Hacker News Reader

awirthon JPEG image of Shakespeare which is also a zip file containing his complete works

Did people do this back in the day? 4chan used to be totally fine with just uploading a jpeg concatenated with a zip, but I haven't seen this ICC profile trick before today.

awirthon Google Home (in)Security

Yeah, I'm not sure what flow lets you bypass that that GP is refering to. My impression was there aren't any, you always need to be able to see the screen to get the PIN code, and presumably there's rate limiting on trying codes.

awirthon HHVM JIT: A profile-guided, region-based compiler for PHP and Hack

Yep, you're totally right. I misspoke.

awirthon HHVM JIT: A profile-guided, region-based compiler for PHP and Hack

The development of HHVM is really interesting. I spent some time a while ago dockerizing an old version of HPHPc (the previous PHP -> C compiler which HHVM grew out of) and put it up at https://github.com/allanlw/hphpc-docker - The version reflects what you might see in early 2013. It should be dockerized and easy to play with if anyone is interested.

awirthon Ask HN: What are some niche communities you enjoy?

The amount of garbage is pretty highly dependent on the board - the entire site isn't /pol/. If you're willing to be your own content filter and can handle a lower signal to noise ratio than a curated community there are a lot of good posts. It's DEFINITELY not for everyone though.

For example, 4chan has some of the most up-to-date English language discussions around for a lot of Japanese fandoms. If you want to discuss new releases of obscure japanese noise bands, you probably want to be /mu/. If you're not on /mu/ and are on some other platform, you're probably just going to get a regurgitated version of the discussion from /mu/ anyway, with an increased propogation delay and someone else doing the cherrypicking. (Note: I'm just using "Japanese noise bands" as an example, I don't know if that particular discussion on /mu/ is good, or if the relevant low-latency discussion is on Twitter, Tumblr, Reddit, etc these days)

awirthon Ask HN: What are some niche communities you enjoy?

If you're suggesting hacker news is a "niche" community, then we're likely talking about different scales of niche-ness. HN has a few orders of magnitude higher traffic and larger target audience than the types of communities I had in mind.

awirthon Ask HN: What are some niche communities you enjoy?

I said "hard to find" not "impossible to find". Start with being in the subreddit or relevant other high-traffic high-SEO community for the subject, and see what other places the good members are discussing (often a discord, IRC channel, Slack, forum or similar). Recurse a few times, and each time you do you'll get a higher signal-to-noise ratio, higher expertise, lower abuse/garbage behavior, etc

If you just link random people directly, you'll inevitably get some folks that can't read the atmosphere and just generally walk all over the flowerbeds without realizing what they're doing. AKA they need to "lurk moar"

awirthon Ask HN: What are some niche communities you enjoy?

The best niche communities on the internet would get worse if attention was drawn to them. They're good because they're hard to find and membership is self selecting and/or invite-only. This is true, as far as I can tell, for communities on nearly any topic/subject matter.

awirthon A CLI game to learn Vim

I've been practicing making Dockerfiles for things so I figured I'd do this one too.

https://gist.github.com/allanlw/64aaa1ed1b24fa3eb833da7940b3...

Dockerfile style/feedback appreciated, although this is really quite terse

awirthon Sex Workers Say Porn on Google Drive Is Suddenly Disappearing

That sounds like a privacy nightmare.

awirthon IOTA: A tangled mess

You can have the exact same problem with just different versions or even configurations.

awirthon Safe Pointers in SPARK 2014

This is a really cool paper with impressive results.

An interesting property that this paper doesn't consider (I believe the language described does not allow it though) is casting pointers/references to integers. Many languages consider this unsafe, but Rust does not. Considering casting pointers to integers unsafe prevents 'address disclosure' vulnerabilities, which is relevant in the context of any program that incorporates (potentially buggy) unsafe code (read: all of them). This can be used to defeat ASLR.

awirthon AlphaSmart

We had these too, but I distinctly remember getting in trouble in 5th grade for making ASCII art on the helpfully monospaced display.

awirthon I'm on the FCC. Please stop us from killing net neutrality

body gets a class ".bx-client-overlay" that has "overflow: hidden!important" which hides the scrollbar

awirthon IRC necromancy

At work we have an onsite Zulip instance which meets both those requirements for us (including SSO integration). It's surprising to me that there aren't more places using it.

awirthon NoScript Not Available for Latest Firefox

I have a small extension (~100 users) that I forgot to upgrade until 57 landed and broke it. I hastily threw together a WebExt version and pushed on Wednesday night, but forgot to set the strict_min_version flag correctly (which was, unfortunately, Firefox 57).

The new version worked fine for people on 57, but for anyone that was on ESR or a slightly out-of-date version of firefox and updated they got a broken WebExtension that I couldn't push another update to to fix it - Firefox doesn't let you "downgrade" from a WebExtension to a native extension. Thankfully a user emailed me about it and I had it fixed in less than 48 hours, but it was still a mess. All I could do was add a note to the addon description and disable the bad versions and anyone that got broke had to manually downgrade.

The new Webextensions are nice, but it was definitely easy to shoot yourself in the foot with the transition. I know that NoScript also needs the same API that I was using (the ability to inspect response bodies), FWIW.

The extension is https://addons.mozilla.org/en-US/firefox/addon/gpsdetect/ for those curious

EDIT: brevity

awirthon Linux containers in 500 lines of code (2016)

Ditto for the seccomp syscall (and args) blacklist, although I wouldn't describe it as "worrying" considering the disclaimer at the top. Jess Frazelle's contained.af uses a seccomp whitelist[1], which doesn't need to be that long to allow reasonable programs to execute.

This is a very good piece of writing with extensive references and I'll definitely find this useful to share in the future. She documents a ton of tradeoffs she made and resources she chose not to constrain (including the aforementioned syscalls and capabilities), which is important in this type of design and something that I wish I saw more of.

[1]: https://github.com/jessfraz/contained.af/blob/master/seccomp...

awirthon Why would anyone choose Docker over fat binaries?

But here's the thing: You can dockerise a PHP app. How am I meant to make a fat binary out of one?

For years Facebook (reportedly) did this with hPHPc. Not a very good idea these days, but it's certainly within the realm of possibilities for large companies.

awirthon An ode to pack: gzip’s forgotten decompressor

A nice middle ground would be to change to have this unexpected code path require explicit invocation via a command line flag or enablement through an env variable. This would reduce the attack surface for the vast majority of users and still retain support (albeit not entirely backwards compatible with scripts) for folks that want this.

> Poorly tested obscure format support is a goldmine for hackers looking for exploitable code.

IMO the issue is when these code paths are automatically invoked. This is how you get gstreamer running 6502 opcodes for a codec no one has ever heard of when you download a file from the internet.

awirthon Zsync: Differential file downloading over HTTP using the rsync algorithm (2010)

I'll note that bittorrent uses HTTP for a few different things:

- HTTP(s) based trackers (although UDP is more common these days) - HTTP webseeds/mirrors (BEP-17) - (if you count it) webtorrent uses Websocket trackers and can support HTTP webseeds (although really of course the P2P is WebRTC)

awirthon Building and using a 29-year-old compiler on a modern system

Getting old build tools to work is really awesome. I went through a similar process getting an old version of HPHPc (the PHP-to-c compiler precursor to HHVM) to work[1]. I found Docker to be incredibly invaluable for doing this in a reproducible way, especially when the system state needed to be changed in complex ways or dependencies needed to be tweaked.

A small example is that the test cases only work right if English, German, Finnish and French locales are available and if the system timezone is set to "America/Los_Angeles".

[1]: https://github.com/allanlw/hphpc-docker

awirthon Reserve the 418 status code

For those that may not know, Mark is also co-chair of the HTTP Working Group on the IETF[1].

[1]: https://datatracker.ietf.org/wg/httpbis/charter/

awirthon Here be dragons: the same 3D scene implemented with 10 different 3D APIs

The GBA could definitely do a real 3D engine but it wouldn't look very good at the low resolution anyway. I remember a demo from back in the day of a Quake-like 3D engine on the GBA but it really didn't look good.

For the DS, note that he seems to be targeting the original DS (e.g. not DSi OR 3DS). I remember there being some slightly better stuff but not significantly better than what he made.

awirthon Babel-preset-php: PHP7 to ES7 syntax translator

If you want to use an existing toolchain, you could use HPHPc (the predecessor to HHVM, which transpiled PHP to C code) and emscripten to translate from C to Javascript. It would probably require some mucking around at the emscripten layer though to get all the packages linking properly, because HPHPc has a non-trivial number of (non-optional) runtime deps for supporting all of the various php modules. You should just be able to compile them separately with emscripten into a prefix (e.g. don't use emscripten ports, which I've had a terrible time with) but YMMV.

I dockerized a working version of HPHPc (which is quite difficult to set up due to bitrot) at https://github.com/allanlw/hphpc-docker if you want to play around with the compiler. I might try to take a shot at passing it through emscripten later.

awirthon A Study of 4chan’s Politically Incorrect Forum and Its Effects on the Web [pdf]

If this is a subject that interests you, I'd recommend reading Angela Nagle's Kill All Normies: Online culture wars from 4chan and Tumblr to Trump and the alt-right[1]. It's a really level-headed look at online identity politics. It's an extension of her The Baffler article "The New Man of 4chan"[2], from last year which went into /r9k/, but in her book she analyzes both "sides" (4chan and tumblr, if you will) which I thought was really interesting analysis, even considering I watched it all unfold as it was happening.

[1]: http://www.zero-books.net/books/kill-all-normies [2]: https://thebaffler.com/salvos/new-man-4chan-nagle

awirthon Show HN: 3D Packing for 3D Printing

oh, I was assuming that the time for the rotations was dependent on the size of the models, presumably in number of verts. This memoization would change the runtime.

E.g. if it was linear in that, then you would be going from O(mn) to O(m+n)

awirthon Show HN: 3D Packing for 3D Printing

I read it as though the rotations were expensive, so they were memoized. In this case, it really could be much more than 24 times faster.

awirthon Amazon Drive removing unlimited storage plan

Ooops, missed this thread. I did a little mini-writeup of what happened on a different branch if anyone is curious on the details: https://news.ycombinator.com/item?id=14512598

awirthon Amazon Drive removing unlimited storage plan

As someone completely unfamiliar with this space, this prompted me to do some reading into this rclone issue. I'll record it here for anyone else similarly curious.

It seems that as of a few months ago, two popular (unofficial) command line clients for ACD (Amazon Cloud drive) were acd-cli[1] and rclone[2], both of which are open source. Importantly the ACD API is OAuth based, and these two programs took different approaches to managing their OAuth app credentials. acd-cli's author provided an app on GCE that managed the app credentials and performed the auth. rclone on the other hand embedded the credentials into their source, and did the oauth dance through a local server.

On April 15th someone reported an issue on acd-cli titled "Not my file"[3] in a user alleged that they had received someone else's file from using the tool. The author refered them to amazon support. The issue was updated again on May 13th with another user that had the same problem - this time with better documentation. The user reached out to security@amazon.com to report the issue.

Amazon's security team determined that their system was not at fault, but pointed out a race condition in the source for the acd-cli auth server (sharing the auth state in a global variable between requests...) and disabled the acd-cli app access to protect customers.[4]

In response to this banning, one user suggested that a workaround to get acd-cli working again would be to use the developer option for local oauth dance, and use rclone's credentials (from the public rclone source).[5] This got rclone's credentials banned as well,[6] presumably when the amazon team noticed that they were publicly available.

To top this all off, the ACD team also closed down API registration for new apps around this time (which seems to have already been a strenuous process). I suppose the moral of the story is that OAuth is hard.

[1]: https://github.com/yadayada/acd_cli [2]: https://github.com/ncw/rclone [3]: https://github.com/yadayada/acd_cli/issues/549 [4]: https://github.com/yadayada/acd_cli/pull/562#issuecomment-30... [5]: https://github.com/yadayada/acd_cli/pull/562#issuecomment-30... [6]: https://forum.rclone.org/t/rclone-has-been-banned-from-amazo...

awirthon Amazon Drive removing unlimited storage plan

Source on the 1PB guy for the curious: https://www.reddit.com/r/DataHoarder/comments/5s7q04/i_hit_a...