HNHacker News
TopNewBestAskShowJobs

DaSHacka

1,770 karma · joined December 29, 2021

i am mad hacka its so cool sonuvabitch
submissionscomments
DaSHacka··on Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents
> Come again? If you have umbrage against antifa, surely you’re pro fascist?

Just because they call themselves "antifa" doesn't mean its accurate. If the nazis referred to themselves as the "free puppies for everyone and world peace organization", it would not change anything about the morality of their party or the acts committed by them, despite the name.

DaSHacka··on Roblox downloaded 145GB models from us (including adult content) without asking
That wouldn't work if a sysadmin implemented the rDNS lookup mentioned in TFA. The PTR specifically must end in `.googlebot.com`, not `.googleusercontent.com`.
DaSHacka··on Is my data used for model training?
Ignoring that your account is shilling for your service, how would such a service help with anything at all?

Encrypted end-to-end..... When the issue is one of the ends is monitoring chats? The issue has nothing to do with OpenRouter or some other middleman intercepting your chats, but the end server itself (and specifically the company managing it) being of question.

The cloud is just someone else's computer, after all.

DaSHacka··on A 28-Year-Old DOGE Operative Gutted USAID. HR Had No Record of Him Working There
> We’ll be reading about the crimes of dodge for years

I know their tendancy to have wiring faults could certainly stand to be improved but jeez, that's a bit harsh

DaSHacka··on I will no longer upload to NEW
Well, the BSDs are right there.
DaSHacka··on I will no longer upload to NEW
Maybe so, but we're still going to complain when we're subjected to it.

My most recent experience was calling AT&T because the serial for my modem was whitelisted on an incorrect PON port (AKA the issue was on their end), yet if you correctly answer all the automated bot questions when calling their support line indicating you have an issue with WAN connectivity, it guides you through the process of unplugging your combo unit, waiting 10 seconds, and plugging it back in, then it automatically hangs up on you. Like thanks, that may help Sheryl who thinks the internet is down because her computer's DNS caches an expired facebook IP, but I literally cannot solve this issue myself without help from an AT&T tech lest I violate federal law by breaking into their network closet and do it myself.

I finally got through to a person by incorrectly claiming there was a billing issue and asking that rep to transfer me to the right department, skirting the bot entirely.

DaSHacka··on New 14‑inch MacBook Pro with M6
Of course it does! You just have to go to a Genius Bar after the release of a new MacBook, and tell them you're interested in buying one. They'll even handle recycling your old one for you!
DaSHacka··on Around a dozen banking apps began specifically permitting GrapheneOS
> There is a significant difference between coordinating community members to brigade and notifying community members about threads which contain factual inaccuracies about the projects technical work or history.

There is no functional difference when the obvious end-result is sending a horde of external people to influence voting in the thread, the definition of brigading.

> As an open-source project and a non-profit foundation, there is not a PR team or firm. It is perfectly normal to have an opt-in notification role for community members who wish to help clarify technical misconceptions in public discussions. It is a transparent and not uncommon practice.

This is absolutely not a common practice. Point to other notable FOSS projects that act in this manner, I've legitimately never seen it from other projects.

> HN has built-in protections against external voting and flagging. Comments that end up being flagged are rarely (if ever) substantive criticisms related to the OS or foundation. In nearly every case they are comments serving to derail technical discussions into personal attacks, armchair psychology, or unsubstantiated accusations against contributors and community members

The behavior of the core maintainers and broader community is still intrinsically tied to the technical aspects of the project, and the discussion at large. When there are threads about OpenAI (and other commercial AI providers) and the U.S., do people stop at discussing solely technical aspects of both, or do they understandably bring up relevant social and communal points as well?

A security project demands particularly high trust, which is where my concern stems. I would love to use GOS without worry, my hope is that the project can course-correct and eventually put this behavior behind them.

> (like repeatedly calling community members "sycophants" and "pathetic").

The community does in fact have some sycophants. I never asserted that every single member is one, or that they are the majority of the community (as they are not). And I called the behavior pathetic, not the member. Your framing of these comments is disengenious.

> Constructive technical criticism of the project happens every day, and is welcomed without issues. Expecting those discussions to remain focused on technical aspects and factual realities rather than personal hostility isn't "crashing out".

