tomxor · HackerTrans

tomxor

10,468 karmajoined il y a 10 ans

Submissions

Ask HN: Why is HN blocking Mullvad?

40 pointsby tomxoril y a 3 ans21 comments

Show HN: HN Avatars in 357 bytes

701 pointsby tomxoril y a 4 ans493 comments

Show HN: Minecraft in 140 Chars of JavaScript

twitter.com

9 pointsby tomxoril y a 5 ans1 comments

Show HN: A Stargate in 140 chars of JavaScript

dwitter.net

377 pointsby tomxoril y a 6 ans55 comments

Show HN: A DOOM style renderer with textures in 140 chars of JavaScript

dwitter.net

8 pointsby tomxoril y a 6 ans1 comments

Star Trek: Picard

cbsnews.com

3 pointsby tomxoril y a 7 ans0 comments

Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability

blog.ptsecurity.com

342 pointsby tomxoril y a 8 ans78 comments

Qutebrowser – A keyboard-driven, Vim-like browser based on PyQt5

qutebrowser.org

202 pointsby tomxoril y a 8 ans107 comments

Only a few vendor-paid developers do almost all open-source work

infoworld.com

151 pointsby tomxoril y a 8 ans43 comments

Petition: Stop Microsoft from Buying GitHub

change.org

4 pointsby tomxoril y a 8 ans0 comments

The Sound of the Machine (1997)

nutshellhifi.com

1 pointsby tomxoril y a 8 ans0 comments

comments

il y a 19 heuresdiscuss

There's an interesting tension between "censorship" and "ideology" here.

On the one hand I think organisations taking pure ideological stands is healthy for society as a general behaviour, rather than appealing to the masses and business insentives as GitHub would; on the other hand that can technically manifest as censorship in some cases.

But that's ok as long as we have more than one of a type. The answer to disagreement with one small organisation or projects ideology is to make another one, which is exactly what the author has done in the extreme (host my own damn git). This is the same thing that democratizes FOSS, projects can be ideological dictatorships, that's ok because they can be forked and no one is forced to stay. It also allows individual projects to efficiently follow their ideology or principles without the machinery of democracy getting in their way... It's the best of both.

il y a 4 joursdiscuss

> A ping goes around the whole world before your pressed key is visible on the screen.

I don't disagree with your sentiment, but as someone who manages infrastructure which is literally on the opposite side of the planet (from me) RTT is long enough to be objectively horrible for anything interactive like typing over SSH. At least 250ms capital to capital for Europe to Oceania + last mile latency makes 300ms a more realistic minimum + actual processing time + client side rendering and it really starts to feel like a half second from the full human perspective... Under ideal conditions.

le mois dernierdiscuss

> For many people, LLMs are the first time that computers do what they tell them to. Not what some big tech PM has decided is or isn’t possible.

The crux is here somewhere.

A massive group of people (A), don't fully understand or care about code, but they care about arbitrary specific outcomes that serve their needs and desires VS a tiny group of people (B), who initiate, architect and maintain successful projects, who care deeply about the health and cohesion of the codebase over it's lifetime, because that serves everyone.

Group-A is now liberated for better and worse. For the first time they can force their will upon a codebase without understanding. They are making selfish changes, and that's fine, this is hacking for the masses. The problem is they still don't realise these are selfish changes, because they have not been forced to tread the path of the programmer to understand they are selfish changes.

The response from FOSS maintainers seems inevitable from this perspective... But I think what's going to be more interesting is watching how Group-A over time respond to creating their own personal hell.

As group-A accrete more and more unsupervised selfish changes into their forks - at what point will they implode and turn into LLM-token-tarpits, at what point will Group-A notice, and I wonder what their response will be.

il y a 2 moisdiscuss

That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages. i.e. inclusion of malicious code in libraries you depend on, this could be as simple as inserting a cryptominer, or as severe as data exfil in a front end package.

This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.

il y a 2 moisdiscuss

At this point lifecycle script should be disabled by default in NPM.

It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.

The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.

il y a 2 moisdiscuss

> You are not recovering these investments

OK, Question: Would this outcome still benefit society overall?

In the aftermath of this bubble "AI" will still have utility, like the dotcom bubble. So lets say FANG doesn't make a return, how much should we care? How much of this investment is sunk cost that would continue to provide value, and how much of it is operation costs just keeping the lights, I mean GPUs on, that would become unviable post-bubble? As an immediate effect, what happens to these AI companies? or if they become insolvent, what happens to the assets and tech? and what are the secondary economical effect to society if FANG doesn't get their ROI?

il y a 3 moisdiscuss

Hah TIL. So it's the river Welsh river on the English side of the Bristol channel.

I often feel like I would understand a lot more names if I bothered learning Welsh. It's pretty popular for made up climbing route names too, because Wales is so good for it I guess. Allegedly some of the classics in the Avon gorge are Welsh derived but I could never figure them out to be sure.

il y a 3 moisdiscuss

> Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned.

No, it's really not.

High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place.

Example: spectre/meltdowm mitigations.

I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.

il y a 3 moisdiscuss

FYI it's dynamically loaded on demand, so lsmod will show it after you try run the exploit, or you can explicitly load it with:

  modprobe algif_aead

The following mitigation (from the article) does work for Debian 12 and 13, I've tested this:

  echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead 2>/dev/null || true

First line blocks it from loading, second line is unloading it if it's already been loaded. You can test with the same "modprobe algif_aead".

il y a 3 moisdiscuss

Another happy self hosted Gitea user here for ~3 years now.

Came from Gitlab which started pushing out basic users in 2022 with massive price hikes. I weighed Github as an option but was like "no I don't want to be dealing with this same problem in another 5 years" when some other rug pull or degradation happens with that service. So I'm feeling pretty validated for that decision these days.

The speed improvement was massive (super low latency), and was worth the switch on it's own, but we also saved 90% in immediate cost... probably more in secondary effects from the git host just not being a pain point. The only long or unplanned downtime we've had was 2 hours in that whole 3 years where the tiny Linode VPS host had a total hardware failure and got migrated, which is a pretty damn good number of 9s for a simple easy to host single server solution. We also gained more durable and fast offsite backups (zfs) that Gitlab could never offer, but that's more of a custom self hosted thing not specific to Gitea.

il y a 3 moisdiscuss

> aaand we have Quake and Comand&Conquer - Red Alert

Agreed, it would seem that evolutionary biology peaked in the late 90s then

il y a 4 moisdiscuss

These robots weren't really "walking" in the sense that humans walk through continuous dynamic balancing, i.e falling forward.

These used quasi-static walking, where the zero moment point (like a moving centre of gravity) is kept within the support polygon of the footprint. This is what gives them their weird swaying gait and extremely conservative movement characteristics. You could never make a bipedal robot run, jump or respond to large and sudden external forces using this method. It's essentially a balance free movement hack.

il y a 4 moisdiscuss

Go back to Win98 UI, I know it will never happen but can you imagine...

At this point I genuinely think people would be blown away at how much of a functional improvement it would be.

There would also be a lot of bewilderment for the younger generations, and people who aren't interested in actually using computers who don't think it looks "sleek" enough or whatever. But in terms of day to day quality of life, those old UIs just got the fuck out the way, and were obvious when you had to interact with it. I have some earned hate for the underlying windows OS, but in terms of UI and desktop, we didn't know what we had until it was taken away.

il y a 4 moisdiscuss

Yes, by generally I really mean all the defaults are pretty permissive, but I understand some people tune both TCP and SSH on their servers to drop connections faster because they are worried about resource exhaustion.

