Hacker News Reader

convivialdingoon Google loses antitrust suit over search deals on phones

Finally? Google has basically turned search and news into a political-corporate mouthpiece. Android is essentially a vacuum for surveillance capitalism. I rarely even use google to find anything beyond Chinese food and such.

If we could go back to Google 2010 that would be fantastic.

convivialdingoon Ask HN: Weirdest Computer Architecture?

Incredibly odd system which had no assembler. Almost a pure stack machine, some models had a 51 bit word (48 bit and a 3 bit tag). One of the first machines with NUMA & SMP, segmented memory, and virtual memory (but with all the oddness of a first innovator).

I knew some of the engineers at Unisys who were still supporting Clearpath and Libra. Even they thought Burroughs was weird...

convivialdingoon CrowdStrike Update: Windows Bluescreen and Boot Loops

A driver that crashes with bad input is not “fine.” Bad design, bad configuration loading and crap input validation. Did they even fuzz the code?

We’d spend 20x development time on kernel code because BSOD is never an option.

I get that this was a bad release - but IMHO it’s incredible that they pushed this out to a billion devices before the red flags went up.

convivialdingoon CrowdStrike Update: Windows Bluescreen and Boot Loops

Here’s my take as a security software dev for 15 years.

We put too much code in kernel simply because it’s considered more elite than other software. It’s just dumb.

Also - if a driver is causing a crash MSFT should boot from the last known-good driver set so the install can be backed out later. Reboot loops are still the standard failure mode in driver development…

convivialdingoon Writing an MP4 Muxer for Fun and Profit

This is awesome work. I’ve coded some extensions for mp4 livestream to handling dozens of real-time streams and I’d love to try out the multi stream mux / demux…

convivialdingoon The XAES-256-GCM extended-nonce AEAD

This is freaking fantastic- I only wish it existed when I wrote my last encrypted filesystem a few years back.

Nonce collision is a huge concern on large file system deployments. 2^32 seems huge but when you’re writing 100k iops a second on a PB array the chance of collision is almost guaranteed if you’re betting on PRNG randomness.

convivialdingoon X debut 40 years ago (1984)

My story about X windows...

I was invited to the Atlanta Linux Symposium in the late 90s and met just about everyone around the Linux/Slashdot/X11 world. I had been hacking on OpenGL drivers and one of the first to "integrate" 3dfx 2d acceleration into X.

I had a wonky alpha AXP desktop I'd built from random parts and porting X11 to 64 bits on Linux as the code & binary was actually still 32bit. I'm chatting with rasterman for a bit and up walks an older gentleman.

He'd been listening in on our conversation and was eager to get my take on X. I told him straight-up I thought it was kinda crappy and it should have used blah blah bah. He said "I'm Jim Gettys and I co-wrote X windows.." I was aghast...Oh shit. He laughed and we had a long conversation about how X was implemented.

convivialdingoon An Analysis of Chinese LLM Censorship and Bias with Qwen 2 Instruct

Really interesting how China changes the output to these questions in different languages.

Shouldn’t model developers disclose their alignment training questions and censorship triggers?

I don’t disagree that there needs to be guardrails on dangerous information to a certain extent.

Companies producing these models often go beyond general safety and regurgitate political points as if they were the same as how-do I-make-nitroglycerin questions.

Hot political topics are most-often bucketed into a single ideology.

Disclosure would go a long way towards understanding the motivations and goals of these models.

convivialdingoon The One Billion Row Challenge in CUDA

You could hash the city names using something like a djb2a algorithm?

convivialdingoon Ask HN: What is the most useless project you have worked on?

A few years back, I worked at a startup that got a contract with a major software company.

Our job was to implement a crypto storage system for an OSS database where each user only had access to data based on their own authentication keys. Only minimal changes to the DB allowed, so we made our own PAM module to handle the authentication and key management.

We implemented a POSIX layer that intercepted file ops and backing-stored and encrypted the blocks into S3 containers. Files/blocks that got purged would automatically pull from S3.

One month into the project the major software company decided they didn’t want it. But we still had the contract and had to fulfill it for six more months.

So yeah, six months of code in the trash. But I learned a lot of S3, AWS and wrote a toy compiler with the spare time. Since nobody cared I was able to try a lot of new solutions, test out different languages and tools. Basically experimented with everything out there.

Delivered my code on the day of the deadline. Tested, worked, archived.

convivialdingoon WindCon2024: A Joke Too Far for Many

I thought it was hilarious. Perhaps I’ve suffered through one too-many corporate culture synergistic vision realignments…

convivialdingoon Bug in reader/writer locks in Windows API

I did some work with testing a cross platform in-house library for read-write locking.

We tested cmpxchg16b and found the performance was terrible with more than 4 cores.

Ended up using spin-locks similar to Linux kernel RCU.

convivialdingoon Airfoil

If you watch it very slowly, the paper initially folds under the mouth and then it blows out straight.

I'm guessing the initial puff creates a high pressure area on top of the paper, rolling it downward and back. Them after the puff has pushed the air away, there is now a low pressure zone on top of the paper which lifts it up as the air below is rushing upwards around the sides of the paper.

convivialdingoon Neat Parallel Output in Python

Funny enough Glibc has a lock for threaded printing internally. You can disable the lock in glibc with the __fsetlocking function and the FSETLOCKING_BYCALLER parameter.

I had a threaded server that we were debugging which would only dump state correctly if we deleted a printf right before in a different thread. Really confused me until I figured this out.

convivialdingoon Launch HN: Univerbal (YC W23) – Language learning with a conversational AI tutor

Yes, something in recording was reset and it worked again.

I really like the concept - good execution. I picked up the ability to click on a word for translation easily.

convivialdingoon Launch HN: Univerbal (YC W23) – Language learning with a conversational AI tutor

I really like it!

It worked the first time after asking for mic permission.

But second time, I did have a problem with the mic button on iOS 16.6.1 getting stuck on but not taking audio input.

Pushing the button again (to cancel perhaps) did nothing.

Switching to tutor mode fixed it for another input.

convivialdingoon All arabica coffee is genetically similar: how can beans taste so different?

I've often wondered how fermentation effects bean flavor. It was a surprise for me to learn recently that coffee beans were fermented in the first place!

convivialdingoon Using Zig to Unit Test a C Application

It would be nice if something in Zig could auto-magically generate the zig to c interop call and type declarations.

I see there's "translate-c" to help migrate C to Zig, and maybe that's enough.

Generally I fall on the side of if a compiler can toss out a type warning, it could certainly give a reasonable solution also. Best-guess with a "// Warning type was guessed" is better than an opaque "RTFM" in most every case.

convivialdingoon How to easily pay a single employee in another country

At my old company, we engaged with a contractor from France. We went to university together and I knew he was well qualified to do the work we needed in OpenCV.

We researched ways to pay him legally, but for a six month contract it turned out to be much easier to simply pay an agency that pays him and does the paperwork.

Essentially it is presumed that most workers are full-time employees, and it is difficult to maintain a contractor due to tax liability and labor laws.

convivialdingoon Vtracer: Next-Gen Raster-to-Vector Conversion

There's a lot of handwritten texts out there. I spent a few months transcribing my great-great grandmother's journals as a military wife in the late 19the century. It was an enormous task - I'd spend an hour or two a week and got though a few dozen pages.

I used potrace and autotrace to darken the faded text strokes - I should give this a try and see if it can do a better job.

convivialdingoon Frigate: Open-source network video recorder with real-time AI object detection

We use Yolov8 with custom training for people detection - in our situation (hospital) we regularly get 96% accuracy.

I highly recommend - best model we tried out of dozens of public models.

convivialdingoon The astonishing behavior of recursive sequences

Somewhat related, I have found The On-Line Encyclopedia of Integer Sequences[1] to be an amazing resource when I come across interesting numeric sequences.

[1] https://oeis.org/

convivialdingoon Building and programming a 16-bit Intel x86 breadboard computer [video]

This was a well done and engaging series, kudos. I remember creating projects like this - still amazed that you can step a CPU like that one cycle at a time.

convivialdingoon Snowden leak: Cavium networking hardware may contain NSA backdoor

Well, true.. the Hash_DRBG hashing algorithm remains. But it's rather likely that previous FIPS validations occurred utilizing the actual backdoored and deprecated algorithm as an input to the Hash_DRBG, rendering it's security properties suspect.

In NIST SP 800-90A Rev. 1, the HASH_DRBG section has been significantly updated to that effect.

For instance, Appendix E: (Informative) Revisions.

Section 10: Section 10 now includes a link to the DRBG test vectors on the NIST website. Sections 10.1, 10.1.1 and 10.1.2 now include short discussions about selecting hash functions to support the DRBG's intended security strength. The Dual_EC_DRBG has been removed, and section numbers adjusted accordingly.

convivialdingoon Snowden leak: Cavium networking hardware may contain NSA backdoor

Well, there's several Cavium devices that support the deprecated/back-doored Hash_DRBG.

For example, these devices were validated for the completely appropriately named "SonicOS 6.2.5 for TZ, SM and NSA". Gotta appreciate the irony.

Cavium CN7020 Hash DRBG

Cavium CN7130 Hash DRBG

Cavium Octeon Plus CN66XX Family Hash DRBG

Cavium Octeon Plus CN68XX Family Hash DRBG

I don't know if that's hardware support or just a software validation - but it's still interesting that they validated it.

https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Valid...

convivialdingoon Snowden leak: Cavium networking hardware may contain NSA backdoor

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A.

From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publication contains the specification for three allegedly cryptographically secure pseudorandom number generators for use in cryptography: Hash DRBG (based on hash functions), HMAC DRBG (based on HMAC), and CTR DRBG (based on block ciphers in counter mode). Earlier versions included a fourth generator, Dual_EC_DRBG (based on elliptic curve cryptography). Dual_EC_DRBG was later reported to probably contain a kleptographic backdoor inserted by the United States National Security Agency (NSA).

From Cavium's NIST FIPS-140-2, Section 3.3 [1] Approved and Allowed Algorithms:

The cryptographic module supports the following FIPS Approved algorithms.

*SP800-90 CTR DRBG Deterministic random number generation 32

1: https://csrc.nist.gov/csrc/media/projects/cryptographic-modu...

convivialdingoon Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

As a developer and a consumer, what I'd really like to see is:

- Manufacturer voluntary guarantee of 1/3/5 years security updates with an expiration date.

- Separation of functionality and security updates.

- The ability to "turn off" connectivity and retain full local functionality.

- An industry security certification like UL.

- A single point way of identifying and validating devices.

As it is, I avoid using IoT mostly for security reasons. Having worked in security for many years I have seen the best and the worst. Having security isn't a panacea either - it needs an ongoing management & reporting infrastructure.

convivialdingoon Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

It depends... I just worked my part of certifying a product(security) and it was only ~$40k.

Agreed on the current state of the FDA filings - there's a lot of paperwork and process auditing - but guidance is lacking and I'd like to have more clarity rather than just "industry best-practices." That said - things are much better and it seems like the trajectory is improving.

convivialdingoon An unexpected find that freed 20GB of unused index space (2021)

An index is most efficient when it represents a unique set of values. It's still very useful to have an index for grouping, but if the groups represent a severe minority then you will end up wasting a lot of space and cycles searching through the index.

convivialdingoon Tesla repossessed my car due to an extreme oversight on their end

Opposite experience for me. So far my 2016 Tesla has been the best car-owning experience I’ve ever had.

Last week had to fix the instrument clusters, door handle, and a couple of recall issues. My 100k warranty ends in 400 miles - so needed to get it done.

This was my first time in the shop. Got a loaner for 4 days, problems all fixed, no cost. They communicated everything going on.

Really fantastic- I feel like a valued customer. Only thing I’d suggest is they wash and vacuum - but that’s just a nice-to-have really.