Hacker Newsnew | past | comments | ask | show | jobs | submit | maccard's commentslogin

The doordash story is very relevant here - they started with a menu and a Google voice number and did the orders and deliveries themselves.

I worked on this for a pretty big game. We recorded the network traffic and played it back and simulated the game - so same problem with patches. It also has the awkward side effect of exposing a metric crap ton of “join in progress” style bugs because our game didn’t support JiP.

Machiavelli nailed this 500 years ago in the prince. If one person always plays by the rules, they will lose to the group who ignore the rules,

If google really cared about privacy, they wouldn't have moved maps away from a subdomain. now if I want maps to have my location (logical), I need to grant google _search_ my location too.

It's not all-or-nothing; sometimes some people at Google push for some things to improve privacy. Rarely happens when revenue is at stake.

Android used to ask you "do you want to alllow internet access?" as an app permission. Google removed that, as it would stop ads from showing up. Devastating change for privacy and security, great for revenue.


It's not great for revenue, it is their revenue.

People act like Google products are a charity that had been free forever, and then this mega-corp called Google came along and started harvesting the data of innocent people who just want to get directions to Starbucks.


Google is pretty much just a wrapper around DoubleClick.

GrapheneOS still does this -- allows controlling internet access on a per-app basis.

It's one of the big reasons I advocate for graphene even if one chooses to install Google services afterward.

Also notable: as of last year, OnePlus allowed mobile and WiFi network toggle, effectively doing the same thing.


For those of us stuck on normal android, is there a way to achieve that? I know it used to work with some firewall apps but nowdays they all require root access.

Rethink DNS can block internet access of an app (besides doing DNS-based blocking, etc.): https://rethinkdns.com

It uses the VPN functionality, but you can stack a Wireguard VPN on top of it.


Netguard No Root Firewall still works for me: https://github.com/M66B/NetGuard

+1 for Netguard, it is awesome. A bit clumsy UI, but indispensible.

It looks like you can't revoke the internet permission, but you can use the firewall via ADB. Settings are lost on reboot, but you can use an automation with Tasker or similar to set them on boot:

https://www.reddit.com/r/tasker/comments/1mxjnvs/how_to_bloc...


Not the same thing, but you can install an app like Blokada Libre to block ads and trackers in all apps.

https://blokada.org/


Or you can set your DNS resolver to dns.adguard-dns.com and it blocks almost all ads. You can search "private dns" in Android settings app and set it there.

This has the disadvantage that you can’t whitelist specific domains, which is something I need pretty often.

You can signup for private adguard dns, then you should be able to whitelist domains.

Go to settings > App > $SCUMMY_APP > Mobile Data & WiFi. Uncheck all.

Not a thing on stock android

Why does Apple not give that Wi-Fi option there? I mean, is there a reason we’d be sympathetic to?

iOS allows this, but only on mobile data, which is pretty infuriating. Why should I not be able to also restrict apps from dialing home/anywhere just because I'm on a Wi-Fi network (which isn't even necessarily unmetered)?

It's really annoying. I have a sudoku game on my phone, works great but give it internet access and it's suddenly full of sketchy adverts.

If I'm playing it on my commute, it's usable with mobile data disabled for the app. But when the train stops in a station long enough to auto-connect to wifi, immediate full screen adverts :(


Then don’t use an ad supported app? I have one as supported app on my phone - Overcast. The developer created their own ad platform and serves topic based ads based on the podcast you are listening to right now. Ironically enough I started to pay for a subscription even though it didn’t give me any real benefit just to support him until he started having ads.

I’ve found a lot of useful podcasts from the ads.


The OS ought to let you deny internet access to an app entirely, but DNS-based adblocking might solve your problem: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

I’m gonna be That Guy for a minute: if you enjoy using a Sudoku app, isn’t there one available on more acceptable terms, e.g. a single purchase or a IAP that removes the ads from this one? I’m not saying you have to pay like $3.99/week for a scam one, but more like pointing out that if you don’t like ads (as I also don’t) why not support the developers who believe in selling software to you for a few bucks rather than selling your annoyance to Google via Adsense?

Google doesn't care about privacy, but its easier for them to keep collecting your data if they can also keep it from getting unintentionally leaked to others. The last thing Google wants is for people to start thinking about the amount of data they're handing over.

Google has your location either way. What difference does it make?

You can lock down their usage. Limit it to three months storage and minimize sharing. They still report an old address for home and work for me since I dialed up the restrictions years ago. They have the data but it is less exposed.

I honestly don’t understand the scenario you’re defending against. Google still knows where you actually live and work trivially. If you don’t trust Google you should just de-Google completely.

I also don't trust my government. So should I just degovernment completely? Sounds just as practical or realistic for most people.

"Just move" seems to be a pretty popular sentiment, in that scenario.

As if the government doesn't monitor both non-citizens and ex-citizens living in other countries too.

You’re saying moving on from Google is similar to switching government?

Switching government and deleting google are probably on the same order of magnitude of difficulty for most people.

In a way, yes, as google de facto governs and controls much of the internet.

Have you tried moving on from Google, and preferably not to Apple?

Yes, it’s trivial. What are you having difficulty with? There are plenty of threads here on HN about this

If you think it's trivial you must not be paying attention. You cannot keep your data from Google. Government websites include google tracking. Google drives past your house to take photos and sniff your wifi traffic. Your employer hands your data over to google. Your doctor hands your data over to google. Your bank hands your data over to google. You can limit how much you actively and voluntarily give them, but you can't free yourself from them entirely and still function in society.

Trivial? Ha! Way to say that you never tried it. Either that, or that you don't care for things like push notifications. Yes, most of the things work, but not nearly all of them.

Not GGP, but I suppose the general idea is: Granting permanent location permission to maps.google.com seems a bit more privacy preserving than granting it to *.google.com, assuming one opens maps significantly less often than e.g. GMail, search etc.

I'm not sure I follow. maps.google.com still resolves?

maps.google.com now redirects to google.com/maps and has done for the past few years.

Ahh I see. Thanks.

Thing is though - either of those options is still multiple orders of magnitude faster than running on a remote host. Either will work, either will scale way farther than you reasonably expect it to.

> they're usually resold when the employee gets a new one

Are they? Everywhere I've worked they get shoved into a storage closet and ignored for another 5-7 years


It's pretty common if you have IT and finance teams that are paying attention. Sure a lot of shops let them waste away on a shelf, but that's what it is, waste. If you have fungible inventory that isn't likely to get used soon it is just a mistake it let it sit around unutilized. If it is cash, it is easier to utilize on other projects.

My previous company was overly cost sensitive, but large enough to not notice the waste. IT and procurement managed relationships with the vendor (Lenovo IIRC), and we had the workstations for 3 years officially but most people were 5-6 years. The hardware 100% just went back into storage when we cycled and would be given out to new hires when they joined. We were using Threadrippers with 128GB RAM and NVMe SSDs anyway...

My old mac was supposed to be donated to some place, but they had forgotten me to tell the iCloud lock is still on there. They wrote me on LinkedIn and as they were a good employer, I did unlock it

Ours are on lease, but the leasing company will release some from time to time for auctions at $DAYJOB. I've won 2. Using one, son flipped the other one for a couple hundred dollar profit.

Every laptop I've ever purchased was corporate surplus

Apple has a buyback program for corporations.

Now you understand why people have non technical co founders!

I have a co-founder who is half-technical, and without his help and support I would not have been able to keep going on this project.

By the way it finally occurred to me who I should ask to do the deep dive: Gary Bernhardt


The trick to raising money is being able to convince an investor you are the person to build that platform, not being able to build the platform.

Given you're about to run a binary, it's no worse than that.

It is definitely worse. At leas a binary is constant, on your system, can be analyzed. Curl|sh can give you different responses than just curling. Far far worse

Only if you download an analyse it. You’re free to download the install script and analyze that too in the same way. The advantage that the script has is it’s human readable unlike the binary you’re about to execute blindly.

It’s absolutely mind boggling to me that we have gotten to a point that building a web frontend takes longer than compiling the Linux kernel..

