HNHacker News
TopNewBestAskShowJobs

AlexAltea

539 karma · joined July 9, 2014

Security, reversing, mathematics.

Writing emulators and hypervisors.

Alexandro Sanchez <alexandro@phi.nz> https://phi.nz/

submissionscomments
AlexAltea··on Linux 6.1 Officially Promoted to Being an LTS Kernel
Silly question: if Linux kernel interfaces e.g. syscalls are stable, why is there a need to create an LTS release? How can non-LTS updates affect differently than updates within the LTS branch?
AlexAltea··on Mexico cracks down on solar geoengineering
I didn't miss anybody's point. Your comment made me realize something that I wanted to share.
AlexAltea··on Stop developing this technology
Instead of blocking technology, what about addressing the root problem: People need to understand concepts such as "chain of trust".

Do you trust videocall participants because you recognize their faces and voices? ...Or because a server certified by a root CA has authenticated the other participants?

The age of deepfakes has started, nobody can stop it. Improving our mental security models will become as essential as literacy.

AlexAltea··on Mexico cracks down on solar geoengineering
Every local action has global consequences.

Throwing a dead battery into a dump -> Battery acid gets dragged by the rain -> Polluting a river -> Flows polluting a sea -> Currents polluting all oceans.

Of course effects become smaller as scope grows, but still in many instances it's measurable, see Fukushima.

AlexAltea··on Ryujinx (Switch Emulator) Update
This is fairly common in many console emulators, see:

- PS3 (Nvidia RSX): https://github.com/RPCS3/rpcs3/blob/master/rpcs3/Emu/RSX/rsx...

- PS4 (AMD GCN): https://github.com/AlexAltea/orbital-qemu/blob/master/hw/ps4...

The hardware is known ahead of time, so console platforms take advantage of that: GPU drivers allocate a context and hand it over to userspace which can do nearly anything it wants with it (abstraction layers are quite thin), and graphics APIs are essentially a 1:1 mapping of the hardware.

Because of that there's little difference between emulating the API or emulating the GPU (the subset of the GPU accessible through the API).

The only major difference I'd say is emulating the entire GPU (including VM, GART/IOMMU, display controller, multi-contexts, etc.) vs just emulating a single GPU context (which feels quite similar to implementing a graphics API).

AlexAltea··on SourceHut terms of service updates, cryptocurrency projects to be removed
Cool. You and your friends go your way! My friends and I will go ours, sounds good?
AlexAltea··on SourceHut terms of service updates, cryptocurrency projects to be removed
I was not implying that you'll slip into such extreme policies, it's just that people with strong moral compasses are often unable to reevaluate their positions: "this is good, so it cannot be wrong".

Which leaves me no choice but to trust all my future projects to services run by people as you put it, "without a moral compass".

If I'm into (say) 3D printing and create software for it, I simply will not risk getting de-platformed just because some dude is upset people are 3D printing guns and guns are bad. The day 3D printing is illegal/restricted, I'll stop or accommodate to regulations.

I chose "3D printing" as something innocuous, but feel free to replace it with anything divisive and controversial... People just do not realize who *exhausting* it is dealing with founders with strong moral compasses. (And yes, I get it's their/your prerogative and if I don't like it I can GTFO. Just venting off.)

AlexAltea··on SourceHut terms of service updates, cryptocurrency projects to be removed
With all due respect, I do not care about your moral compass.

I want the predictability that as long as I am not breaking the law, my data can be safely hosted. Am I supposed to now pay attention to law and the countless individual moral compasses of people/vendors I interact with?

Moral compasses are tricky, some people let them run amok, and end up infecting computers with revenge-ransomware just for having their system language set to Russian, as it happened in March 2022. Was that also justified for the "greater good" of humanity?

Of course, it's your project, your service... anybody can fork it or self-host it, but this only screams at me: "be wary of this guy and his services, you could be next".

PS: I do not maintain cryptocurrency projects or trade any.

AlexAltea··on Global population is crashing, soaring and moving
No, and I am willing to stake everything I have to fight anyone pushing this experiment.

People that engineer the future of countries they will never live at, happy to displace cultures for a fucking basis point, make me deeply sick.

Who in the bloody hell are you, or anyone at Davos for that matter, to dictate what my nation, my town, or my family needs? Have you even been asked? Or is this just the usual arrogance ingrained in all globalists of just "knowing better"?

AlexAltea··on Wikipedia RFC to stop accepting cryptocurrencies passes by majority vote
> What is really happening is that nobody is using it for payments at all

[Citation needed]

Over the past years I've been able to book flights, shop hardware, get hotels and rental cars, renew my domain, pay for my server with cryptocurrencies.

AlexAltea··on Ask HN: Does anyone else question USB-C as an “improvement”?
Yes, making accidental non-compliance easy and thus commonplace is IMHO a shortcoming of spec as per Nextgrid's comment.

Also, you can express disagreement without throwing Reddit-style sarcastic snarks.

AlexAltea··on Ask HN: Does anyone else question USB-C as an “improvement”?
> The fact that I can successfully plug in a USB-C cable on the first try

Depends on the device, I've had low-quality USB-C devices whose transfer speed inexplicably decreased when connected "the wrong way". Not knowing which orientation is the right one until you initiate the transfer is frustrating, and worse IMHO than physically preventing the wrong orientation.

Of course, this issue affects only a subset of mediocre hardware... But the fact that [1] this is possible is quite a downside to USB-C.

[1] https://hackaday.com/2021/03/22/cursed-usb-c-when-plug-orien...

AlexAltea··on George Hotz against the institutions
> it seems that Hotz hasn't grown up much

What do you mean by "growing up"? Hopefully not embracing the pervasive mediocrity of institutions and defending the current status quo.

AlexAltea··on George Hotz against the institutions
> someone you likely don't even know

You are replying to marcan from fail0verflow; he likely does. Many people from the early PS3 hacking days did.

AlexAltea··on Nvidia Hit by Major Cyberattack
> would cripple the ability to (re-)train Ai systems which might be used in military defense systems.

Crippling use-cases is quite difficult: how could you distinguish at hardware/firmware-level object detection for fighter jets vs object detection for cars. Under the hood everything is just a bunch of compute units with extremely wide ALUs. I would even say, it's next to impossible to cripple "AI" without crippling graphics engines and most GPGPU kernels.

EDIT: Ah, you meant drivers. Yeah, that's perhaps more doable (since the OS can provide context on the calling application), also more detectable by the end-users: many people diff drivers to find patched vulnerabilities, security researchers would eventually notice it.

AlexAltea··on Upper limits on partial Dyson spheres in the Milky Way
Neither. I just thought it opens an interesting question: What happens in the long run if some parts of the world embrace eugenics and gene therapy (in whatever form), while others do not, e.g. under ethical grounds or simply different priorities.
AlexAltea··on Upper limits on partial Dyson spheres in the Milky Way
> eugenics has got a bad rap

Mostly in Europe and North America, and territories culturally-influenced by them, largely as a side-effect of historical events 80 years ago.

Other parts of the world have different opinions on the matter.

AlexAltea··on Recording 660FPS Video on a $6 Raspberry Pi Camera (2019)
This is possible by interfacing directly with the sensor MMIO registers. I've always found fascinating how much flexibility hardware provides, compared with the typically rigid functionality the drivers expose to userland.

I wonder what we could make out of many high-end cameras if only we had enough patience and motivated people to reverse engineer everything that has been hidden away by comfort abstractions.

AlexAltea··on Remote work will break the US monopoly on global talent
There's many other companies abroad capable of offering compensations that can compete with the US.

Anecdotal, but plenty of contacts who would have never accepted an on-site position in UAE, Hong Kong, Germany (for reasons ranging from personal, political, or just sheer affordability), and are now contracting as individuals at companies based in such regions, for substantially above the Bay Area average for their experience.

AlexAltea··on Remote work will break the US monopoly on global talent
I disagree, I don't see how the supply/demand ratio of talent will significantly change by remote work.

Companies will pick from a larger pool of people. People will pick from a larger pool of companies.

AlexAltea··on Zoom adding advertisements to the free tier of its service
I can't blame them either... but isn't high bandwidth usage a solvable problem?

Why can't they switch to P2P audio/video transmission instead of funneling everything through their servers?

AlexAltea··on Facebook chooses profits over people
As long as paying customers are advertisers instead of users, why would they care? Why is this even news?
AlexAltea··on S.Korea broadband firm sues Netflix after traffic surge from 'Squid Game'
> Netflix's data traffic handled by SK jumped 24 times from May 2018 to 1.2 trillion bits of data processed per second

What an odd way of representing data transfer bandwidth: Was it so hard to just say 1.2 Tbps (or better 150 GB/s)?

Also, maybe an ignorant question from my side: Is that bandwidth such a big deal at nation-scales? It feels like barely 1000 homes maxing out the fiber usage. All submarine cables being deployed today are already in the 100+ Tbps range, aren't they?

AlexAltea··on YouTube starts to require a credit card or ID to verify the age in EU (2020)
Then why wouldn't the owner change after verification? Maybe they should verify every day, just to be safe?

Such nonsense just ruins the Internet, maybe we should find better approaches than "yet another banner": accepting cookies, accepting privacy policy, verifying age, registering, logging-in, etc. all to watch some dumb 10 second video... Yet, porn and violence are to this day still a Google search away. So, what is YouTube exactly trying to stop here?

AlexAltea··on Apple proposes adding "model" element to HTML that displays 3D content
Dismissing Apple's <model> HTML element proposal because WebGL/WebGPU on <canvas> already "solve" the problem feels short-sighted...

Under that logic, shouldn't we replace <img> and <video> elements with WASM modules for ffmpeg/libjpeg/libpng rendering into a <canvas> too?

Or hey, maybe we could drop HTML altogether and just render all content from WebAssembly straight into the <body>?

AlexAltea··on The rise of never-ending job interviews
Years ago, while applying to some security engineer position at Google, they were testing low-level skills focusing on vulnerability research, C/C++ and x86. At that point having spent 10+ intense years on that arch: having written binary translators for it, reversing/exploiting software and writing a micro-kernel. After rejection, they recommended me to read a "x86 assembly 101" book which was truly infuriating at that point.

Granted, it was an automated email, but an automated "No" would have been more appropriate. Is it so hard to offer different standard responses? Why does the company consistently fail at human interaction, be it candidates or customers?

From my circles, most share the feeling that FAANG/MSFT are insulting for candidates (I can only speak for Google/Microsoft).

AlexAltea··on CVE-2021-22555: Turning \x00\x00 into 10000$
> Vulnerabilities once you have access to the machine are not really worth spending time on

That's absolute nonsense. There's so many platforms, Android/iOS, where applications are compartmentalized: local privilege escalation (LPE) vulnerabilities is what enables a rogue application (or remote code execution into one, such as a browser/chat), into full control of the device and its data. Sometimes LPEs are needed to achieve some level of persistence. In VMs, a guest LPE is frequently needed to interface (and exploit) directly the emulated/paravirtualized devices and VM-escape into the host OS.

Yes, it is a big deal.

AlexAltea··on Show HN: 3dasd – open-source DIY room-scale 3D scanner
Available at https://examples.3dasd.com/
AlexAltea··on Arm Announces New Mobile Armv9 CPU Microarchitectures
This is explained in the article:

> The new CPU family marks one of the largest architectural jumps we’ve had in years, as the company is now baselining all three new CPU IPs on Armv9.0.

I believe the deprecation of AArch32 is quite an important change and by itself already warrants issuing a new major version (then there's all mandatory extensions from v8.2+ and SVE2).

They have not claimed to bump the major version on a regular basis from now as you seem to suggest.

AlexAltea··on Accelerating QEMU on Windows with HAXM (2017)
I have actively worked on Intel HAXM as part of emulator project [1]. I think there's a fragmentation problem in hypervisor scene: KVM is Linux-only, Hyper-V is Windows-only, HVF is macOS-only. Some toy hypervisors support a small subset of modern features, while lacking in other areas. Some support either Intel VMX or AMD SVM, but not both. To make things worse, Windows/macOS are making incredibly difficult for developers to deploy their own hypervisors. I believe Intel HAXM took a step in the right direction at aiming to be cross-platform, the community has unofficially even ported it to AMD CPUs as well, but more awareness is needed

I don't think https://libvirt.org/ is a solution to the fragmentation problem. Whenever a new virtualization feature appears (and this happens quite often!), having to update N different hypervisors, and expecting their interfaces to consistent enough and consumed by libvirt is wishful thinking: In practice it just does not happen. This hurts the development of cross-platform software that require cutting-edge hardware virtualization features.

[1] https://github.com/AlexAltea/orbital

← PreviousPage 2 of 4Next →