Hacker News Reader

Vendanon Soli

Yeah, but what you are feeling with the "click" is not directly physical. Turn your computer completely off (not just power off, but like, "hold the power button" hard shutdown, and that "click" will stop happening.

Vendanon Why Generics?

or just "Better has multiple dimensions", and not all of them are "Theoretically purer" or "look how succinct I can write this code". "How hard is it to hire devs?" is just one of those dimensions.

Vendanon Why Generics?

Compiler perspective (fast compiles are a core part of Go, IMO), various tradeoffs(fast compile? fast runtime? binary size? Pick 1 or 2), and seeing code bases that get out of control with generics and such.

Note that, for all of that, I'm still in favor of adding generics in Go, as I do see the value they can add. I'm just pointing out that "bashing" on Go devs on not knowing what generics are or how they can be useful is both non-productive and probably generally wrong. Plenty of us are saying "Man, if I had generics, this would have been less code/cleaner/more reusable!", just the other various tradeoffs outweigh the actual cost of using a different language. Go's ability to drop a very junior dev (or just one that has never use Go) into a codebase and have them be almost immediately productive is incredible.

Vendanon Why Generics?

What is it when you know about the power of features of the "higher level" languages, like generics, but still chose the "blub language" because of other reasons, like ease of hiring devs?

Vendanon Why Generics?

And yet, the core devs have never said they don't want generics, only they didn't want a poor implementation.

Also, there's a bit of hilarity about commenting this on a blog.golang.org where the first sentence is "This article is about what it would mean to add generics to Go, and why I think we should do it." being posted by a core Go dev....

Vendanon Why Generics?

Chiming in as a fervent Go dev that's also a huge fan of generics: Generics are awesome, but always seem to add a ton of complexity. Everyone starts with just "oh, `func Reverse(slice []T)` is so obvious" kind of thing, but that's like saying `fmt.Println("Hello World")` is simple. It's simple cause you are doing a simple thing.

That said, I do want generics to come to Go, just... with an emphasis on what Go is, not just "here, let's replicate X's generics in Go". I am interested in the contracts implementation.

Vendanon Siri records fights, doctor’s appointments, and sex, and contractors hear it

The Mycroft Home stuff covers Google Speech to Text, so I'm betting that overall speech processing is done in the cloud, though I'm sure wake-word detection is done locally.

https://mycroft.ai/documentation/home-mycroft-ai-pairing/

Vendanon How not to sign a JSON object

as far as I can tell, it's cause they are hardcore JS devs, where JSON is seen as almost a part of the language, and little to no effort was put into things like future-proofing. A lot of the failings have been fixed as the community grows, but this one is core to how the whole thing works, so changing it at this point is fairly non-trivial (would basically involve completely breaking any kind of backwards compat, and potentially even some forwards compat)

Vendanon How not to sign a JSON object

Don't worry, multiple people (including me) have told the community in question that it's a flawed approach. Doesn't seem to have done much to fix it though... :shrug:

Vendanon How not to sign a JSON object

https://tc39.es/ecma262/#sec-json.stringify

The stringify function returns a String in UTF-16 encoded JSON format representing an ECMAScript value, or undefined.

Vendanon How not to sign a JSON object

At least when I implemented it, it was the full message, as a complete valid json object. The signature would get added as another field, and then the object reserialized.

Vendanon How not to sign a JSON object

SSB signs objects like so:

    {
      "previous": "%XphMUkWQtomKjXQvFGfsGYpt69sgEY7Y4Vou9cEuJho=.sha256",
      "author": "@FCX/tsDLpubCPKKfIrw4gc+SQkHcaD17s7GI6i/ziWY=.ed25519",
      "sequence": 2,
      "timestamp": 1514517078157,
      "hash": "sha256",
      "content": {
        "type": "post",
        "text": "Second post!"
      }
    }

gets signed like

    {
      "previous": "%XphMUkWQtomKjXQvFGfsGYpt69sgEY7Y4Vou9cEuJho=.sha256",
      "author": "@FCX/tsDLpubCPKKfIrw4gc+SQkHcaD17s7GI6i/ziWY=.ed25519",
      "sequence": 2,
      "timestamp": 1514517078157,
      "hash": "sha256",
      "content": {
        "type": "post",
        "text": "Second post!"
      },
      "signature": "z7W1ERg9UYZjNfE72ZwEuJF79khG+eOHWFp6iF+KLuSrw8Lqa6
                    IousK4cCn9T5qFa8E14GVek4cAMmMbjqDnAg==.sig.ed25519"
    }

which means that you have to be careful about how you remove the signature in order to verify the original. The "main" node implementation does this by parsing the json, removing the field, and then re serializing, forcing any alternate implementation to exactly match the node serialization in order to be compatible

Vendanon How not to sign a JSON object

As one of the people that built a alternative implementation, this is completely true, but also much worse, cause there were 2 things around crypto, signing and hashing, and one encoded it one way, and the other encoded it a different way (encoding as far as utf16 and such) which meant that for ascii, everything just worked fine, but as soon as you started using non-ascii, everything got 2x as complex.

Vendanon Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

Propane fridges actually burn the propane for heat, so it's not using it as a "refrigerant", just as a heat source.

Vendanon Why we’re switching to calendar versioning

Yeah, and I've been in a similar situaton. A year in, and my wife told me I needed to get a new job cause that one was making me "depressed"

Vendanon Why we’re switching to calendar versioning

If I worked on something for 5 years with no rewrites/improvements, I'd be demotivated as crap, no matter the version number...

Vendanon Removing Array Duplicates

You can just do

    found[key] = struct{}{}

Vendanon Why is no one signing their emails?

It's worth noting that ignore/report is for the email server it's destined for. The server is supposed to send reports back to google (mailauth-reports@google.com specifically) about the failures and such.

Vendanon Why is no one signing their emails?

But it can work for individual addresses as well. For instance, gmail uses DKIM. If they only DKIM sign an email if the user is logged in as the address they are trying to send as, then boom, DKIM is proof that the email from is not forged, and the only way to bypass it is to hack the account.

Vendanon Why is no one signing their emails?

This is a thing: DKIM.

Lets email servers and domain owners attest that a message was sent by them. For instance, gmail can apply a DKIM to all outbound emails, to verify that it's sent by gmail, and that they authenticated the person that it was sent as. For example, here's one of gmail's DKIM public keys:

  k=rsa; 
 p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAviPGBk4ZB64UfSqWyAicdR7lodhytae+EYRQVtKDhM+1mXjEqRtP/pDT3sBhazkmA48n2k5NJUyMEoO8nc2r6sUA+/Dom5jRBZp6qDKJOwjJ5R/OpHamlRG+YRJQqRtqEgSiJWG7h7efGYWmh4URhFM9k9+rmG/CwCgwx7Et+c8OMlngaLl04/bPmfpjdEyLWyNimk761CX6KymzYiRDNz1MOJOJ7OzFaS4PFbVLn0m5mf0HVNtBpPwWuCNvaFVflUYxEyblbB6h/oWOPGbzoSgtRA47SHV53SwZjIsVpbq4LxUW9IxAEwYzGcSgZ4n5Q8X8TndowsDUzoccPFGhdwIDAQAB

If you get email from a domain that uses DKIM (you can use DMARC to tell), then you can reject that email if it's not signed, or if the signature is invalid. Companies can set this up on their mail servers, so it just works for every email client effortlessly.

Vendanon Partial password usability sucks

5 characters is "pretty simple to bruteforce" area, and now you've got 5 characters, replicate that for the other patterns, and you can probably crack the whole password pretty easy

Vendanon We Lost Our Ability to Mend

I'd recommend something like this: https://www.amazon.com/OXO-Grips-No-Spill-Silicone-White/dp/... The ice "slots" get completely sealed with the silicone, and I have stuck it in on it's side and it didn't leak at all.

Vendanon Apple blocks Google from running its internal iOS apps

Google blocking this kind of thing in android would be quite hard to near impossible...

Vendanon Show HN: Shellvault – Cloud SSH terminal accessible from any browser

secure password auth trumps "give full access to stranger" auth any day of the week....

Vendanon Show HN: Shellvault – Cloud SSH terminal accessible from any browser

Not only is it completely possible, pretty sure it's already been done.... https://github.com/stuicey/SSHy

Vendanon Water-stabilized hydrogen promises twice the range of gasoline at half the price

60% water, so it depends on what the other 37% is

Vendanon How Alexa knows “peanut butter” is one shopping-list item, not two

yeah, but which way? `Add custard powdered sugar to my shopping list` is is powdered custard, or powdered sugar?

Vendanon Dotsies (2012)

Eels. My hovercraft is full of eels.

http://www.omniglot.com/language/phrases/hovercraft.htm

Vendanon Bubble memory

The "movement" is the bubbles of magnetic state moving along the track under the influence of an external magnetic field, not the track itself moving. So yes, it is both at once.

Vendanon Go 2, here we come

> language allows casting pointers to integers

The original thread was about converting int to be an arbitrary precision type: "so that 'int' can become a true integer". One would imagine that, to preserve the ability to do pointer <-> non-pointer number, they would just leave uintptr alone, and so basically ignore your concerns, whereas int as the "native type" for slice indexes and the like is a more likely reason to prevent messing with "int" itself