Hacker Newsnew | past | comments | ask | show | jobs | submit | giacaglia's commentslogin

Pinetree | Remote (North America, GMT-8–GMT-5) | Full-time | Salary + Equity

We’re hiring our third team member, a full-stack engineer, to work directly with the founders across the Pinetree codebase. If you were here today, you’d be shipping notifications, building out the creator studio with analytics and video management tooling, and improving our Farcaster mini app experience and onchain features like direct payments to creators.

Pinetree is building the best onchain platform for video creators: a crypto-native alternative to ad-driven video platforms that gives creators real ownership over distribution, monetization, and their content. We’re looking for someone highly autonomous who brings solutions to complex problems and wants meaningful product and company ownership.

You should have experience writing and deploying production software in TypeScript, ideally on a small (<50 person) team or other startup environment, and be comfortable working across the stack (React / React Native / Next.js, Node, Postgres). Crypto or social product experience is a plus.

Stack: TypeScript, React, React Native, Next.js, Node, Postgres

Comp: $120–200k base, 1–4% equity, health/dental/vision, unlimited PTO, remote-first, $2,500 home office budget.

Reach out to giu@pinetree.so with a resume or links to work you’re proud of.


Its S-1 shows $70M held in Bitcoin ETFs, and board approval for another $30M BTC purchase via USDC!

https://x.com/tier10k/status/1940133141546770454


Oh, so that’s why they’re taking it public: they are turning the company into a crypto investment fund which just happens to provide a SaaS design tool.


It’s the other way around, they bought some bitcoin because they are going public for the meme stock value.


Thats pretty weird, you’d think they would offload things like that to not spook investors


> they would offload things like that to not spook investors

Judging by the amount of fairly traditional companies holding Bitcoins, it would seem like holding Bitcoin is no longer spooky. I guess it makes sense when the financial environment is slowly turning into one without any regulations, Bitcoin will thrive in that sort of market.


It says more about Bitcoin than it does Figma.


Nitro Enclaves seem super neat. For security focused people, it seems like a no-brainer. Great article!


I'm the author here! Feel free to ask me anything!


I love that your website offers a dark/light theme switch toggle, but I'd love it even more if it were "sticky" (sets a cookie so it stays dark or light) across the entire site and through multiple site visits.


Is there an epub/mobi version? I'd love to read it on a kindle.


There will be shortly. The Holloway format has more features (comments, search, infographic, etc.) than an epub so we launch web at first (today). If you purchase now it includes instant online access and future updates, and that includes upcoming epub and other download formats too.


Yeah, we are going to update the book as new developments occur. There is a new section dedicated to just that!


This is pretty cool!


The website looks amazing!



No

But, however in that regard it is interesting to see the shoe on the other foot for Firefox this time around.

Historically Firefox used to rely on remembering recent intermediates it had seen to "fill in the blanks" when trying to access a site that doesn't bother providing any reason to trust the certificate it offers†.

But, Mozilla spent years collecting knowledge of all unconstrained intermediates for trusted root CAs. Then they shipped the entire set as part of Firefox. So, a modern Firefox visiting a site that only has a Let's Encrypt certificate and no other reason to be trusted, sees that and goes oh, that's issued by Let's Encrypt's R3, which I have a copy of, and so it's trustworthy. Done.

Whereas for several other popular browsers they're looking at potentially stale local information, and may conclude that they can't trust this site because some stale data has expired or they rely on an already expired certificate sent to them in some cases rather than disregarding it.

† You're supposed to provide a "chain" (it doesn't actually need to be a chain, but that's most compatible) of other certificates to show why the leaf certificate you have is trustworthy, e.g. my certificate is from Z9, Z9 has a certificate from Big Trusted Corp Q46, Big Trusted Corp Q46 has a certificate from Very Famous Trusted CA, and the relying party (well, their client software) goes, "Oh, I see, and I trust Very Famous Trusted CA, so that means I trust you're you". But, lots of web sites (maybe 10-20% and more of the smallest with negligible IT budget) don't get this correct so web browsers try to work around it.


There's two Let's Encrypt issues at play at the moment.

The issue that your comment about cached/discovered intermediates relates to is that some servers were still manually constructing the chain that goes leaf -> R3 -> DST Root X3, and the R3 intermediate signed by X3 expired on 29 September. This chain hasn't been returned by Let's Encrypt since May 2021.

The other issue relates to the current default chain returned by Let's Encrypt that goes leaf -> R3 -> ISRG Root X1 -> DST Root X3 for Android compatibility. Most clients are able to successfully build a valid chain from the leaf to the still valid ISRG X1, however, old versions of OpenSSL (pre-1.1.0) and several other TLS libraries that don't explore the graph correctly barfs at a chain that terminates in the now expired X3 root.

[1]: https://community.letsencrypt.org/t/production-chain-changes...


Well, you're right that there are two issues, and it's perhaps unfortunate that ISRG chose to arrange that they happen next to each other (but to be fair I don't think we pressed them to do anything else back when it would have been possible, although I'm behind on some reading I don't think I'm that far behind)

But, in both cases Firefox's choice works out for it regardless. And unfortunately I believe -- though it's hard to tell for sure -- that some other browsers get the missing certificate case wrong, perhaps for a few hours and perhaps much longer. Lacking a guiding hand, they may end up choosing to "validate" the R3 -> DST Root CA X3 case which can't work. I think some logic will eventually expire this useless data and those browsers will work, but obviously that's not helpful if your site seems "broken" now.

It will be clearer by tomorrow, but understandably Let's Encrypt's community site is under a deluge of "Help!?" type posts, which are a struggle for the volunteers.



OpenAI keeps innovating. Amazing to see the speed of execution of the team


This guy developed Triton for his PhD thesis, and OpenAI hired him to continue working on it. Doesn't really seem fair to give all the innovation credit to OpenAI.

See: https://www.reddit.com/r/MachineLearning/comments/otdpkx/n_i...


Not odd. Expected


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: