Hacker News new | past | comments | ask | show | jobs | submit | more _fsbf's comments login

Don't have any data on this, but I know a bunch of not-so-tech-savy people that don't use lock codes. Their data's then as naked as a greek nude.


If the device is not locked, how about just launching the Mailbox app and browse the attachments via its fancy UI? :)


On any app that consists of sensitive information, one should probably implement passcode security on the application itself. Now this might annoy some users, but if you know you are going to use it for something special, you won't mind it!


So therefore, your article could have been titled "{Mailbox|GMail|iMail|all_other_mail_clients_ever} is a Security Fail!"?

Because as far as I am aware, few mail clients either support or (if they do) actively encourage an extra password layer, and your users do not want it. Given an average un-password-protected phone, you will be able to read their email even if they were using the iOS encrypted files framework, just by opening the app.

I apologize, but it appears that your headline is deliberate sensationalism. If you want to have a discussion about how we need to secure email apps in general, I'm interested. If you want to just pick the latest 'big thing' and take pot shots at it, nah.


@tmpajk How does it make Mailbox more secure. Let's talk about the scenario where you have access to an iPhone for few minutes. In one case, you can go through some contents, in another case you can copy all emails and contacts. My whole point is files or attachments on information on every app that has sensitive information should be protected. There are various ways to do it on iOS! One can use keychain to store some secret key and protect these files using that secret key.


The risk is that people assume their email is secure because the email storage on the iPhone is secure.


Where is the key kept then? One possibility, the user has to know it, at which point we're back to the fact that users dont seem to want a password for their email app (again, happy to see an interesting post on the generalities of email app security). The other approach is to store it somewhere on the phone, at which point connecting the phone to a computer as you describe is still an attack vector; you just need to find the key.

Of course, I am not highly versed in security, so if there's another option I'm interested to hear it.


One can keep a secret key anywhere other than Document or Library directory of such apps. One of the obvious place will be device keychain.


The very fact that so many apps (Facebook, Twitter, Mail etc) remain signed in while not in use prompted me to use a lock code (albeit with a 5 min grace period, a trade off for convenience). I can't see why anyone wouldn't want it enabled.

I think most devices paired with an ActiveSync (Exchange, GMail) account are required to use lock codes.


Thanks for pointing that out (: The blogpost explains how in learning C after years with PHP, MySQL, JavaScript and Objective-C one discovers little things about CS that weren't visible before while working on a higher abstraction level.


Reading the document kind of felt like being a journalist with a piece of highly secret leaked government data in his hands.


It's an interesting claim to say that iOS has aged poorly. I tend to agree that the use of skeumorphic design does make the standard apps look a bit out-of-date, but is that really a problem? How many powerusers are really bothered by this? If you don't like the Podcast app, just get Downcast. If you don't like Calendar, just get Fantastical. And using your claim that skeumorphism helps smartphone newcomers adopt the platform more easily, isn't the current situation a sort of a win-win for the iOS ecosystem? Newcomers get an easy entry and more versatile users can enjoy the great results of third-party developers.


It would be much less of a problem if iOS allowed one to actually replace stock apps with new ones. There's no way to make GMail my default mail app, Chrome my default browser, etc.

Lack of intents is also a serious problem, apps have to specifically support sharing to each source.

A related issue is the lack of system accounts. One has to log in to each app separately, even if many of them use the same account.


Oh, there are a lot of serious problems with iOS. After 3 years on the platform, you start to see that restriction-based badness all over the place. But one shouldn't forget that Apple has built an incredible product with one of the most secure OSs in the world and offers one of the best UI SDKs available. Those facts alone make me want to cut Apple some slack from being such assholes when allowing users to make more low-level decisions.


On the other hand Android allows nonsensical sharing options - there's no way to launch the email app, you have launch a ACTION_SEND_MULTIPLE which will launch Skype, or GMail or Mail or various IM apps.


And why should the developer have to care if I want to send something via Gmail, Skype, or carrier pigeon? As long as Android abstracts the data properly within the Intent, the target app should be irrelevant.


That's true, but the Android approach for accomplishing it is kind of horrible. For one, far too many apps respond to message types that don't really make sense to me. I don't know that this problem is avoidable with freedom, but the lists of available apps for any particular action are often long and very confusing.

I have witnessed this confusion with users, and it really hurts the platform in a lot of cases, IMO.

I can select one to be the default "always", but this doesn't work well either. If there are five applications that can receive a particular intent, my selection of "always" will be lost every single time that ANY of those five applications are updated. So, in practice, my "Always" selection typically only lasts a couple of weeks.

There HAS to be a better way.


I'm not sure you're correct here. A developer can specify a particular package to launch Gmail or the stock mail app, something like:

Intent intent = new Intent(Intent.ACTION_VIEW); intent.setPackage("com.adobe.reader");

Would open the adobe pdf reader for instance.

That said this is hardly desirable from a users perspective.


Even though a lot of smart people agree that we can only get a few hours of real concentration a day, not many of them link to scientific papers that support this claim. I would agree that the claim "feels right". But in absence of a real experiment, how valuable is this insight really? Maybe useful to keep the idea in the back of one's head, but seems far from a definitive answer.


I imagine that any feasible scientific experiment would measure only a crude approximation to reality. How can you randomize someone to a job and a way of working? Most people are not capable of concentrating for four hours a day, or have jobs that don't permit it.

At best you might recruit some undergraduates -- nearly all psychology subjects are college students -- and have them do some artificial task one way or another for a couple weeks. I find anecdotes from successful musicians, scientists, and authors more persuasive than data from an contrived scientific study.


Those are good points and I agree with everything you said. And even though anecdotes are informative, they may not be enough to make big important claims about how people should manage their mental energy.



Sorry to point this out, but you sound more like a recruiter than a designer. I'm sure people would answer your questions if you would ask them a little bit less bluntly.

My answers to your questions are: 1. I showcase the projects I've been working on 2. I don't describe the projects, just point a link to them, they should describe themselves (README, code comments, etc.) 3. Someone very skilled to make them good money with little hassle


I don't describe the projects, just point a link to them, they should describe themselves...

Can't disagree more.

If I'm hiring a freelance developer, I want to be assured of their "here's my problem, help me come up with a solution" abilities. Simply linking to an app they build for a client or a Github project doesn't necessarily tell me everything I want to know. Why does this exist, and what problem was it trying to solve? And did it end up solving said problem, if so — how?


If the readme (or the front facinf page of the project) doesn't answer those questions I wouldn't be interested in it, and even less in its developer.


It works surprisingly good. Tried it out for my hometown "Suceava", a small forgotten city from northern Romania. The information one gets is really useful and seems to be mostly accurate.


When I went to Budapest (this summer), it contained invaluable information about the city and some scams that ticket inspectors pull. I was able to avoid it and help a few fellow passengers because of Wikitravel (now Wikivoyage). I would definitely recommend it, it was entirely accurate in my case, and for the few Greek cities I skimmed.


mostly accurate?


In the world of travel guides, mostly accurate is pretty much the gold standard.


The donkey was basically asking for it. What was it doing in the middle of nowhere, anyways? Probably slacking while another donkey from China was doing the work for it for a sixth of the salary.


Looks like the star programmer took advices from "The 4-Hour Workweek" one step too far.


Brain fart: AJ Jacobs was the first to do the whole outsource your life thing. If I recall correctly, his experiment was published in Esquire magazine. Tim openly gave Jacobs credit for the idea.


At the moment not very concerned about digital privacy and security


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: