Hacker Newsnew | past | comments | ask | show | jobs | submit | notpushkin's commentslogin

> A simple dropdown with a finite list? Has its own loader and makes 10 fetch requests for no reason. Not even exaggerating - look at Instagram and Facebook on web.

I’ve seen an address form with search dropdowns that were absolutely bonkers. First it loads the list of countries. You start typing and the list disappears – it sends the text to backend, which returns... exactly the same list. The filtering is then done on the frontend. (After you select the country, you can select the region and then the city, which, of course, work exactly the same.)


Evil Martians have a nice write-up on the login forms: https://evilmartians.com/chronicles/html-best-practices-for-...

The “Question? Answer.” format seems way overused, too. I don’t usually comment on “LLMiness” of blog posts, but here it seems to somewhat devalue the point the author is trying to make.

It is, indeed, heartbreaking to learn that the one person in a giant corporation that cared about your problem enough to pull some strings and fix it gets laid off. But if you truly care about them, why don’t you try and write about it yourself, in your own voice?


Yandex has quite a few international entities, which are probably not direct subsidiaries, which in turn probably helps with sanctions. Yandex Cloud seems to be sold by a UAE company internationally: https://yandex.cloud/en/about#impressum

Make it a “tourist eSIM” for a good measure. Your phone will be in one country, your exit IP in another (because there usually use roaming).

That said, you might still want to use a VPN on top of that, depending on what you’re doing.


This might be a good idea, but consider banning them for, say, a couple hours at a time. It’s easy to rotate IP, especially if you’re using a residential proxy service, and there’s a good chance you’ll end up blocking real users using the same ISP.


yeah, I'm using https://proxybase.xyz for this. It's like Mullvad but for proxies. No kyc, no email but supports xmr.


You should put your business (https://proxybase.xyz) in your HN profile. It might help to find more customers.


I’m not here to promote anything just wanted to share a valid use case in the right context.


And yet you regularly promote you own commercial product using submarine adverts on HN. Hmm... I can think of few other behaviours that HN commenters like less.


Do they say how do they have access to those IPs? Most residential IPs are malware-infected devices.


That’s part of our value proposition. It’s same as when you go to a bank and ask where the yield comes for your account or asking OpenAI where they get data to train their models.


> or asking OpenAI where they get data to train their models

Yes I know it comes from pirating/torrenting/scrapping. Are you saying you acknowledge your IPs come from malware, and that is OK because OpenAI is shady too?


For the context, I have the right not to tell you anything about how we operate our business but we're not shady, we don't take any action without user consent. The other thing is that we don't use "source" keyword in our business context. I think when you use that essentially you inherently accept some part of your business is shady as hell. Instead, we use "providers". That's a lot better.


Is this your service? Since you've made seven posts to HN about it and also your username shows up in the commits on their GitHub.

Because I'm quite curious on where the IPs are from. Usually residential IPs is a fancy wording for malware infested devices from regular people.


> Is this your service? Since you've made seven posts to HN about it and also your username shows up in the commits on their GitHub.

Ohh, that makes sense haha.

@m00dy: please disclose when you’re talking about your own projects! It’s okay to plug your stuff sometimes, just be honest about it :-)


I’m not hiding anything :-)


No, but you weren’t upfront about it either. I’ve suspected it looked like your own project but checked your comments in the profile and didn’t see any other, so I didn’t dig any deeper.

> I’m not here to promote anything just wanted to share a valid use case in the right context.

There’s a small difference: if one of your users did this it would be totally fair, but when a founder does this I think it’s a polite thing to disclose it. That’s what I’ve been doing when talking about my own project on HN [1], and I think in most cases other legit founders just say that upfront, too. I’m not sure if that breaks any rules, but it feels juuuuust a bit shady not to :-)

[1]: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...


    > Since you've made seven posts to HN about it
Do you have a tool to text search a user's comment history? Your comment is very specific: "seven"!


https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

(Seems to have some weird cache issues though, had to play around with the ?querystring part to get more results)


Yeah I also have to fight the URL parameters on Algolia from time to time, the JS front-end seems to have some syncing bugs

Makes me think I should probably have reported it, even if I found a quick-for-me workaround. Looking at the repo, though, it was discontinued several months ago. https://github.com/algolia/hn-search Wonder how much longer it'll be online for


Actually should have clarified, I meant submissions not general posts. I just searched their profile's submissions and found seven mentioning proxybase. I actually didn't check their comments.


To me, that is even worse that comments. That violates my internal rule about submarine adverts. At least they can be honest about it and add their business to their profile, and mention it when they submit.


I like the API-centric nature of it. $10/GB seems a bit steep though, especially compared to Mullvad’s 5 €/mo.

Search for “mobile proxy” – those are usually cheap-ish monthly subscriptions, with unlimited traffic, and often an API to rotate the IP programmatically if you need it. No KYC, but you usually do have to sign up with an email.