As a non-frontend developer mainly observing and touching something here and there, a lot of the things that frontend developers do seem vastly over-engineered.

This is my understanding too - tools like react are like microservices - they’re a technical solution to an organisational problem. HTML/css/JavaScript is an imperfect abstraction, so we got bootstrap. Then we got client side frameworks which introduced a build step, and then we got asset bundles, optimisers, linters, validators, tree shakers, package managers, validators for your package managers. All of these monkey patched around the actual problem with more abstractions, and the end result is what we have now.

I'm not insanely deep into frontend, I mostly just pick up React and call it a day, but it seems like this is also over-engineered?

I've seen vanilla JS before, and I just know I wouldn't want to do the housekeeping that comes with it. People claim it's less work because it' simpler, but I fully expect myself to rewrite the thing at least twice, only to give up because I have no actual mental model anymore of how it works.


I have never in my career encountered a Vanilla JS project of at least medium size that I would have called simple. They all feature brittle selfmade frameworks whose developers have since left the company years ago.

I write C++ and C# all day - I think it’s fair to say the same about a project in any programming language!

Isn't the main problem that the building blocks the modern web is based on are not a good fit for what we do with it?

CSS is a total mess. HTML is a mess. JS is okay, but is not a high quality language.

We would save so much time and money if we would have a modern base to build on. Sadly this will probably never happen, because company interests will try to corrupt the process and therefore destroy it.


How are CSS and HTML a mess? Combined, they're an incredibly powerful layout engine that works almost the same across all environments and devices while also featuring easy accessibility.

When taking a bird eyes view on CSS it will be hard to oversee that CSS is a mixture of different concepts that evolved over time with a lot of inconsistentsies. It is possible to make it work, but it's not pretty.

Same for HTML. If the web would be reimagined today, there is a very low chance that we would create HTML as is.


the biggest problem with html/css is that they are tightly coupled. you can't meaningfully modify a layout with css alone.

second biggest problem is "no stricter mode". so even wrong or useless html/css code goes unflagged and is treated as it is normal.

CSS is way too powerful.


> you can't meaningfully modify a layout with css alone.

https://csszengarden.com/pages/alldesigns/

That statement wasn't true ages ago, and it's even less true now.


> you can’t meaningfully modify a layout with css alone Wut?

Same reason why 90% of websites have serious UX issues and constant bugs. This and ad frameworks.

Like using SPAs for classical Web development, and then they rediscover PHP.

It’s mind blowing when you check the generated code, because it goes over 50 elements deep for a simple looking website.

Makes me think that there’s no way this is computationally efficient either.


That particular issue is nothing to do with Next or React and everything to do with how HTML/CSS is a really shitty layout engine.

Hard disagree. This is JavaScript frameworks building a hierarchy for themselves and ignoring any sort of complexity on the generated DOM. There’s 0 reason for these 8-10 nested divs other than that’s what the framework spits out.

Not that backend is any better - microservices everywhere, must scale to Facebook traffic even if we only have 10 customers, etc. Saying this as a backend dev

And underenginered at the same time !

It's mostly because a lot of the web tooling is written in JavaScript. The build times for the "next generation" tools written in Rust/Go are dramatically faster.

Agreed. My frontend/react builds use esbuild, and rebuild fast enough that it feels like hot module reloading

C is infinitely less complex to parse and validate than Typescript. C is compiled in a single pass, the `tsc` type checking algorithm has to check structural typing, conditional types and deep generics while also emulating JS' dynamic behaviour.

I don't think any C compiler has been single pass for the last 20 years. Typescript's analyses are also not that complicated, it's just that the typescript type checker is written in js. Iirc the actual ts -> js part is pretty fast with some of the more recent compilers.

That's not the point...

I disagree - this is an excuse. Even the post we’re commenting in now shows that it’s a series of poor abstractions and bad tooling that takes way too long to do the basics, combined with a language and ecosystem that encourages this behaviour . They saw a 5x speed up by changing tools while still using a JavaScript framework so it’s clearly possible for it to not be complete nonsense.

Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: