HNHacker News
TopNewBestAskShowJobs

ValdikSS

1,446 karma · joined December 29, 2014

submissionscomments
ValdikSS··on Is it time for a new Embedded Linux build system?
Wow, no cross-compilation as a feature?!

Architecture emulation with qemu-userspace is 5-10x slower than running a native build.

The only 'proper' no-friction cross-compilation system I know is Debian/Ubuntu, because it allows to install foreign architecture libraries into your native system, and has all the wrappers for cross-compilation in dpkg-buildpackage.

This way you don't have to maintain cross-compiler or toolchain/sysroot, you just install whatever dependencies you need with the regular `apt install` of another architecture.

I'd like to have more friendly tooling around that instead of a slow compilation of architecture emulation.

ValdikSS··on Digital Printing of Arabic: explaining the problem (2017)
>compelling explanation for why Nastaliq is hard/unavailable

https://www.tiro.com/John/TypeCon2014_Hudson_DECK.pdf

ValdikSS··on Digital Printing of Arabic: explaining the problem (2017)
It still is a problem in general, that's why fonts now have webassembly in it.

This repository has a good outlook: https://github.com/harfbuzz/harfbuzz-wasm-examples

ValdikSS··on CVE-2026-42530 – Nginx HTTP3/QUIC Use-After-Free
It's an RCE

https://x.com/nebusecurity/status/2067623683427045541

ValdikSS··on Running local models is good now
Gemma e2b, Gemma e4b. It's made for smartphones basically. You can run e2b with 8GB RAM.
ValdikSS··on Curl will not accept vulnerability reports during July 2026
This is true for the majority of open-source projects, but the most serious ones, on which a lot of software/businesses/infrastructure depends, are controlled by foundations or some kind of other management entity.

cURL also offers paid support and also paid access to the rock-solid (LTS) version, with guaranteed response times, and the blog post states that there's still people to respond to these.

ValdikSS··on Every Frame Perfect
>That wasn't the criterion, which was "the best"

Yes. Making perfect transition animations for the software is a very hard task, which is totally useless in my opinion — transitions shouldn't be made for screenshots, it should be made for humans to understand what have changed, how did click influence the UI.

>So show your Kwin animation example

https://litter.catbox.moe/s6ahsjybdcfkvdi5.mp4

>explain how it's the best due to "human vision" compared to a transition without the weird stretches.

Simple: Nikita's file picker example tries hard to repaint in time, and that looks very weird, because it's both janky and not how the window usually repaints.

And the latter is what the human eye and human brain are consider weird. If the animation does not attempt to present the contents during the animation, but instead only acts as a transition from state 1 to state 2 using smooth (as in constant-FPS) action, it does it job better, even if it does not preserve or even present the real contents during the animation.

The example of it could be seen on many websites which show the web page elements templates during loading (elements are positioned on their places but don't have real data yet).

>And again, what features of "the human visual system" does white window exploit that makes it the best?

If you present crispy sharp, high-fps picture to the user, the brain would look for any animation deficiencies, nitpicks.

If you just hide the contents in some way (blur, no repaints, no data), the brain just won't try to find anything weird.

ValdikSS··on Every Frame Perfect
>You also don't seem to understand what that example shows

I do understand, and this is exactly what I consider weird. Instead of repainting (in any way, even what is considered pleasant by you and Nikita), I'd prefer blur/mosaic/white window during the animation. Not the motion blur, but just not the actual contents of the window! This breaks "every frame is perfect", you can't make a meaningful screenshot of this transaction.

In KDE's Kwin, I configure windows resizung using crude stretching algorithm. This means I see non-proportionally weirdly stretched window several frames, then it repaints. On screenshots that looks really weird, while in reality this is quite ok.

ValdikSS··on Every Frame Perfect
You can read why people prefer 24 fps movies instead of high-fps ones.

I'm quite puzzled by the article. Animations in software are transitions, it should not be perfect in UI sense, because it might look weird to the human eye in this case.

I'd prefer motion blur to something crisp. This is the case of file picker example.

ValdikSS··on Introduction to UEFI HTTP(s) Boot with QEMU/OVMF
It works on the majority of UEFI implementations

1. Just a matter of a boot entry. However adding the boot entry is not trivial: efibootmgr used to have implementation which have been reverted (it was incomplete, works only with full device path unlike just MAC which the original code added).

I don't know any utilities to do that, ended patching efibootmgr myself.

Learned about it from this talk: https://youtu.be/EtGhHCr3VLE?t=567

2. HTTP Boot is also available as a DHCP option 67 without boot entry:

* https://github.com/tianocore/tianocore.github.io/wiki/HTTP-B...

* https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha...

ValdikSS··on Spoiling Linux Kernel with "sanctioned" code
Greg K-H is one of the original author of OHCI implementation, and the current USB subsystem maintainer. Another USB subsystem maintainer told me he won't merge the code without Greg's approval (he's OK with my code and reviewed it, as you can see in the mail list).

This is not the first case anyway.

>author doesn’t get to contribute to the Linux kernel because their government

I guess you're missing the point: nobody has asked me anything. The whole assumption that I'm Russian, from Russia, and a possibly designated, comes from using my .ru email.

I used to have .cn and .be domains as well during my life, should have been Chinese or Belgian to send kernel patches :D

ValdikSS··on Spoiling Linux Kernel with "sanctioned" code
The patch removes this latency and improves transfer speed, without any drawbacks.
ValdikSS··on Spoiling Linux Kernel with "sanctioned" code
Why should it be? It has low rating (yet).
ValdikSS··on Parallel Reconstruction of Lawful TLS Wiretapping
That's right, it's easier to setup such MiTM using an intermediate server, because only getting the private key of the certificate won't get you the user's traffic due to PFS.

You either need to disable PFS on the server, or export TLS master keys for each session in some way, or MiTM.

ValdikSS··on Liquid AI reveals 8B-A1B MoE trained on 38T
Bad at translation, at least to Russian. Very fast though, about 2x faster than Gemma 4 e2b on my CPU.
ValdikSS··on Pushing to a pull request that isn't yours
On GitHub, if anyone makes an MR which changes the name of existing GitHub Actions, it will be instantly renamed. The web interface will show redefined name, even if the MR comes from new contributor (and yet unmerged of course).
ValdikSS··on Flipper One – we need your help
You're biased. AI was trained on a well-written professional texts which used these phrases and speech patterns, it was very common before the AI-generated texts. These speech patterns especially common for Russian speakers.
ValdikSS··on Flipper One – we need your help
I can't understand why people defend improper typography. If you're writing a proper, professional-looking blog post, they think you now should use double-minus -- instead of em-dash to make it look non-AI like, only for that reason?

In Russia, we have many typography keyboards/addons, because, well, it historically looked very silly to use double-minus or "-quotes instead of «»-quotes.

I've no idea how some countries got their typography standardized on the PCs and have it from the very beginning (Germany with their quotes for example), but the other countries need to setup external software and configuration. Apparently, US also didn't got their "third level" keyboard as a standard.

ValdikSS··on Reviving old scanners with an in-browser Linux VM bridged to WebUSB over USB/IP
Any airprint/mopria certified devices don't need drivers to work on Linux, Windows, Android or macOS.

https://mfi.apple.com/account/airprint-search

https://mopria.org/certified-products

ValdikSS··on Reviving old scanners with an in-browser Linux VM bridged to WebUSB over USB/IP
See above, that's my mistake.
ValdikSS··on Reviving old scanners with an in-browser Linux VM bridged to WebUSB over USB/IP
Sorry, it's me who needs a reading comprehension lessons. I've read back in printervention website and now again that you didn't open the code that you HAVE to. Because you're apologizing for that, I assumed that you're breaking the license, twice.

After rereading both of your websites again, I should say you've nothing wrong! It's sleepy me who accused you for nothing, sorry.

Linux printing and scanning stack is held on 5 enthusiasts basically, and is quite buggy. Any contributions welcome.

If you want to further improve your project, make it small and fast, you can compile printer filters (most of which work on cups-raster data) with emscripten. This way you don't need to use CUPS, Linux, and x86 emulation. You'll need to write some shims for CUPS libppd functions which many filters use (some don't), and either parse PPD files or convert them into another representation.

Most filters (drivers) are quite simple pipes from stdin to stdout, sometimes they don't use cups functions at all, receiving all the data directly from raster header. Some filters, such as gutenprint, are more complex and use their own backends, but even in this case it's not a hard task: libusb has emscripten WebUSB backend.

ValdikSS··on Reviving old scanners with an in-browser Linux VM bridged to WebUSB over USB/IP
It's a great concept, but you haven't open-sourced the previous code, as the license requires, and you're yet again apologizing in this project as well, without any code.

Pretty sure you have my code in both projects. I contribute first and foremost to make printers and scanners to work reliably, but also keeping in mind the idea that I could at least try to apply legal actions for companies which violate the license rules one day, as a CUPS/SANE/printer/scanner drivers contributor.

Printer companies generally don't like that: https://xcancel.com/ValdikSS/status/1745898408693371125#m

Cool project though! Hope you can publish the source one day so we can all benefit from it in the future!

ValdikSS··on We stopped AI bot spam in our GitHub repo using Git's –author flag
Linux kernel contribution policy required sending patches under real name, but that policy have been lifted about 2 years ago. Now they allow pseudonym contributions.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

https://github.com/cncf/foundation/blob/659fd32c86dc/dco-gui...

ValdikSS··on A 0-click exploit chain for the Pixel 10
It's a part of PDF, so if there's a PDF renderer which makes preview, it supports G4 and JBIG2.
ValdikSS··on How Fast Does Claude, Acting as a User Space IP Stack, Respond to Pings?
That's why LLM will eventually be used only for initial interaction between the user in their language, to prepare the data to a specialized model.

Imagine face recognition to work like a text chat, where the PC gets the frame from the camera and writes in the chat: "Who's that? Here's the RGB888 image in hex: ...".

ValdikSS··on Denuvo has been cracked in all single-player games it previously protected
Denuvo is owned by Irdeto, a digital rights management company in a broad sense. They not only do software and hardware DRM, but also work as a watchdog for movie and music companies to claim DMCA violations for BitTorrent, among all other stuff.
ValdikSS··on Open source does not imply open community
>there are only a few licenses approved by OSI that are not also considered Free Software

This is what I'm trying to conterpoint: you're thinking of "Free software" as in legal definition of GNU (4 freedoms), and "Open Source software" as in legal definition of OSI (10 points), in terms of the licenses approved by these organizations.

Users see open-source as a combination of legal/social/community expectations, as a phenomenon. Overwhelming majority of the software have only legal license, and nothing more, and oftentimes the developer themselves don't know what their social behavior should be, they're forming it given the circumstances.

We focused ONLY on the legal definition of open source for very long, and hardly spent time on the other, IMO much more important things: for whom this software is for, how should you communicate, what should you expect as a user, everything about social aspect, maintenance (which is out of scope of legal definitions of the software, but which made FOSS that appealing).

I've even seen cases where the author changed the license (used "legal measures") to prevent further community from forming around the software (to decimate users, to make the software less appealing to FOSS community), because it was too overwhelming to respond to everyone. Instead of using direct measures (social statements of some kind), they used license as a community control method. The author didn't really want to change the code license, they just didn't know other means to achieve different social expectations/behavior they want.

ValdikSS··on Open source does not imply open community
The only instance of social contract I know is Debian's, initially from 1997.

https://www.debian.org/social_contract

>I wonder if this always used to be the case

As written in the article of discussion, it used to be, well, quite a mess. There wasn't an established social expectation that you can ask author to do something, and they will do that. The whole software ecosystem was 100x smaller, and most of the users were tech-savvy. The author released the software somehow, this v1.0 got updated my "many" people (back than many meant 3-4-5), and then, after quite a while, it made a roundtrip back to the author, for which they "officially" released v1.1.

That's it, more or less. If no more bugs found, the software was considered as finished.

ValdikSS··on Open source does not imply open community
The article recalls people that open-source software is not necessary created for the community, but rather by the author, for the author oftentimes.

The "support" is not only the maintenance burden which (sometimes) could be solved for money. It's also the features that the original author just don't find useful at all, but others may want to have.

If I don't have Mac, never used it and don't plan to buy it, why would I want to accept contribution to support this platform? It's useless for me, I won't be able to test it (and it will break sooner or later), and once the code is accepted, it's usually assumed that it would be maintained by the application author, not the code contributor (unless additional CLA is signed, etc).

ValdikSS··on Open source does not imply open community

  - FOSS applications don't have to be distributed publicly — that's only the common social expectation
  - FOSS does not imply that the code should be available for non-customers. The developer decides who is the customer.
  - FOSS is *encouraged* to be sold for money, *you can sell others' software, even if it's originally free of charge* (see https://www.gnu.org/philosophy/selling.en.html)
  - Open-source licensed with non-free license is still open-source, although non-FOSS
  - You, as a developer, should not be ashamed to choose non-free open-source license if you want to earn (more) money on your software or apply additional restrictions for your benefit. It still could be copyleft.
TL;DR: we invented LICENSE.md and stick to it a lot, but nobody thought of making SOCIAL.md. When someone says "open source", many assume:

> The author is making it "for people, for society, for everyone around them, interested in developing the project, adding new features (especially those I need), and improving it in every way for the benefit of all users. After all, if that's not the case, why even publish it?"

This, however, is just a most common social expectation of FOSS, but far from the only case. Lack of mention of this distinction between technical and social open source is the main cause of disagreements, disputes, and, ultimately, burnout due to misaligned social expectations.

I used to have to explain the problem and the difference to an outraged public, but recently I came across an article by Jeffrey Paul https://sneak.berlin/20250720/the-agpl-is-nonfree/ comparing open-source code to a gift! My explanation boiled down to:

"Don't like the gift, it doesn't suit you? Throw it out and forget it!"

← PreviousPage 6 of 14Next →