I'll post an example for the parent just in case they are honestly confused about use cases. Here is one that happened to me. I had an eSIM on my iPhone. My iPhone broke (screen became somewhat unusable, and the phone was stuck in a restarting loop). It was an older model phone so I checked the repair cost and thought I'd rather buy a new one.
Bought a new phone. Now, to transfer my eSIM from the old phone to the new phone, I needed the carrier to approve. But I was away from my home country and on roaming. So I tried to call them. They needed me to use a verification PIN they would send via SMS on the old phone, to verify the transfer to the new one. Impossible since the old phone is unusable.
Back in the day, I'd have just taken out the sim from the old phone and moved it to the new one. Easy peasy.
The only other option in this case now was to visit one of their stores thousands of miles away. Eventually just ended up doing that when I returned weeks later but during this time I could not access several services due to lack of access to my number plus 2 factor codes being sent there.
Moving a sim from phone to phone was seamless. Now the carrier needs to approve this swap. Even with two working phones sometimes it's a hassle and there will be delays while carriers decide to approve the move. There is a new feature that allows you to transfer eSIMs easily between phones but carriers seem to be holding onto their power in this regard and not every carrier will let their sims move so easily. This possibly requires regulators to step in and solve the issue - make it up to the user to move eSIMs. I would count on the EU to make this easier at some point.
On the plus side, eSIMs are nice to be able to signup and provision them through an app. Helps with travel and roaming. So there's that too.
So for Visa Waiver countries one of the requirements is to keep that number under 1% or so to stay in the visa waiver program. For visa required countries, if the visa vetting process wasn't so strict, probably the numbers would be a lot higher.
It's well known that people often lie on visa applications and try to immigrate illegally. The US publishes a yearly review of overstayers broken down by country of origin. So you can see where the highest problem areas are. Sometimes this is masked because of way stricter visa issuance policies. So for example, you may not see a super high overstay percentage for India because many folks get rejected at the visa application stage. But still, this gives you a clearer picture of how rampant the lying is and the subsequent "disappearing" in the US.
I have several examples and lots of personal experience. I’ve been asked to go back from Mexico, Brazil, and Chile while traveling there and applying for a visa to Peru. Finally the Peruvian embassy in Chile gave me a visa to visit Peru because I accidentally bumped into the assistant consul.
Several more examples but in this day and age you can just ask chat gpt to summarize for you. But if you check visa application requirements for many embassies, they will often say: proof of residence if not a national of the country of application. So that’s the requirement often.
I will add though that I’ve always maintained that this is a soft policy and they will make exceptions in some cases. It is mostly consulates wanting to do as little work as humanly possible. So there can be ways to get around it if you can talk to someone in charge. But usually that’s very difficult with consulates.
I’m pretty sure though in the US’ case now it’s a hard no. So there will be no working around it.
This was already the case for almost every other country. Most embassies required you to be resident or a national of the country you are applying in.
So oddly, the US was far more permissive than other locales in this one aspect. All this change does is bring it in line with security practices that other nations already had in place.
Honestly am quite surprised that the US didn’t already have this restriction considering overall it’s one of the toughest countries to get a visa for or even enter with a valid visa.
The US visa vetting procedure is known to be so strict even for tourists that many nations give visa free access to nationals who would otherwise require a visa - just because they hold a valid (or sometimes even expired!) US visa. It’s a highly regarded sticker if you can get one in your passport and seriously ups the power of your passport if it’s a weaker one to start with.
Thanks for posting context. I was pretty annoyed at Revolut after reading the twitter thread but didn't know about this part of the situation. Of course, it's not obvious from the twitter thread at all.
Thank you for having the time and patience to reply to everyone about psychotherapy and how it's not a one-stop-shop to fix all your issues. I feel the same but honestly do not have the patience to take on this immense debate with mostly people who blindly believe that some person with a basic degree has the knowledge, insight, authority, etc. to solve your life's problems. I personally cannot reason with people who have based their beliefs on 'blind faith'.
The gist of it is that it depends a lot on your citizenship, the kind of work you do, and how it is all setup. Normally, taxes are to be paid where the work is done if you are a tax resident in that country. Interpretations vary so most nomads are on tourist visas and just fly under the radar. There is no proper framework for this kind of work yet. Even if you wanted to pay taxes in a country you're visiting it would be impossible in many cases because they wouldn't even issue a tax number without proper residence papers. You should be most concerned about your home country and speak to an accountant about that.
The context of this discussion is smaller publishers/bloggers/etc. If you see the grandparent post it's clear that industry leaders will not find it technically challenging to get on board with both TLS and HTTP/2. The question I asked about economic incentive is not in the context of the NYT homepage but thank you for the unnecessary snark.
