Hacker Newsnew | past | comments | ask | show | jobs | submit | 58x14's commentslogin

I spent half my day following your launch, and it looked like things were going downhill pretty quickly. How have things been since? You turned on your paid subscription signup?


I apprecate you joining in on the chaos! It was definitely WAY more attention than I was expecting. That's why I had encouraged people not to pay during the announcement post - I was more aiming to show off a side project rather than launching a platform. It was an absolutely crazy week, especially considering I was launching a larger feature for Figma (my day job) two weeks after that.

Three of the biggest issues was there was an off-by-one error in the payment amount selector (which imo is unacceptable for anything paid), the subscription cancellation button didn't work, and the mobile view (which made up ~60% of the user agent requests) was broken (especially when logged out). I fixed those and started rolling out regular updates as well: https://non.io/#updates

Launched a bunch of new features since, but really what I'm waiting on before promoting and trying to get things off the ground is the iOS app. Overall it's been wild ride, but the thing I'm most proud about is the $119 I've paid out to users. It's a tiny amount in the grand scheme of things, but it proved the platform worked and that the distribution of funds worked.


Welcome to the valley of despair. It is dark. It is cold. You feel alone. You will get through this and emerge stronger than you ever were. Stay the course.


Damn, I have a few of these. I keep them backed up to a RAID setup but still disappointing to hear.


Years ago I tried to install and sign up for Turo on iOS to rent out a car I owned. It was a luxury car with a rebuilt title.

After I put in the VIN of the car, I received an error, and inexplicably I was banned from the app. No notification as to why, no "we don't accept rebuilt title vehicles," nothing. Naturally I scoffed, deleted the app and forgot about it.

Last year a friend rented a few cars on Turo for a trip and added me as a driver to one of them. I had switched phone numbers but kept the same phone. I downloaded Turo again and signed up with a new phone number and new email.

Before Turo even asked for my driver's license information, I was blocked again. It must be due to fingerprinting, which persisted over years.

I'm unsure how much apps can learn about your user profile, other apps you have installed, and other uniquely identifiable data. I've assumed it was limited, but perhaps I've been naive.

I guess these new rules are generally good? But I can imagine for every nefarious usage of these APIs, there can be a plausible cover reason...


Since you kept the same phone, that was probably DeviceCheck, which gives you 2 bits to store “fraud” related flags.

https://developer.apple.com/documentation/devicecheck/access...


Why does Apple let your device work against your own interests? If an app developer wants your phone to detect you committing "fraud", that should be their problem.


Why would Apple ever prioritize their customer's interests over their own? They've never once suggested that they would, and their customers prefer a hierarchical relationship. Apple is a company that whitelists which functions of a general purpose computer that their customers will be allowed to use.

That makes some people feel really secure, like the company is a loving parent, although companies don't love. They decide what is profitable and what is not.


Why do mail providers work against your interests by blocking outgoing spam? Because in aggregate it's beneficial to users if external parties can trust the more.


That's different because you block spammers' messages on your servers, without the cooperation of the spammers' computers.


I mean the same reason Apple uses your phone to scan for nearby AirTags.

This isn't a feature that is actually costing them sales but a lack of DRM/etc affects what apps will be in their store.


It certainly costs them some sales, but not enough for them to care about.


That's a weird hill to die on.

Service providers need to ban people sometimes. This includes people who are savvy enough to know how to delete and reinstall an app to clear its settings. Never permanently banning anyone simply isn't a thing that's happening.

If Apple didn't provide DeviceCheck, or something similar to it, service providers would use some other means of deterring abuse. There's a couple directions they can go in, but they're all generally worse for users (e.g. using invasive tracking, requiring users to pay for service, etc). DeviceCheck is about the least invasive way I can imagine this being implemented.


> probably DeviceCheck, which gives you 2 bits to store “fraud” related flags

Does resetting your iPhone (Erase All Content and Settings) clear out data like that?

Does doing a restore from backup put that data back on your iPhone?


The linked article says the 2 bits are stored on Apple’s servers.

I.e. they could persist even if the device were bit-for-bit reset to factory state.


Is that basically serving the same purpose as Android's SafetyNet attestation?


It’s a little different since it’s meant to basically be a persistent identity. App attest is the more comparable technology for SafetyNet.


It could have been simply some data put in the keychain. That persists through app deletion.


It used to. They have largely changed that now - all data is deleted once the last app from a given vendor has been deleted (though it's not instant, and seems to apply weirdly on TestFlight + ad-hoc builds)


I delete Facebook a few times and every time I installed the app the first screen I got prompted with was "Hello Josh, would you like to sign in with your stored details?" Not all data is scrubbed. This persisted to even today running on iOS 17 Public Beta.


Did you also delete Messenger, Instagram, Whatsapp and Threads?


Yes.


I have experienced the same thing. Even when Apple made changes in Keychain policy to try to combat fingerprinting, “I never got the memo.” That sounds nuts, but I’m in the same boat.

I’ve had a few apps I’ve redownloaded months later, the only one from the developer, and my auth state was preserved.

I keep hearing that the Keychain data should be deleted, but my iCloud Keychain is filled with long-dead data


It's most probably keychain.


Probably keychain, but maybe just iCloud?


On the app I'm writing, keychain info remains.

I have a specific debug setting to wipe the keychain.

Sign in with Apple also generates a persistent ID with each app. That could be used to fingerprint the user, but not the device.


I think this behavior hasn’t changed: https://developer.apple.com/forums/thread/36442


Everything in this space is so muddled. Deleting the last app from a vendor should erase that data. On the other hand, if you restore your phone from another device, that should never require relogging into anything.


I used to go out of my way to take encrypted iTunes backups because it restored app state perfectly.

After some iOS release though, every app started doing "new phone, who dis" regardless of the restoration strategy, so I stopped wasting my time.


Yeah, last I checked, encrypted itunes backups would keep the "this device only" keychain data. Which would only work when restored to the same device - it needs the UID key from the secure enclave to decode. (I wrote code a few years ago to decrypt the rest of the keychain.)

At one point, google authenticator started marking its entries as "this device only". I don't know if they've backed off on that since then.


This does not align with my experience. I see Uber automatically log me in on a fresh install after I've uninstalled the app for months.


No, I tried to completely delete Tiktok. It's impossible.


Keychain and DeviceCheck are likely how.

Apple needs to get their shit together with these two APIs.


There’s other ways. Like iCloud - you can store something on a private container and it will persist in the users Apple ID


I heard recently (on Lex Fridman's podcast with Marc Andreessen) that Oppenheimer was called a "cry-baby scientist" by President Truman, and that his groveling campaign was considered by many to be self-aggrandizing, albeit in a self-deprecating way.

Apparently, his involvement was less significant than many others in the Manhattan Project, but his name became one of the most well-known due to his public outcries, and of course his iconic quote.

I haven't yet seen the movie and I'm looking forward to it; I wonder how much of this is portrayed.

Funny enough, I'm planning a double feature with Oppenheimer and the Barbie movie. Maintaining a healthy relationship involves tradeoffs.


> Apparently, his involvement was less significant than many others in the Manhattan Project

He was essentially the project manager, so I'm not sure how this is possible.

Are people simply suggesting that he wasn't the one who did most of the actual science? If so, that seems like missing the point.


Alternatively, have you considered that the guy organized and ran the development of the atomic bomb and that those specific podcasters might not be particularly objective in their analysis?


He both ran Project Y and contributed to it in meaninful ways. And managing the project was not simple on a technical/engineering level nor as "big science" (as Project Y essentially invented the term).


> on Lex Fridman's podcast with Marc Andreessen

There's two to talk.


General Leslie Groves thought very highly of Oppenheimer, and if you got the stamp of approval from Groves, you were doing something right.

Oppenheimer was dragged through the mud during the red scare and his name is still tarnished because of that. It is ironic and a little sad that he was awarded the Fermi medal once his name was finally cleared because Fermi worked for him during the Manhattan Project. It probably would have been the Oppenheimer Medal if it weren’t for Senator McCarthy.

Oppenheimer beat Heisenberg (also a pretty smart guy) to the bomb and not by a little either. And thank whatever higher power is out there he did.

Oppenheimer was a genius both in theoretical and practical physics work. It is a shame that he doesn’t have a better reputation today. And when it comes to his “campaign”, well, he had good reasons for his concerns. The second atomic bomb dropped on Japan was dropped without the president’s knowledge! He realized that we were not ready for that weapon and still aren’t to this day.


Cool, I've had "add a personal calendar appointment scheduler feature" on my backlog for months, and for some reason I just didn't want to do Calendly. Maybe it's because I'm pretty averse to overgrown SaaS?

I like their messaging and I'm more inclined to use a tool ran by a team/company like these guys.

Consider me a customer... whenever I clean up the backlog


Surprised to hear no mention of Obsidian (https://obsidian.md/). I switched from Evernote to Notion years ago and finally switched beginning of this year from Notion -> Obsidian.

Top reasons:

- local first files stored in markdown format (somewhat future-proof); this also allows a Git repo sync

- multiple ways of syncing Vaults (their term for a workspace); can store Vaults on iCloud, Dropbox, or with Obsidian's Sync service which is E2E encrypted

- rich plugin ecosystem

- can style pages with CSS and run various code, like javascript, from inside the editor

- Graph view and Canvas are extraordinarily useful visualizations of your data

- supportive and prolific community, from their forums, to YouTube creators and bloggers; simply search "Obsidian intro" or "Obsidian tips" or "Moving to Obsidian from ___" for inspiration


Every time someone mentions Obsidian, I'm reminded that I like it, but not as much as paying $8 USD monthly for being able to sync notes to my other devices.

I pay a couple of cents per GB per month for rsync.net, and I understand they're very different use cases, but why is syncing my 40 MB of notes so expensive?


Obsidian runs on a local folder of files on your device, so there are a dozen different sync services you can use including several free options, e.g. Git, Syncthing, etc.

With Obsidian Sync, your $8 don't only go towards syncing. It helps Obsidian remain profitable and 100% user-supported (no VC investors). Subsidizing costs in pursuit of growth is what got Evernote here.


I sync with Google drive and Drive Sync on Android for free.


It seems like there's a lot of recent interest and effort in open-source or self-hosted Notion-like/markdown-with-widgets applications and platforms. AppFlowy (https://github.com/AppFlowy-IO/AppFlowy) comes to mind; I attended one of their monthly "town hall" meetings a few months back, and looks like they're rapidly increasing in popularity. I think there was another similar project like this on HN front page last week, IIRC.

This makes me happy, because I switched to Obsidian primarily for local-first file storage in a platform-agnostic format. I've learned to love many things about Obsidian and am writing a few plugins myself, but there are still several Notion-esq functionalities I wish I had, and I find myself handing off between Obsidian and other webapps for certain effort, like team project management.

I used to get far more excited to explore new projects like BlockSuite, and I really appreciate their documentation, but I find it hard to justify allocating time to reviewing and trying out new tools when I still have much more improve on with my Obsidian usage; this is especially true of newer projects where I'm unsure of their shelf life.

To assuage my internal conflict I remind myself that I think plaintext is fundamentally the right choice for much knowledge collection, and I'm proud to say that if the internet shut down, I'd retain a significant growing fraction of my personal data.


It would be interesting to have your perspective, as an Obsidian user, on Logseq(https://logseq.com/). I say this, as like you - I moved towards this for local-first file storage, where content can be edited on any device with any editor and where I have more control over my data.

I did try obsidian briefly, but eventually gravitated towards Notion for knowledge and project management - but found that the bulk of the content I put into this would eventually go stale/unused simply because content was not linked and would instead be held in a table, within a project/area full of other pages of notes. I then found myself on Logseq for the reasons mentioned prior.


I'm using and enjoying Logseq but I don't think I am getting as much out of backreferences as other people. I try to keep projects under a single page and make additions to that page. I'm curious how you are using it, if you have time to share? I am always hoping to steal some ideas that improve my usage for note tools.


I switched to Logseq from Obsidian and like it a lot. The PDF annotation features and ability to use Org Mode are what won me over.


How does this compare to outline?

https://github.com/outline/outline


Does Outline have mobile apps? The name makes it hard to search and find anything relevant


Sadly they rely on PWA for Android. PWAs work but has their own set of issues.


Setting it up is a little bit complicated.

I wish they have a offline electron app.


AppFlowy looks nice. I get a project management tool vice from it. I have been using Zim Desktop Wiki for many years now, for pretty much the same reasons you mention, and I never had the idea "hey I need a kanban board in here". Why would I use AppFlowy for note-taking? What do you use it for?


I too use Obsidian for my personal things that feel too important to not always have up to date local copies of. It works well. Haven’t yet found anything I’m missing compared to Notion though.


So, to mitigate, avoid changing Github organization names if possible, and if not, preserve / re-register the former organization name to prevent impersonation?


If you don't have a lot of projects, it may be better to transfer them into a newly registered organization because that doesn't require a temporary drop of the namespace. Either way, you'll break the redirect, but that's better than being vulnerable to impersonation IMO.


My first 5 minutes have been positive. I've worked for years on a similar platform but never expected to have the time to ship, so I appreciate that you've implemented a few patterns/features that I was hoping for, namely tag-based subscriptions.

Bug report: on latest Firefox with uBlock Origin, I have a strange UI bug on the root/home page: without any activity from cursor or otherwise, there is a dropdown that appears to show emails saved in my browser for form auto-fill. This is visible in the top left which seems to be in the same place where your registration sidebar is.

I have quite a number of thoughts and questions which I'll move to the platform. Great job.


Really? Why would they fire that off from the client as a separate call? Thanks for the heads’ up, will check out.


Perhaps because they don't want to actually block you from doing this, but want to have the plausible deniability that they put measures in place?

(And 'they' here might mean the company as an abstract entity, or perhaps just the engineer put in charge of implementing this feature?)


Validates output at time of rendering, so you can't trick it with obfuscation techniques.

There's a browser plugin called DeMod or something that disables it but I don't know how well it works.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: