/...

it is withdrawn from a special intermediary "reserve" balance OR a Debt is created on this identity.


Also many of these design attacks still work http://sakurity.com/oauth


I owe you many thanks, your guide helped me exploit a bug on a bug bounty years ago and then helped me get my first security job.


> set of UTXOs as collateral, and the moment any of them move, which is easily monitored

not possible. Once collateral is moved, it's moved. You can't even call it collateral if the other person can easily take it away in front of your eyes. It's only collateral if it's locked up and has a dispute period (see: payment channels collateral)


>There are some protocols emerging which lets you keep ownership of your coins and still lending them out.

how is it possible? When you lend your assets, someone can give it to other person. You cannot keep ownership of something others control?


Overcollaterization and multi-sig. For example on HodlHodl you can lend USDC where the borrow posts more collateral than the loan. The lender, borrower, and HodlHodl each own one key in a 2-of-3 multi-sig. If there's a dispute then HodlHodl will resolve it.


I believe he might be referring to flash loans, essentially the borrowed money is returned to you within the same transaction that borrowed it + interest.


I don't agree with calling flash loans loans. Money isn't borrowed, as you don't posses them even for a second. Instead it's more like "offer me an atomic transaction that will make me money, and I will run it with my liquidity". See: i'm not giving you my liquidity, i merely choose to use your strategy which is atomic, and you cannot change your mind and steal the money halfway (as in borrowing).


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: