HNHacker News
TopNewBestAskShowJobs

Normal_gaussian

4,700 karma · joined February 15, 2016

submissionscomments
Normal_gaussian··on Malicious npm packages detected across Red Hat Cloud Services
> Changing your own car's oil is actually not that hard

It is. Changing oil requires a place where you have sufficient access to the vehicle to drain it; the right equipment; the right disposal solutions. Most people who have cars do not have that. And it takes significantly more time to change your own oil than to have someone else do it as part of other specialist maintenance.

> Think of QR codes, people hardly used them for many years, because you needed to download an app for it, small step. It only started to catch up when you had it built in the camera app in most providers.

Exactly. Using a QR code app required specific knowledge of the app, an internet connection, some time, knowledge of how and when to use it, and something to use it with - the barrier of which surpassed the convenience gained from the QR code.

> So yes, everyone could open a file and edit it, also everyone could watch a youtube video on how to do X and yet choose to have someone else do it for them :)

I'm struggling to find a non-contrived group of people who:

- do not know how to open and edit a file on their system

- do use npm

- would find installing pnpm or running `sudo install -d -m 0755 /etc/apt/keyrings; curl -fsSL https://depsguard.com/apt/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/depsguard.gpg; echo "deb [signed-by=/etc/apt/keyrings/depsguard.gpg] https://depsguard.com/apt stable main" | sudo tee /etc/apt/sources.list.d/depsguard.list >/dev/null; sudo apt update; sudo apt install depsguard` simpler

Of course, cooldowns.dev is a very long winded way of telling someone to run `npm config set min-release-age=3`, which is the simplest.

Normal_gaussian··on Malicious npm packages detected across Red Hat Cloud Services
No.

Many places run analyzers on published code; many security users have reason to shorten the period. The default period becomes the period where white hats have a chance to detect it and stop it passing the threshold.

Normal_gaussian··on Malicious npm packages detected across Red Hat Cloud Services
> If you know how to edit your ~/.npmrc etc, you don't really need any of them, but if you have a loved one who just needs a one click fix, these can likely save them from the next attack.

This feels like a very very small group of people; and people who really could do with opening the file and adding the line.

Normal_gaussian··on Google changes its search box
Ask Joogle or Ask Geeves?

https://www.techradar.com/computing/search-engines/ask-jeeve... / https://en.wikipedia.org/wiki/Ask.com

Ask Jeeves was dissolved 15 days ago

Normal_gaussian··on Composer leaks contents of tokens configured as GitHub OAuth tokens
If everyone that can read the logs are people who can read the secrets, then nothing. If there are any log readers who should be be secret readers, its a potentially exposed secret.
Normal_gaussian··on Composer leaks contents of tokens configured as GitHub OAuth tokens
GHA have always been a PITA for any serious DevOps; it's quite clear they were designed to integrate in 7 lines of code and then tell everyone who complains that they're doing it wrong.

This does not surprise me.

Normal_gaussian··on Launch HN: Ardent (YC P26) – Postgres sandboxes in seconds with zero migration
Business side people install Claude, find it fantastic, read about postgres and BigQuery MCP, and immediately demand it.

Small enough company without suitable MoC and they've got a real chance of getting it.

Normal_gaussian··on eBay Rejects GameStop's $56B Takeover as Not Credible
https://www.google.com/finance/beta/quote/EBAY:NASDAQ?window...

eBay is doing fine.

Normal_gaussian··on Holding Community Space
'a' isn't very interesting though. Preferring more money because its more is very very uninteresting.

'b' is probably the point the person was trying to make - if they'd said "I would prefer $32/month rather than $1000 one-off" it would be a much more interesting comment, talking about the relationship between value and the commitment to the space.

Normal_gaussian··on Holding Community Space
Well sure; $32/mo is a lot more than $100 inside just 1 year
Normal_gaussian··on Wi is Fi: Understanding Wi-Fi 4/5/6/6E/7/8 (802.11 n/AC/ax/be/bn)
That is really interesting! (https://mikrotik.com/product/hap_be3_media for others). Its coming in at a decent price as well.
Normal_gaussian··on Wi is Fi: Understanding Wi-Fi 4/5/6/6E/7/8 (802.11 n/AC/ax/be/bn)
From the article (which is long):

> But as a very significant bonus, the 'extra' antennas if there is a mismatch in MIMO levels between the client and router do not go unused, but are used for 'diversity' and 'beamforming', which extends range, and improves speed at range.

You don't get higher max speed, but you do get better performance in general. I hadn't expected it to be drastic - I had thought it would be more theoretical than practical - so I had been planning on adding some 2x2 APs in a few months; but I don't think I need to now.

The original drive was because I have 4x4 on my desktop which won't get wired in for at least a year now; and my homelab is wired in.

Normal_gaussian··on Wi is Fi: Understanding Wi-Fi 4/5/6/6E/7/8 (802.11 n/AC/ax/be/bn)
Today I set up a NWA210BE (Zyxel) to replace a unifi 6+ AP; I bought it second hand and my key metrics were: 4x4 MIMO, available used/discounted, current gen, fully functional standalone mode.

The 4x4 makes all the difference. Sitting in my car the 6+ would fight with my 4G for internet and cause maps to be super slow; now I'm off the property before its unusable.

I had intended to put APs in multiple rooms, but there doesn't seem like much point now.

Normal_gaussian··on Rumors of my death are slightly exaggerated
Yes; this is the way
Normal_gaussian··on Docker 29 has changed its default image store for new installs
the training data is on a separate drive; or the training data isn't that large for this use case; or they aren't training.
Normal_gaussian··on US special forces soldier arrested after allegedly winning $400k on Maduro raid
While it seems like an interesting point - a kind of 'doubling down' - its not clear cut at all.

Firstly, the dichotomy you presented for the individual is: succeed, live, and make loads of money vs fail, die, and lose a fair chunk. The argument you make with this dichotomy is that the gambling doesn't affect anything. However the reality is that there are many ways for the mission to end - fail, live, lose a fair chunk being notable because when the mission is going sideways the individual becomes incentivised to put themselves and others at greater risk to make a successful outcome more likely. Succeed, live, lose your squad mates, make loads of money becomes more likely as well as fail, live, lose your squad mates.

Secondly, insider trading is and always will be a signal for others. If you're only allowed to bet in one direction it becomes a form of information leak - monitor who is liquidating their assets to gamble on outcomes. For any project it becomes a signal to others - if your boss isn't remortgaging to gamble more then you know its time to jump ship. This will in turn have significant effects on outcomes.

Normal_gaussian··on An update on recent Claude Code quality reports
I often have Claude commit and pr; on the last week I've seen several instances of it deciding to do extra work as part of the commit. It falls over when it tries to 'git add', but it got past me when I was trying auto mode once
Normal_gaussian··on Show HN: CodeBurn – Analyze Claude Code token usage by task
This is cool.

I do find the activities a little suspect - it has 1 turn of planning for me in the last 30 days. I have claude write plans first before every coding session, often using one agent session to plan and then output a plan file, and then others to execute on it. I also have several repos dedicated to 'planning' in the sense of what should I do next based on what emails/tickets/bugs etc. I have. In other words - I do all kinds of planning!

Normal_gaussian··on Cloudflare's AI Platform: an inference layer designed for agents
yeah this really sucks.

No downtime snapshots would be the best but I'd be quite happy with a blocking backup on a set schedule that can be set from the GUI / from the cli / from a config file. Its a huge PITA having to play 'trust me bro' to clients and their admins with custom workers and backups.

I currently stream it D1 dump -> worker(encrypt w/ key wrapping) -> R2 on a schedule, then have a container spin up once a day and create changesets from the dumps. An external tool pulls the dumps and changesets.

Normal_gaussian··on Protect your shed
My other comment goes into more detail relating specifically to my earlier comment. But a niggle with Home Assistant in particular:

It appears to be a system designed to be debugging adjacent, with every intent to frustrate debugging.

Normal_gaussian··on Protect your shed
No, the I/O passthroughs are fine. Proxmox and HA are fairly great at keeping them stable. I have passthrough for WiFi/BT/USB zigbee/USB thread Of course it pins you to a singular proxmox host, not benefitting from proxmox HA, but that's the way the cookie crumbles with h/w.

pfsense and home-assistant both claim to be declarative configs, which is technically true. However the config files are not well or effectively documented, and where there is documentation it typically relates to the GUI which diverges significantly in arrangement. Their configs are declarative in that they declare the way their internal processes are configured, not in the way that they should interact and appear to other services (networking people will find that statement very confusing).

Both are effectively "Operating Systems" within operating systems, starting/stopping/configuring/managing other programs, home assistant is doing this to the nth degree. When you start them it is very hard to determine when they have actually started - particularly the bits you care about. Getting errors and logs out of them is painful. Updating configs and restarting has multiple routes, the longest of which is very long.

Both are reasonable ways to get to grips with the problem areas they solve for; they are not optimal however.

Normal_gaussian··on Stanford report highlights growing disconnect between AI insiders and everyone
I think there is a lot of truth to what you say, particularly when it comes to caring rather than parroting; however as part of my personal and civil life I interact with a lot of non-tech people in non-tech capacities, and a surprising number of them raise unprompted complaints about people like Sam Altman and Elon Musk. Musk I understand everyone knowing about; between Tesla, SpaceX, the Thai boys football team, a very public inclination to raise his hand, and a position in the US government he is meaningfully famous. However how Sam Altman has managed to get his name out there in the wrong way very quickly to a bunch of Brits I don't know.
Normal_gaussian··on Building a SaaS in 2026 Using Only EU Infrastructure
The best bit:

> A subtle, high-visibility banner

Normal_gaussian··on One item purchased, ten emails
A whole load of banking products aren't legal in the UK, or are highly regulated; particularly sludge products which are easy to sign up for but hard to cancel.

UK banks are required to make their communications easy to understand and relevant. There are also regulations requiring banks to tell users when products may be unsuitable.

All UK companies have to adhere to the UK GDPR, which allows users to restrict what marketing can reach them.

So yes - a bunch of regulations.

Normal_gaussian··on One item purchased, ten emails
I'm in the UK. I have several bank accounts, both personally and for business.

For my four personal accounts my last email was last October, and the one before that was last July.

For my business accounts I have most set to email me a statement every month (automations attached).

Normal_gaussian··on Protect your shed
I have a professional 'homelab' and a personal 'homelab'. You're 100% right, they can be a time sink. The important bit is to make sure the time is setup not 'maintenance' time.

The trick is twofold: if it isn't 'declare and deploy' don't run it. If it isn't in your backup/restore pipeline don't run it.

Pfsense and Home assistant are huge pains in the ass. Everything else is easy breezy.

Proxmox/pbs/truenas/talos/linstor/DRBD are all amazing.

I'm thinking about ditching pfsense for tailscale/cloudflare tunnels, but it's not worth the time atm. I don't have a viable alternative for HA.

Normal_gaussian··on Assessing Claude Mythos Preview's cybersecurity capabilities
It can be easier to hack the device and patch it than determine which device it is. This is nearly always true for the non-technical, but it is true for most technical people as well. Many of the devices in peoples homes that aren't being actively patched are not that old!
Normal_gaussian··on "The new Copilot app for Windows 11 is really just Microsoft Edge"
Electron is NodeJS + Chromium + Some native control APIs (trays/menus/shortcuts/window management) + update & packaging.

So a lot more can be done with an electron app, while still staying mostly in the web based comfort zone.

Normal_gaussian··on Issue: Claude Code is unusable for complex engineering tasks with Feb updates
https://claude.com/pricing#team-&-enterprise

Team is not per-token priced

Normal_gaussian··on Number in man page titles e.g. sleep(3)
It's called Claude. Or Gemini-cli. Or any other agent capable of running man.

"Hey <agent>, use `man` to help answer these questions about grep"

← PreviousPage 4 of 34Next →