@ notpushkin,

yes, it's a bit more expensive because it's for different use cases. You can't use VPNs or Mullvad for anything mission critical. Just try to log in to your bank in US, it will increase your risk score on their end because VPNs by nature are very easy to detect whereas "residential proxies" much harder.


> You can't use VPNs or Mullvad for anything mission critical. Just try to log in to your bank in US, it will increase your risk score on their end because VPNs by nature is very easy to detect whereas "residential proxies" much harder.

Naturally! I’m just saying there’s residential proxy providers that are a LOT cheaper than that.

(IIRC, you can usually reply to fresh comments if you click on the “n minutes ago” – the reply link should be visible there even if it isn’t shown in the main comments tree)


I think when it comes to privacy or XMR, money is not really that important. Just give me a few names that support XMR payments + no KYC and providing mostly non-flagged residential IPs that you can use them for mission critical stuff.


That’s a good question! I haven’t been in this scene for a long long time now, so can’t say for sure.

I’ve been implementing an Instagram liker service back in... 2018 was it? So a stable pool of non-flagged residential proxies was important here, and it was my client who introduced me to the concept of “mobile proxies”. Basically, they use regular 3G/4G/5G modems with regular SIM cards, and expose that as a SOCKS proxy. You get a normal-looking IP from a pool of mobile operator’s IPs. Since mobile devices reconnect all the time (and are behind a CGNAT mostly nowadays), you can’t really flag an IP like that – and if it is flagged, you can get a fresh one in a moment.

I’m not using this mostly because I’m too lazy to research. Here’s a random one I found (so not an endorsement!) which is $1/GB, seems to only require email to sign up, and takes crypto (including XMR): https://floppydata.com/


By the way, if you’re a webmaster doing this, look at the Accept-Language header instead: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...


I suppose you can use any nameserver you like, the only problem is it’ll be a PITA to change it.

(I’ve recently registered a .bt domain by filling out a PDF form, hand-signing it, scanning and sending to a Bhutan Telecom admin. Changing a nameserver would probably be a similar procedure now, and involves a one-time fee if I recall correctly.)


This. Plus if I want to access my bank account on a device I trust, the bank shouldn’t say “hey we don’t trust it so buzz off”. It’s my money in that account.

I understand there’s some stupid compliance thing that makes banks do this, but it clearly isn’t a hard requirement, as there’s still plenty of banks that don’t participate in this security theatre.


To be fair to your bank, it has to cover you if your money gets stolen through a hack through their app, no matter what your operating system is.


I’d very much love to have an option to waive that cover though! Just give me a scary warning “hey, we’ve determined your device is unsafe; so if you get hacked through that device, you agree not to hold us liable for that. proceed? [y/N]”

For more specific mitigations, they could issue shorter-living tokens to such devices, in case it gets stolen and it didn’t store the token properly (say, the user did something stupid like “hey I’ll substitute secure enclave with a shim that writes secrets to an SD card”). And they could limit certain critical functions that do require attestation for some reason (e.g. Host Card Emulation, aka “tap your phone to pay”, which they usually delegate to Google Wallet/Pay/Wallet anyway).

Wise seems to do it correctly. It works on rooted phones, even, just gives a scary warning and blocks some app functions. They also have a fully functional webapp, so you mostly don’t need the app anyway. Revolut, on the other hand, has outright blocked me from my account – so I’m not using it anymore.


You may waive that cover, but when (not if) you get hacked and your money gets stolen, someone still has to pay it back or you will die. Neither of those options are okay with the government and only one is okay with your bank.


  {"data":{"error":"Imgur is temporarily over capacity. Please try again later."},"success":false,"status":403}
There is some strange irony to this, I suppose.


In my experience, that error is a lie and is what you get if they've IP blocked you. (Easy to hit on a VPN, in particular)


I get "content not viewable in your region", from the UK. Not an ideal image sharing website nowadays.


Other countries are available. With a UK passport you can move to Ireland, Thailand, or Australia fairly easily, amongst others.


FWIW, I’ve got that error while in Thailand :D It resolved in a couple minutes though.


Are you seriously suggesting that that's a feasible, go-to solution for a problem in your country? For most normal, well-adjusted people?


Plenty of people leave countries all the time.

In fact, voting with your feet and leaving is far more effective at fixing political issues than the democratic voting process.


> Plenty of people leave countries all the time.

Yes. I've done so myself. The fact that people do this all the time doesn't mean it's the best thing to do when your country has problems.

People also move houses all the time. It's a big undertaking. Not the default solution whenever your kitchen needs renovations.

> In fact, voting with your feet and leaving is far more effective at fixing political issues than the democratic voting process.

Citation needed. Sounds very defeatist.


Rather, not an ideal legislation nowadays…


A protection against bad networks, including VPN.

It's been like that for over two years now.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: