HNHacker News
TopNewBestAskShowJobs

chha

3,619 karma · joined May 13, 2016

hnchat:fuRLJ39FkDGVfU466wvI
submissionscomments
chha··on Ask HN: How much gas we could save in EU if we reduce our heating temp by 3°?
Not true. Norway currently supplies around 25% of the EUs gas supply, with quite a lot going through a terminal in Germany.
chha··on France to Build Six New Nuclear Reactors
Nice! It turns out we have a few (12) pumping stations here as well, but there is little information on how often they've been used. The high electricity prices we've seen lately have reactualized this, with spikes of around $1 USD/kWh.

Current water levels are at approx 47% capacity [1], compared to around 64% same time last year. Unless we get a wet spring and summer it could get exciting come next year...

[1] - https://www.nve.no/energi/analyser-og-statistikk/magasinstat...

chha··on France to Build Six New Nuclear Reactors
That depends on how you want to store the energy. There have been some talk in Norway about using excess energy to pump water from ground level to fill up existing lakes as a form of energy storage. There seems to be quite a few power plants based on hydro power other places in Europe as well, so it could be a feasible strategy there as well [1, page 5]

[1] - https://wwfeu.awsassets.panda.org/downloads/hydropower_press...

chha··on How to set up a router's port forwarding for a nintendo switch console
"Within the port range, enter the starting port and the ending port to forward. For the Nintendo Switch console, this is ports 1 through 65535."

How on earth can someone seriously have this as a requirement?

chha··on Understanding Lego Part Numbers
I work quite a bit with numbering/naming systems for the oil & gas industry where I live; generally speaking there isn't a single system when things live for so long, but rather multiple systems, with each trying to fix issues with the previous one.

This is especially valid if you try to add any kind of logic or embed information in the naming conventions, as you'll quickly find out that the number series you allocated five years ago has proven to be too small.

And you can forget about scrapping everything and just creating a new system from scratch; all the documentation and drawings already point to the existing numbers, so the new system can't use an existing number but you have to map whatever you have to the new system... not unlike this[0] xkcd. And this is assuming that you've got loads of money to spend, and nobody cares how you spend it.

[0] https://xkcd.com/927/

chha··on Are 14 people really looking at that product? (2020)
Same, but if combined with limited stock it can make sense.
chha··on Security issue related to the NPM registry
It's likely to be a combination of several things. Npm is trendy and has a low threshold for getting started, plus the fact that adding eg. bitcoin miners to a website is a nice way to decentralize and ramp up mining capacity.

Maven on the other hand define several requirements, such as all files in a package being signed, more metadata and they also provide free tools the developers can use to improve the quality of a package.

chha··on Security issue related to the NPM registry
It depends on how you look at it. If I'm running Debian, I have decided to trust their sources and their process, regardless of how their software is being delivered. That process and the implementation of it is the basis for my trust. If I'm really paranoid, I can even attempt to reproduce the builds to verify that nothing has changed between the source and the binary blob.[1]

For npm, trust isn't really a concept. The repository is just a channel used to publish packages, they don't accept any responsibility for anything published, which is fair considering they allow anyone to publish for free. There are no mechanisms in npm that can help you verify the origin of a package and point to a publicly available source code repository or that ensures that the account owner was actually the person who published the package.

Security and trust is very hard, but my point here is that npm does nothing to facilitate either, making it very difficult for the average developer to be aware of any issues. The one tool you get with npm is...not really working the way it was supposed to.[2]

1 - https://reproducible-builds.org/ 2 - https://news.ycombinator.com/item?id=27761334

chha··on Security issue related to the NPM registry
Linus doesn't have root access to our systems for several reasons. One of them is the fact that we get the actual source code, and not just a compiled blob doing "something". Another is the fact that they have at least some level of reviews wrt who can commit code, although this isn't perfect as the case with the University of Minnesota proved.

Npm on the other hand is much, much worse. Anyone can publish anything they want, and they can point to any random source code repository claiming that this is the source. If we look at how often vulnerable packages are discovered in eg. npm, I'd argue that the current level of trust and quality aren't sustainable, partly due to the potentially huge number of direct and transitive dependencies a project may have.

Unless you start to review the actual component you have no way to verify this, and unlike the Linux kernel there is no promise that anyone has ever reviewed the package you download. You can of course add free tools such as the OWASP Dependency Check, but these will typically lag a bit behind as they rely on published vulnerabilities. Other tools such as the Sonatype Nexus platform is more proactive, but can be expensive.

chha··on Ask HN: How do you security-audit external software using NPM packages?
Yeah, currently in the process of evaluating Lifecycle, Firewall and Repository. Impression so far is great, and coming from an org where everything is blocked by default having these tools in place is night/day for us...
chha··on Netflix's new player breaks the ability to modify the seeking of a playing video
Yeah, there were several manufacturers who produced soundcards that basically offered two channels of sound, but where elements creating sound on-screen could be positioned as in a 3-dimensional world. I had a Packard Bell with an A3D[1] card, and I remember being fascinated by the demos they supplied.

[1] - https://en.m.wikipedia.org/wiki/Aureal_Semiconductor#A3D

chha··on Netflix's new player breaks the ability to modify the seeking of a playing video
Not sure if this is valid in all cases; avid user of Netflix and F1 fan here. I only use Firefox on Linux to watch them
chha··on OWASP Top 10 2021
Just to give some more context; this is a list that has been updated every 2-4 years since around 2004 or so. A lot of orgs treat it as the minimum a developer needs to know in terms of security, so it's time well spent looking through it (IMO)
chha··on OWASP Top 10 2021
Fixed.
chha··on Antigravity.py (2020)
Related: https://xkcd.com/353/
chha··on Apps Getting Worse
Not so sure. I accidentally forgot to unsubscribe from the Prime emails way back, so once a week I get an email recommending shows I've already seen. Such as TGT, South Park, the individual presenters from TGT and so on. Oh, and they're also kind enough to remind me about their app...which is the one I'm already using to see their shows...

I'm leaning more towards laziness and lack of creativity.

chha··on Three programmers got fired, including me, due to a single app crash
Problem was, there was no real checklist. They were part of a huge number of people who have created the checklists, partly as a result of lessons learned after making mistakes resulting in death and destruction.
chha··on “One Day Longer and Those 13 Boys Would Be Dead”
There is a couple of other stories that comes to mind, unfortunately both of them were about recovering the dead.

"Raising the Dead" is about the accidental discovery of a diver in SA, and the recovery efforts there. [1]

"The cave divers who went back for their friends" is about a trio of finns who went back into a Norwegian underwater cave system to recover two friends who got stuck and died there. [2]

[1] - https://www.outsideonline.com/outdoor-adventure/water-activi...

[2] - https://www.bbc.com/news/magazine-36097300

chha··on “Plug and socket”, industry group pushes for "obvious" change in terminology
And this will cause issues when you have cable-into-cable. Then you'll have a plug into a plug, with no apparent difference.
chha··on Leaving Google
Not sure where he's been, but as far as I can tell from Google, they're not that uncommon, at least in Norway. Own experience is also that most people seem to have a separate freezer in addition to a fridge, so there's not always a need for a combination of the two.

Most of the things he mention doesn't really hold truth, at least not where I live. Go outside the cities, and you'll find plenty large houses. As for AC and pools...parts of Europe doesn't really need the first, and the second is also kind of luxurious, at least to me. I've got a 5 minute walk to a fresh water beach when the temperature is high enough, and when it's not I really don't want to be in the water outside at all...

chha··on Secret Recordings Reveal How Exxon Lobbyists Manipulate Politicians and Public
Reminds me about the Thursday Next series by Jasper Fforde. One of the subplots in book four is about the company "Goliath" and their attempts to be recognized as a religious organization. T
chha··on NATO Classified Cloud Platform Compromised
I know, and they also failed on the primary goal of the project.
chha··on NATO Classified Cloud Platform Compromised
Not sure what you're trying to say with this.

The Apollo program was run by NASA, who had lots of government employees, but at the same time all the hardware and much of the software was built by contractors. The Apollo program was behind schedule and over budget for most of the project period.

NASA originally estimated the cost to somewhere between 7 and 12 billion USD; NASA Administrator increased this to 20 billion USD in 1961, but it ended up costing more than 25 billion USD in 1973 dollars.

chha··on Remove Microsoft Bing from search engines for Search on Internet command
From the merge summary:

"Ref: https://www.reuters.com/technology/microsoft-bing-raises-con...

When a search engin does the censorship instead of its job, the search result loses its quality and it's not reliable anymore. Hence, Microsoft Bing is removed from Notepad++ for "Search on Internet" command."

chha··on Making a Guitar
Came across this a while ago, and it's become something I can put on in the background just to relax a bit while working. No distracting music, no over-the-top narrators, just fantastic craftsmen building guitars.
chha··on Freenode ops take control of 700 channels
As far as I can tell he bought it in 2017 and promised not to change the operating model or interfere with the staff. In 2021 he started doing just that.
chha··on Mars Ingenuity helicopter mission extended by NASA
Isn't this the exact same everywhere else?

Your boss wants to know how long you'll spend on a job; if you tell him 30 days and spend 30 days you're just good at estimation.

If you do it in 20, you're a star for doing it under budget!

chha··on Michigan asphalt company paves first US public roads containing recycled plastic
They mention this as a way to recycle plastics, but for me this seems like a perfect way to get lots of tiny plastic particles out and into the environment once the road starts to wear.
chha··on Shipping containers are falling overboard at a rapid rate
Thanks for suggesting the book, added it to my list of things to read!
chha··on The Blue Hole in the Red Sea is the deadliest dive site in the world
You might also like this story about a dive in Boesmansgat: Raising the Dead[0]

[0] - https://www.outsideonline.com/1922711/raising-dead

← PreviousPage 3 of 6Next →