But if you throw up a default Linux install for your SSH box and have a not-horrible wifi router with a not-horrible internet provider then IME you can sleep your machine and keep an SSH connection alive for quite some time... I appreciate that might be too many "not-horrible" requirements for the real world today though.

il y a 5 moisdiscuss

If hung SSH connections are common it's likely due to CGNAT which use aggressively low TCP timeouts. e.g. I've found all UK mobile carriers set their TCP timeout as low as 5 minutes. The "default" is supposed to be 2 hours, you could literally sleep your computer, zero packets, and an SSH connection would continue to work an hour later, and generally speaking this is still true unless CGNAT is in the way.

If you are interested there are a few ways you can fix this:

Easiest is to use a VPN, because the VPN's exit node becomes the effective NAT they usually have normal TCP timeouts due to being less resource constrained. Another nice benefit of this method is you can move between physical networks and your connection doesn't die... If you use Tailscale then you already have this in a more direct way.

Another is to tune the tcp_keepalive kernel parameters. Lowering the keepalive timeout to be less than the CGNAT timeout will cause keepalive probes to prevent CGNAT from dropping the connection even while your SSH connection is technically idle. For Linux I pop these into /etc/sysctl.d/z.conf, I have no idea for Windows or Mac:

  # Keepalive frequently to survive CGNAT
  net.ipv4.tcp_keepalive_time   = 240 
  net.ipv4.tcp_keepalive_intvl  = 60
  net.ipv4.tcp_keepalive_probes = 120

This is really a misuse of these settings, they are supposed to be for checking TCP connections are still alive and clearing them up from the local routing table. Instead the idea is to exploit the probes by sending them more frequently to force idle connections to stay alive in a CGNAT environment (dont worry the probes are tiny and still very infrequent).

_time=240 will send a probe after 4 mins of idle connection instead of the default 2 hours, undercutting the CGNAT timeout. _intvl=60 and _probes=120 mean it will send 120 probes 60 seconds apart (2 hours worth) before considering the connection dead. This will keep it alive for at least 2 hours, but also allows us to have the best of both worlds so that under a nice NAT it keeps the old behaviour, e.g if I temporarily lose my network the SSH connection is still valid after 2 hours, but under CGNAT it will at least not drop the connection after 5 mins so long as I keep my computer on and don't lose the network.

There are also some SSH client keepalive settings but I'm less familiar with them.

il y a 5 moisdiscuss

> It’s who’s looking at your profile; it’s the profiles that you’re looking at. That was the holy grail

Facebook actually implemented this as a user facing feature.

I think it was very early days, but I used it, it was fucking creepy, and everyone hated it. I think Facebook probably removed it because it drove people away. It made you feel like a creep for checking on your friends page.

il y a 5 moisdiscuss

Yup, in a word, ownership.

But that's an unpopular approach these days where many companies are obsessed with minimising the bus factor to the point that their IP is as replaceable as their employees.

il y a 5 moisdiscuss

> I cannot think of a technology more diametric to 'plug n play' than VR, which is very unfortunate.

Ironically that's exactly what the Quest solved with SLAM, it really is plug and play, otherwise I would not have bought one... and it sucks that Meta now owns it, but it really is still the best "just works" VR.

I also don't think VR has much potential to solve real world problems for enough people, but it doesn't have to because it's pretty good entertainment as a gaming device (albeit still fairly niche).

il y a 5 moisdiscuss

Not Maybe, I owned a 2009 MBP. Everyone with a macbook from that period that I knew had the same issue, they were absurdly bright, you could not keep it anywhere near a bedroom without putting very thick tape over the light.

It was a poorly thought out design of aesthetics over ergonomics.

il y a 5 moisdiscuss

> I started making deliberate grammar and spelling mistakes in professional context.

I've also noticed an increase of this in myself and others, I used to edit a lot more before sending anything, but now it seems more authentic if you just hit send so it's more off the cuff with typos, broken sentences and all.

I'm sure an LLM could easily mimic this but it's not their default.