Hacker News Reader

Would be interesting to combine this with a web-of-trust.

None of my one-hop trusted people are part of the cancelmob. If I found that somebody two hops away from me did something absurd it's quite easy to do something about it -- apply negative trust to whatever path endorsed that nonsense.

Unfortunately people these days seem allergic to running anything that isn't a web browser or served by an app store, and the entities that control those two channels are extremely unexcited about decentralization.

crotchfireon Smart devices are turning out to be a poor investment

https://ryf.fsf.org/

crotchfireon Is social media behind an epidemic of teenage mental illness?

... and how they steer the discussion from "social media" to "screen time".

Wikipedia helpfully selected a picture of somebody using an ebook reader as their illustration of what "screen time" means: https://en.wikipedia.org/wiki/Screen_time

I'm just flabbergasted with the level of smokescreen that goes on in this discussion. Pretty sure reading books on ebook readers is not what is driving teenage mental health problems.

crotchfireon XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

It's okay, the Cargo Lords promise me that because they require a git-hub account and agreeing to the git-hub terms of service before contributing, everything will be okay.

They pinky-swear.

crotchfireon Radicle: Peer-to-Peer Collaboration with Git

Unfortunately github appears to be actively breaking the ability to use git-bug on repositories with large numbers of pull requests (like nixpkgs):

https://github.com/MichaelMure/git-bug/issues/749#issuecomme...

They really don't want you to leave their walled garden.

crotchfireon Radicle: Peer-to-Peer Collaboration with Git

where a repo is forked but the new maintainers don't change the repo's did

A DID is a public key. If you don't know the corresponding private key you won't be able to make any updates. All you'll be able to do is mirror it.

instead just get more nodes to follow them than the original

This is like saying "but I can fork Verisign's Root CA certificate and get more nodes to follow me than Verisign!". No, you don't have the private key that goes with that root certificate. So everybody will ignore you.

Cryptography is not a popularity contest.

crotchfireon Can We Get Kids Off Smartphones?

You're an LLM, right?

crotchfireon Can We Get Kids Off Smartphones?

Oh please with the karma-farming.

Suburbs, for better or for worse, have been around for a long time. They cannot explain the massive decline in Generation Z's mental health compared to its predecessors.

PS, next time try to link to housing costs -- that one gets better karma yield. Bonus points if you can somehow denigrate cryptocurrencies while you're at it.

crotchfireon Two hundred reasons to not use Azure

To use the Mastodon web application, please enable JavaScript. Alternatively, try one of the native apps for Mastodon for your platform.

crotchfireon What do you do if a hacker takes control of your ship? (2023)

Mister The Plague.

crotchfireon What Boeing did to all the guys who remember how to build a plane

The "one-knob, self-adjusting" way to implement this is a revenue-neutral size tax: https://news.ycombinator.com/item?id=39235533

crotchfireon What Boeing did to all the guys who remember how to build a plane

> AI eating jobs, there's zero mention of whether it could come for management positions. Nothing. Curious, isn't it? Why wouldn't an LLM be good enough at this?

There's a whole book about this, called Rainbows End. Highly recommended.

crotchfireon For young people, the job search has never been so miserable

> How does this end?

War, unfortunately.

crotchfireon A simple, (as-of-yet unidentified) asymmetric Authenticated Key Exchange

You have misunderstood the notation; Noise NK is 2 messages, one round trip.

Exchanges above the dotted line are one-time key distributions; see this link: https://archive.li/bU5Me#selection-3667.0-3671.36

crotchfireon A simple, (as-of-yet unidentified) asymmetric Authenticated Key Exchange

Protecting against "swapped devices" is simple: put a secret key in the device, ask it to produce a signature, check it with the public key. Any device other than yours won't know the secret key.

I'm not sure what attacks you refer to when you say "malicious program-binaries". I'm having trouble imagining something fitting this description which is thwarted by the vendor blowing the programming fuse but isn't thwarted by you blowing the fuse yourself.

crotchfireon Florida's DeSantis signs law restricting social media for people under 16

> 10c per HN post

Apparently some people haven't heard about Stacker News (okay it's more like $0.0001 per post, but anyways...)

crotchfireon A simple, (as-of-yet unidentified) asymmetric Authenticated Key Exchange

Why not buy a TKey Unlocked instead? https://tillitis.se/products/tkey-unlocked/

Then you not only have access to the device secret, you can even choose it yourself.

crotchfireon A simple, (as-of-yet unidentified) asymmetric Authenticated Key Exchange

https://news.ycombinator.com/item?id=39835927

crotchfireon A simple, (as-of-yet unidentified) asymmetric Authenticated Key Exchange

This is Noise NK, possibly with differences in the hashing details which I did not check:

https://noiseprotocol.org/noise.html#interactive-handshake-p...

I encourage you to use their hashing details. They're battle-tested.

Wireguard uses Noise IK, which is NK plus a static public key for the initiator which is encrypted to the agreed-upon-session-key without adding additional round trips. Your protocol and Noise NK omit the parts related to the initiator's static public key, because it has none.

crotchfireon Why is the LinkedIn app almost half a gig?

Telemetry.

crotchfireon ZenHammer: Rowhammer attacks on AMD Zen-based platforms

Sure: you replace the hardware with brand new hardware and it keeps happening. Then you know it's not the hardware.

crotchfireon ZenHammer: Rowhammer attacks on AMD Zen-based platforms

Can you point to any botnets which were built using rowhammer attacks?

Rowhammer and speculative execution attacks are incredibly labor-intensive and target-specific. They are targeted attacks for high-value targets.

crotchfireon ZenHammer: Rowhammer attacks on AMD Zen-based platforms

It will detect (by crashing) enough to make exploitation impractical. That is the key point.

crotchfireon ZenHammer: Rowhammer attacks on AMD Zen-based platforms

What about DIMMs with Error Correction Codes (ECC)? Previous work on DDR3 showed that ECC cannot provide protection against Rowhammer.

This is incredibly misleading. The paper they cite states:

When the ECC detection is used correctly 0.65%-7.42% of all bit flips still cause silent corruptions... On setup AMD-1, uncorrectable errors crash the system.

The attacker will need to cause dozens of machine halts in order to achieve even a single exploitable bitflip. Dozens of machine halts is not something that goes undetected.

Kudos for calling out JEDEC's terrible behavior on the rowhammer question, but we should not be downplaying ECC as a near-term solution.

crotchfireon Revert "video: Prefer Wayland over X11 (take 2)"

Users are not your guniea pigs, either.

To convince people to use something, what you're proposing needs to be less-broken than what they already have. The whole "let's burn down their house because they don't want to move to the new one we built" attitude is a disgrace.

I use Sway (a Wayland compositor), but I'm embarrassed to admit that when I see the WaylandBrigade pulling crap like this.

crotchfireon Revert "video: Prefer Wayland over X11 (take 2)"

Correct. It's explained here:

https://github.com/libsdl-org/SDL/pull/9345#issuecomment-201...

XWayland has special hooks into the compositors that normal wayland clients don't get.

crotchfireon Revert "video: Prefer Wayland over X11 (take 2)"

Best comment: https://github.com/libsdl-org/SDL/pull/9345#issuecomment-201...

> SDL is not your tool for "signaling to stakeholders" about what is important.

But but but I need engagement for my team!

crotchfireon Google ordered to identify who watched certain YouTube videos

You can't avoid it during account creation.

So they still have the number.