Hacker News Reader

LanternLight83on We found vulnerabilities in GitHub Actions Pipelines

Shared by kevin_nisbet under https://news.ycombinator.com/item?id=31194139, and I found it be more generally applicable

LanternLight83on Calling NSA to find your encryption key after a few bits were flipped (2010)

It might be subset of typosquatting, but it's distinct from what the term usual refers to because the typos that are statistically likely to result from user input (swapping neighboring keys, duplicating or omitting letters, etc) occur manually on the level of keys and characters, where as from those that result from bitflips ("adjacent" bit sequences) occur invisibly / without a manual mistake on the level of bit-/byte-streams, forming two mostly exclusive sets of domains that could be targeted. A determined attacker would likely target both.

LanternLight83on Ask HN: Email Therapy

I'd be thrilled to find something like this that's self-hostable, even if you gotta use their app and the updates are binary blobs or w/e-- anything that I can run offline, but I think that's a looong ways off.

LanternLight83on Ask HN: Can one of the Google engineers add support for IPFS on Chrome?

Cloudflare and Google already have a lot of overlap in the related DNS and Domain Registrar spaces, so why not spin up their own IPFS cache?

LanternLight83on Frames-only-mode: Make Emacs play nicely with tiling window managers

Love it! I feel that this is one of those choices that might always haunt you if you go through configuration churn, but I'm about to clean up my dotfiles once and for all™, and it just feels so worthwhile to pair down those layers that I habitually fall into, (wm (tmux ($editor (files)))).

LanternLight83on Operating systems battle: OpenBSD vs. NixOS

Not that I know of, but ideas continue to trickle down, so I look forward to a reimplemention for Guix in the future. Something like nix-index would be great too, but all in due time, as the project admittedly doesn't have quite as many resources.

edit: to be clear, I'm taking about flakes, Guix does have plenty of mechanisms and utilities regarding direnv-esque project manifests, lockfiles, and even "inferiors" which let you install outdated packages that the distribution has otherwise moved on from by actually building and using the version of guix that the package would have been built with at the time

LanternLight83on Ask HN: What Happened to Lambda-the-Ultimate.org?

Thanks! I happened to have opened a relevant 2018 discussion link as a new tab over lunch today, and and was able to slap the prefix right on without scrubbing around for a good snapshot. Appreciate you going that extra mile c:

LanternLight83on My skin was irritated for years until I found out why because of lockdown

Kroger owned stores in most regions the North-West US still carry mushed or mashed avocado, and diced+frozen is said to do when you've got time to defrost and prepare it but not enough to ripen a fresh one (haven't actually tried either yet, but soon c:)

LanternLight83on The u-root CPU command

I suppose that's hypothetically possible, but no, it's not been implemented, and that's why I say that the intro seems to come at this from an odd angle-- I don't see u-root's CPU doing that either, despite the comparisons to static linking and other application packaging systems.

LanternLight83on The u-root CPU command

Awesome! This write up is satisfyingly detailed. Prior work in this space includes Plan9 of course, as well as the python project Outrun, which has it's own RPC-based FUSE FS: https://github.com/Overv/outrun

Other approachs to deployment in particular include the functional package managers Nix and Guix, which can create lightweight application images, and could probably be cobbled together into some sort of remote environment replication even across architectures. As I read on, I thought less about how this compares with Guix in regards to application/environment packaging and more about how these things could be glued together in interesting ways, because I think the intro leads in through slightly off-label examples, if that makes sense. Application packaging isn't what this addresses at the end of the day, but it's no less fascinating for it.

LanternLight83on Ask HN: How to introduce game rules gradually without breaking earlier levels?

Most rules are tied to particular elements of play, and in most games, the involvement of a specific rule is indicated by association with a color which can applied as an accent to those elements. You can tell when en passant applies in chess because potential moves are clearly indicated, when poison is involved because the enemies, terrain, or even just the screen-vignette is tinted green. If you can integrate a color into the entities that are most directly affected by the rule in later situations, then players can infer the rules absence by the absence of the color indicator, which should stand out enough to be notable but be subtle enough to still look cohesive in later levels.

LanternLight83on New(ish) command line tools

https://paweldu.dev/posts/fzf-live-repl/

Previous discussion here: https://news.ycombinator.com/item?id=20455857

Also featured in that thread: https://github.com/akavel/up

For example: echo '' | fzf --print-query --preview 'grep -R {q} . 2> /dev/null'

LanternLight83on WireGuard multihop available in the Mullvad app

It must be attached such it tears when opened, tamper-evident- similar techniques are common fro doors, either across the frame or more stealthily near the hinge. You want it to be a little stealth because an informed adversary could break the seal, remove it, and be prepared to replace/recreate it when they're done (like faking a new wax seal)

LanternLight83on I'm Not Sure I've Ever Enjoyed Programming

They say that choice of language doesn't matter, to just pick something you like and dive deep, but one doesn't really know the feel or pitfalls of a language until you dive deep into it for yourself. I think there's something to be said for using the tools that are already with you, like Bash + the Coreutils, BASIC, or C out of necessity, but I've found it easier to become immersed in higher-level and "ideologically opinionated" languages like Python, Ruby, and Lisp.

For me programming was something that started gradually as I became familiar with Bash, until in denial that I was programming at all. Ansible introduced me to Python, Jinja, and YAML, but I still didn't consider what I did to be programming. Scripting, but "I'm no programmer", just in a sysadmin rabbit-hole. I'll have impostor syndrome real bad.

Going back to Bash after working with Python was rough, and I've since delighted in learning new programming languages and paradigms as I solve my problem-of-the-week, gaining a new understanding and appreciation of how people can approach programming each time. The problems are trivial in retrospect, but feel significant at the time- each is an important stepping stone in the broader understanding of computing that I'm developing, as well as an excuse to get sucked into the syntax, ecosystem, and mental model of a new perspective. Perhaps I'll learn to delight in C someday too, but today I've found my stay in Lisp, and look forward to using purer functional languages in the future.

A background, and the perspective it gives a person, is a unique and special thing.

LanternLight83on Linux containers in 500 lines of code (2016)

I think they're going for the minimal line count by in lining the docstrings. In some of my own scripts, I've lifted an idea that I saw in the wild where your Usage header and function docstrings are just prefixed with '#/', a more aesthetic and equally unlikely string (which also looks good in blocks, so it could even be restricted to newlines that just are comments, letting the line count breath a but and removing any worry of accidentally using that sequence in code). Our help function would then just 'grep w/e $BASH_SOURCE | cut w/e'.

LanternLight83on Booting ARM Linux the standard way

I mean heck, since it's a Nix Package, couldn't they just build it with Nix as the build system? And if for any reason that is the issue (installing Nix on a foreign distros can be pretty invasive, containerized?), the recipe for how to build it is right there.

LanternLight83on Static torrent website with peer-to-peer queries over BitTorrent

This is awesome, thanks for sharing!

LanternLight83on Secure messengers in war time

"Ukraine" means outskirts, so one way to read it is that "Outskirts" is clearly the proper noun of a country, where-as "The outskirts" is a territory.

"The US", however, means "The United States", which makes it really clear that you're talking about the States as a nation (or at least as organized states) and gives it a lot of resistance to this nuance. The cleanest equivalent would "America" vs "the Americas", but because that's clearly too broad. Where a single article is all it takes to change the implication in the case of Ukraine, here we'd need more explicitly refer to the land, like "the continental US territory".

It's also worth noting that no one would be scrutinizing statements about the US in the same way because it doesn't have a context that puts it in dispute. At least in casual contexts, inaccuracies are often overlooked when what you meant to say is clear and uncontroversial.

LanternLight83on Win32 is the stable Linux userland ABI (and the consequences)

Functional package managers like Nix and Guix can reproduce an exact build of a program, including it's dependency tree (build time and runtime), and package that into a container, which can be shipped as an executable image (stripped down to just the neccesary runtime deps). Nix Flakes in particular allow you to define an entrypoint, making the build+run process nearly as painless as "docker run $x"

LanternLight83on GNU Guix package and system manager

It's not super polished or well documented yet (I think you still need to provision the machine), but guix deploy implements work in this direction, including explicit support for providers like Digital Ocean. https://github.com/guix-mirror/guix/blob/master/gnu/machine/...

LanternLight83on GNU Guix package and system manager

Guix let's you create "inferior" channels that are pinned to older channel commit(s) and build packages from them into your system, so if you have a particular package that's broken beyond a point, you can still pin it and roll everything else forward. I do wish there was a branch that was pinned to eg. the latest commit with a successful CI build of the Guix installer, but CI load is currently it's own issue, so I'd be as happy to see a mechanism for creating your own CI that merges master like weekly and runs custom tests (a la "guix system test"'s VM-based test suite).

LanternLight83on An example of why RSS is useful and important

I agree, but would add that nailing these features doesn't excuse a reader without sufficient support for customization of the UI (especially content). I might be able to excuse a reader with a polished, clean, and opinionated design (like Apple & Google's eBook readers), but would prefer to have as much freedom as possible, to the point of user-stylesheet support or some such low-level measure. Bonus points for features easing the manipulation of such 'profiles', such as a simple theme selector for easy swapping between an arbitrary number of custom styles and support for per-feed defaults.

Not to mention accessibility features, which readers are well positioned to support.

Not to be too picky, these are my ideals and I wouldn't so blutly demand such feature coverage from a developer. Y'all do what you think is best and I'll find what works best for me, thx to amyone who's contributed to a reader c:

LanternLight83on Show HN: Curl modified to impersonate Firefox and mimic its TLS handshake

I think ESR is the way to go too, but either way, I wonder if some tests can be written to confirm the coverage/similarity of the requests? It would entail automating a both Firefox session and the recording of network traffic, and feels like it might end up as bikeshedding.

LanternLight83on Reddit can't build a better search engine

Have had mine for several, don't use it as much as I used to because I prefer the sound signature of my phone speaker for spoken content but still love it for music. Reccomended it to my extended family and still get thrown for a loop when I see them using it all the time, like a piece of my home in their's.

LanternLight83on Rockbox – free replacement firmware for digital music players

I still miss the playlist-oriented interface from flashing this to my mother's old player growing up

LanternLight83on Don't contribute anything relevant in web forums (2020)

This absolutely happens on Reddit's mobile site; a little popup-overlay/link reading "Continue on the app!" blocks the content you're reading like you've run out of free Quora questions, can't be closed, and persists on reload.

LanternLight83on IRS to ditch biometric requirement for online access

Or switching to an ergo keyboard, trying a new typing layout, or just joining your first touch typing course?

LanternLight83on The next generation of terminal ergonomics: autocomplete

Yeah, Mac's use ZSH as their default shell, which IIRC is practically a super-set of Bash.

LanternLight83on The Ur-Quan Masters

Have you got any links related to those reworks?

LanternLight83on dwm

I think the great part is being able to assign multiple tags to a window so it appears under multiple workspaces (same toolbelt as a sticky tag, which can co-exist), and being able to assign multiple tags to a workspace ("Chat" and "Music"). The ability to toggle your music windows in and out of existence, independently of other contexts, feels more like having every window on a hotkey than switching to another entire workspace or using sticky. It abstracts your contexts out from your workspaces and allows you to preform manipulations across those sets. I don't think dwm would let you show the difference (https://en.m.wikipedia.org/wiki/Difference_set) between two tags without a patch (because why?), but if you wanted to you could.