A local script injecting an ad is not the same kind of MITM attack and is no way mitigated by enabling TLS.
The discussion here is not about whether encryption is bad. My aim was to ask about whether no encryption = no HTTP/2 for you and why this is the case. I understand that the technical reason at the protocol level is because of obsolete proxies often sitting on port 80 and also the protocol negotiation that needs to take place.
No, of course not. What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?
In my experience the times that I've had users complain about "injected" information or weird ads, it's usually come from malware that resides ON their system. There's no MITM required for this. The injection happens client side through a browser plugin or some other resource that gets loaded up along with the page. TLS wouldn't fix this in any way as far as I am aware.
I agree with you 100%. What I don't get is the tradeoff that happens in this case for sites that do not necessarily need to be secure by design (what about a news site that has no login/etc or a blog?). Should all information on the web be encrypted by default?
Should all those sites not benefit from the speed improvements that HTTP/2 offers? It seems unusual to couple HTTP/2 with TLS, again, it's not the spec that does this but the vendors who are doing this.
The bigwigs of the industry will throw tons of developer resources at converting everything to TLS (haven't they already for the most part?) and then deploying HTTP/2. They already throw tons of money at being the fastest out there.
I find it interesting (worrying?) that while a spec does not specifically enforce a requirement, large browser vendors have enforced it and created an imperative for pretty much everyone to comply if they want the benefits of the new protocol.
What I don't get is why the industry has decided to force encryption with HTTP/2? The spec does not require TLS however almost every single major browser only supports HTTP/2 with TLS.
Is this a push to make the internet more secure by design or is there some other reason behind this?
What's the speed difference between HTTP/2 and HTTP/1.1 without TLS? I'm sure this is hard to test because of lack of client support.
It is not always trivial to move large legacy projects to secure connections (especially because any resource, even an image, being loaded from an insecure endpoint results in a warning) so the result is now:
- Support TLS first
- Then implement HTTP/2
Consumers will not be able to take advantage of the better HTTP/2 performance without big changes to websites to first support TLS on the server end. Why?
What about social circle? This is the biggest question I have when I think about moving to a small place. And when you say small, how small do you mean - and where? A village in, say India, is very different from a developed country. You'd be hard pressed finding running water and electricity in a lot of those places.
Would you mind sharing your contact info with me? I'd love to pick your brain about some of this stuff, especially your perspective on Berlin, startups, tech cofounders, etc.. I checked your profile AND your website (and domain WHOIS too :P) for contact info. My email address is in my HN profile so if you could please drop me an email with your info, we can take it from there.
I read your article and found it quite interesting. However, all the points you raised would have been more interesting if you'd have gone deeper into them. Like raising tech wages. Now, that might attract talent but wouldn't that also raise the bar for starting up? One of the problems with SF startups at the moment is that it's impossible to start anything without tons of funding (see recent Sergey Brin article).
Taxes are another very complex issue.
In general though we could go circles around each point and never end up with much of a conclusion. I do agree that capital is very hard to acquire outside of Silicon Valley and the anti-startup culture is strong.
But I don't think Berlin is a bad place to be in. In fact, at the moment I think Berlin is one of the best places to hack something together because there is tons of talent around and they would not need to be compensated much (low cost of living). You could do the same under a Delaware corp hiring people in Berlin as freelancers and you'd still be able to get US VC investment if you're solving a problem in the states and have customers there.
What's wrong with having a local company (hence subject to laws in your jurisdiction) and then having a bank account in another country with friendlier banking facilities?
If this is a new business it's not usually worth the administrative overhead unless incorporating in the UK or US solves a specific issue (like stripe support, or some other critical services you made need).
Bought a new phone. Now, to transfer my eSIM from the old phone to the new phone, I needed the carrier to approve. But I was away from my home country and on roaming. So I tried to call them. They needed me to use a verification PIN they would send via SMS on the old phone, to verify the transfer to the new one. Impossible since the old phone is unusable.
Back in the day, I'd have just taken out the sim from the old phone and moved it to the new one. Easy peasy.
The only other option in this case now was to visit one of their stores thousands of miles away. Eventually just ended up doing that when I returned weeks later but during this time I could not access several services due to lack of access to my number plus 2 factor codes being sent there.
Moving a sim from phone to phone was seamless. Now the carrier needs to approve this swap. Even with two working phones sometimes it's a hassle and there will be delays while carriers decide to approve the move. There is a new feature that allows you to transfer eSIMs easily between phones but carriers seem to be holding onto their power in this regard and not every carrier will let their sims move so easily. This possibly requires regulators to step in and solve the issue - make it up to the user to move eSIMs. I would count on the EU to make this easier at some point.
On the plus side, eSIMs are nice to be able to signup and provision them through an app. Helps with travel and roaming. So there's that too.