Firstly, the "crashing out" was in the context of random trolls messing with core contributors in official communication channels and successfully getting a rise out of them (IE "don't feed the trolls and they'll go away"), though I do infact argue expecting people to solely focus on technical aspects of an inherently multi-faceted project to be unreasonable, for reasons stated above.

DaSHacka··on Roblox downloaded 145GB models from us (including adult content) without asking
Depending on the service, you may not want it to be indexed anyway (IE login pages) or, if you do, most commercial crawlers have methods to allow site owners to verify that the traffic is a legitimate crawler and not an impersonator, see:

https://developers.google.com/crawling/docs/crawlers-fetcher...

(Though restricting the Google UA to only legitimate Google IPs seemingly would break Brave's crawler, though that's their own fault: https://safe.search.brave.com/help/brave-search-crawler/)

https://duckduckgo.com/duckduckgo-help-pages/results/duckduc...

https://www.bing.com/webmasters/help/how-to-verify-bingbot-3...

https://kagi.com/bot

DaSHacka··on Roblox downloaded 145GB models from us (including adult content) without asking
Because "we" want the assets now, and not when we're 60 years old?
DaSHacka··on Around a dozen banking apps began specifically permitting GrapheneOS
I fail to see how my being in the Graphene discord discredits anything I've said. I use the project, so I remain in the Discord to keep up with updates.

You'll notice that I always say I use the project, I think it's excellent usability-wise and I appreciate the technical work you have done. And that, in spite of that, while you are not my "sworn enemy" I still find your behavior pathetic and off-putting.

I'm all but certain the only reason you often get so many throwaway accounts that attempt to troll the official community platforms is because of how often the core contributors take the bait and 'crash out', as the kids would say.

And the reason why there's more and more real accounts on HN (and elsewhere) that now criticize the behavior of the core contributors (and sycophants) is because it's very off-putting to observe the behavior in real time. Each time you behave this way, when every single critical comment in an HN thread has been flagged due to being posted in the Graphene discord and having a legion of sycophants downvote it, there will be more and more people with raised eyebrows.

Louis Rossman comes to mind, someone who could have been a great ally to the project yet got burned by this "persecution complex" behavior for no real reason.

In that very comment you link to, every single reply of anyone even lightly criticizing the project has been flagged. That's not natural for HN, almost all discussions generally go both ways on here (for any given topic, some criticism, some appreciation) and it's clear the discussion has been brigaded.

You claim HN is suppressing your voice and it's being unfair in platforming "libel and harassment" against you, yet you'll notice none of your replies are ever flagged or silently removed by moderators. HN is simply a neutral platform, you are going to get both criticism and support unless it is explicitly suppressed by the moderators. Yet you keep throwing hissy fits when they doesn't automatically censor any dissenting opinions about you on the platform on your behalf.

DaSHacka··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
I've noticed the newer frontier models are a lot better about this and are willing to give concrete answers, where before even in 90/10 scenarios they would always be wishy-washy espousing the "it depends on the circumstances" BS.
DaSHacka··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Protip, use the Wayback Machine as a proxy to get around firewalls if you only need to view content from a static site.

My work blocks every commercial AI service, but I just want to read the static blogs and benchmarks from the large labs to keep up with recent news and developments in the space and the Wayback Machine trick works perfectly for that.

DaSHacka··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Most domains are only like ~$10/year. I already have a handful registered for potential project ideas because they're borderline free, for major vulnerabilities I would do the same.
DaSHacka··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
It will never not amuse me that Mozilla changed the Brotli extension to avoid this very connotation

https://bugzilla.mozilla.org/show_bug.cgi?id=366559#c147

DaSHacka··on Around a dozen banking apps began specifically permitting GrapheneOS
I think GP may not realize it's (likely) all legitimate accounts, just from 'devoted' GrapheneOS sycophants. They just get sic'd on HN comments if they opt-in to "Do you want to opt-in to mentions for help addressing inaccurate media coverage of GrapheneOS?" on the official Discord.

Evidently GP hit a nerve[0], though I don't know what they were expecting trying to poke the bear like that.

[0] https://files.catbox.moe/7a0wr2.jpg (From the official GrapheneOS Discord)

DaSHacka··on Kimi K3.1 Pro and K3.1 Pro Highspeed
That's surprising, I had the exact same experience as GP. I dropped my Kimi sub this month, but I'm keeping claude because I can use Opus 4.8 basically endlessly. Even Opus 5.5 doesn't drain the usage that much, though I rarely use it because it refuses to do anything cyber-related.
DaSHacka··on PHP 8.2.35
How does knowing the agency who's practically whole purpose is hoarding 0days has 0days mean anyone thinks they're "special"?

Also, Vulnerability Researchers working for the NSA are not located in the Gulf, and the NSA was not involved in that situation.

I fail to see how it's relevant whatsoever. The U.S. is not a monolith.

DaSHacka··on Run full iOS 16.5 firmware on Android Devices
But they also don't have to be bought exclusively in the US.
DaSHacka··on PHP 8.2.35
The NSA does not need to "request" time to use an n-day vuln. They have more 0-days than you can imagine.

They literally employ full-time Vulnerability Researchers doing nothing but 0-day discovery and PoC creation 24/7 to add to their horde. Plus contracting with the MIC for their full-time VRs for the occasional project.

DaSHacka··on Demographic "doomsday" misses the mark
The racist part is extrapolating from mass-scale migration of different demographics and cultures that it will cause demographic and cultural change? You may disagree it is a problem, but I fail to see how it isn't true.

You think if, say tomorrow, all 1.4 billion citizens in China were teleported into the U.S., that there would now be 1.7 billion Americans, indistinguishable from the Americans that came before? Or, would it simply be 1.4 billion Chinese, alongside ~300 million Americans (if we're being generous...)?

Demographics and culture are obviously intrinsically tied, each individual migrant holds beliefs and values that have been forged and shaped over the span of the lives that they have lived in their country of origin. This is, and has always, been the case, its just more of a hot-button issue recently because:

A: We are currently getting an overwhelming amount of migration to stave off our own demographic issues, so the strain begins to have a more noticeable impact,

and B: Many of the migrants (from abroad) are coming from countries with cultures intrinsically incompatible with values Westerners have come to expect in their own countries (See: Sharia Law as contrasted with Women's Suffrage), so they stick out somewhat like a sore thumb when advocating to enact such policies and practicing such cultures.

DaSHacka··on Demographic "doomsday" misses the mark
> Perhaps they could allow mass immigration to fix it but that would destroy the culture. The issue is happening everywhere, how is it racist?

Well, there are people that think the idea of preserving cultures itself is racist (well, at least western ones), or that there is no detrimental effect to an existing culture by enabling mass migration.

DaSHacka··on Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Not sure why my other reply was flagged, I think it's objectively correct. Different tools for different purposes, and all that. Not unlike emacs vs vi(m), actually. (With vi/vim being more minimal, but also more often preinstalled or available OOTB versus emacs)

And of Herdr, tmux, vim, and emacs, I still use all 4 regularly :)

DaSHacka··on ICE Planning $100M 'Nightmare' Domestic Spy Program
I mean, you can check the bodycam footage for yourself? What other 'evidence' other than, well, the evidence do you mean?
DaSHacka··on Plex vulnerabilities being exploited in the wild to drop a cryptominer
Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.
DaSHacka··on Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Its mostly useful for remote sessions as you can use one ssh connection for multiple terminals, and of course the most common usecase, leave processes running after you logout (or if the connection drops).
DaSHacka··on Plex vulnerabilities being exploited in the wild to drop a cryptominer
When was the last time you tried it? I used to agree, but at least as of last year, it must've undergone a UI overhaul as now it looks quite nice imo.
DaSHacka··on Plex vulnerabilities being exploited in the wild to drop a cryptominer
If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.
DaSHacka··on Plex vulnerabilities being exploited in the wild to drop a cryptominer
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.

Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?

I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).

Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).

Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.

FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).

DaSHacka··on Let's Encrypt is adding two additional remote perspectives for domain validation
Caddy and Tailscale can at least alleviate many of the issues and all-but make it automatic and painless (though both are more geared for homelab use). I agree nginx and the more standard webservers/services oftentimes don't have good support and require quite frankly too much manual configuration though. There's no excuse in 2026 for not including acme support OOTB with a single checkbox/config value. Plus, I can't believe the default ACME client is a snap (literally WHO wants this?) and not a simple static binary to help adoption/integration.
Page 1 of 34Next →