Hacker Newsnew | past | comments | ask | show | jobs | submit | JustSkyfall's commentslogin

I mean, considering that it's been 13 years since the release, I think they did pretty well!

This is really cool (especially considering that the pricing is way better than Persona/Stripe Identity)!

That being said, what security measures does Didit take, and has it gone through e.g. auditing or SOC 2?


Thanks! We have ISO27001, iBeta PAD, and about to receive SOC 2. We also do bug bounty programs, and pen-testing.


Can't see any mention of bug bounties on your site - do you have any details you could share?


Rails 8 is surprisingly good nowadays. It absolutely still has its share of problems (e.g. Bundler being slow, the frontend story being crappy without Inertia, lack of types which is a biggie, memory) but it is still a fantastic framework imo.


Why Inertia.js? I quite enjoy not using JS heavy frontends in Rails by leaning on Turbo and light Stimulus JS controllers where needed. My experience going hard into Vue+Rails was full of pain and I've rediscovered why server first makes everything easier to reason about instead of duplicating tons of logic + dealing with constant async issues (particularly around automated testing and complex data loading).


Inertia because it’s a plug-in replacement for ruby html templating aka erb. Try it out, it’s basically the same stuff you get from erb, without the need for Turbo’s web sockets. You get server side rendering, all the great BE stuff like server side validation, but no SPA headache.

I find the best DX with Adonis/nodejs and typescript.


Somebody should port uv to Ruby :/



And I agree! It's something I touch upon halfway iirc, but their suffering shouldn't be something to laugh at or mock. It's genuinely upsetting to see to be honest.

At the same time though, I don't think it's healthy to let them go on with 4o either (especially since new users can start chatting with it)


People are not happy with this because 4o, at least from what I've heard, seems to be much more willing to go down the relationship/friend path than 5.2 and Claude and the like.


My theory is that the vast majority of users won't have an Android with root access/a jailbroken iPhone, which reduces the risk of using a virtual camera? Then they can just block emulators/rooted/jailbroken devices which increases the barrier to entry.


Supabase seriously needs to work on its messaging around RLS. I have seen _so_ many apps get hacked because the devs didn't add a proper RLS policy and end up exposing all of their data.

(As an aside, accessing the DB through the frontend has always been weird to me. You almost certainly have a backend anyway, use it to fetch the data!)


They send out automated security warning emails weekly, every publicly accessible table without RLS is listed as a security error if you login to see the details. Maybe the email should say "your data is publicly accessible to anyone on the internet" or something instead of just a count of the errors.


It really Should be as simple as denying public access until RLS policy exists.


The government is somewhat complicit - there are even reports that the police take escapees back to their captives for a bribe


this is far bigger a problem and requires interventions from China and India. what good is it to just punish the people who ran the scam but not the country that supported it?


You can definitely vibecode an app, but that doesn't mean that you can necessarily "get smarter"!

An example: I vibecoded myself a Toggl Track clone yesterday - it works amazingly but if I had to rewrite e.g. the PDF generation code by myself I wouldn't have a clue!


That's what I meant, it's either, or. Vibe coding definitely has a place for simple utilities or "in-house" tools that solve one problem. You can't vide code and learn (if you do, then it's not vibe coding as I define it).


https://skyfall.dev - this post reminds me I should write more though!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: