Hacker News Reader

cypharon The $6.3B Binance hack was pulled off in just 20 minutes

The Bitcoin genesis block literally contains the message:

> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks

I would've thought the implication was kind of obvious? And I'm not sure why you mention Dodd-Frank -- there were many bailouts throughout 2007-2010 and the point of Dodd-Frank was to put an end to that scheme.

cypharon Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

This has been the case for more than a decade, Heartbleed was probably the one which really created the trend.

cypharon eMudhra to exit global SSL/TLS certificate business

Is it not obvious that not every global .com website owner wants to use only have the choice of US-run CAs (which can be subject to National Security Letters)? If you permit some other countries to certify .com then you're back to the same political question of which countries are allowed to run CAs.

It's also not at all a given that website owners would prefer the national CAs -- as an obvious example, most Rust projects (foo.rs) would probably not trust the Serbian CAs as much as they would LetsEncrypt. Even for website owners that live in the country, it seems possible that Chinese website owners might prefer to use non-Chinese CAs. And again, if the solution is to just special-case one American legal entity then we have just moved back to the original VeriSign-signs-everything model.

The real issue is that the CA model has been obviously broken since at least the days of the Comodo hack -- the trust decision for who can certify the website identity is made by the website owner but really clients are the ones that actually care (it's their data at the end of the day) and they have no input. Moxie had a proposal in 2011 to fix this by letting clients decide the policies for how a certificate should be trusted[1] and I think it is a far more workable solution than the alternatives. If one of the LetsEncrypt intermediates was compromised none of the alternative proposals would have any real hope of providing a workable mitigation.

[1]: https://en.wikipedia.org/wiki/Convergence_%28SSL%29

cypharon eMudhra to exit global SSL/TLS certificate business

I think Moxie's "convergence" proposal from ~2011[1] has the most benefits with the least downsides -- in particular I think he really pointed out the crux of the issue: the fact that servers decide who is trustworthy enough to certify their certificates and clients have no input into that decision is a broken model.

This incident was obviously comically bad but the Comodo hack had a more painful impact on the mitigation that should give everyone pause -- their CA had signed a quarter of the internet's certificates so the trust couldn't just be revoked. Imagine one of the LetsEncrypt intermediates got compromised -- our mitigation strategies really cannot cope with that kind of disaster scenario. Browsers would be in the unenviable position where they'd be forced to make huge portions of the internet go dark for potentially months.

[1]: https://en.wikipedia.org/wiki/Convergence_(SSL)

cypharon mitmproxy adds --emudhra option

I wonder if more CPU cycles would be spent in the transporting and other ancillary operations (hashing and signing) than would be spent if they "brute-forced" it. Crazy.

cypharon PHP 8.2.35

This issue with the "official" Docker images is the reason why (when I was still at SUSE) we switched to pushing releases ourselves to our own project and then eventually to our own registry.

This push for centralisation without the infrastructure to back it up has always been the most frustrating aspect of Docker Inc over the past >10 years I've worked on container runtimes.

cypharon Show HN: The Zelda timeline to catch up before the Ocarina of Time remake

There is a 2003 interview with Shigeru Miyamoto that suggests an "enormous" timeline document existed since at least 2002 and they took it into account when writing Wind Waker if not earlier games[1]:

> Shigeru Miyamoto: For every Zelda game we tell a new story, but we actually have an enormous document that explains how the game relates to the others, and bind them together. But to be honest, they are not that important to us. We care more about developing the game system… give the player new challenges for every chapter that is born.

So I don't think this is as clear cut as "a different group of people decades later make a timeline". The least charitable view might be that they never intended the unified timeline thing to became public and didn't consider it "lore", but I'm not sure I buy that either (since they talked about some details in other interviews, including the Victorious/Fallen Hero split most people object to).

[1]: https://www.nintendoforums.com/articles/40/super-play-magazi...

cypharon Show HN: The Zelda timeline to catch up before the Ocarina of Time remake

The timeline was obviously not a planned aspect of the story originally and I personally don't find it particularly great storytelling but there is evidence in interviews of a timeline document existing internally since at least 2002[1] (where Shigeru Miyamoto explicitly said they do take it into consideration when writing the game's story but primarily focus on the games individually).

Maybe they did release the timeline because of fan pressure but some sort of timeline did exist for at least a decade before they released it which doesn't fit your theory they just came up with something and released it in secondary media because of fan pressure.

[1]: https://www.nintendoforums.com/articles/40/super-play-magazi...

cypharon Show HN: The Zelda timeline to catch up before the Ocarina of Time remake

While I agree in spirit and think that was true for most of the games when written, there has been an official timeline published by Nintendo[1,2] since 2011 (and the idea was apparently around internally since 2002).

I would be surprised if it did not have some impact on the writing of the games, though of course there is (as of yet) no explicit reference to the timeline in the games.

[1]: https://zelda.fandom.com/wiki/The_Legend_of_Zelda_timeline [2]: https://zelda.nintendo.com/about/

cypharon Butlerian Jihad

> The Bene Gesserit woman knew it was healthy because of her abilities, and upon investigation it was found that the hospital’s AI had been running a eugenics program.

The irony. Perhaps the Bene Gesserit were just trying to "pace the frontier" of the eugenics market? Who can say?

cypharon I never authorized an integration that scans my secrets

By "batching" I was referring to whether they deduplicate requests -- if they do one HTTP request for every password then you get some extra information about how passwords are shared that you would have to infer otherwise.

If you know someone with N logins has N passwords it's a decent indication they use a password manager and so passwords are unlikely to be weak, if they have 1 password it's probably shared elsewhere and weak.

I also wasn't responding to a question asking about practical exploits, I was responding to a question that claimed the k-anonymity model is "provably anonymous" and "harmless". Since it clearly leaks some information it's definitely not the former and one could argue it's not the later though the "harm" is minimal.

> My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome ...

I fail to see how the privacy nightmare of modern browsers is relevant to a discussion on whether opt-out signalling to third-party services is a reasonable stance for an open source project? By that metric no privacy bug is worth reporting because Chrome continues to exist. If only there was a term for this kind of non-sequitur...

cypharon I never authorized an integration that scans my secrets

Depending on how it's batched, this tells HIBP (and any MITM -- even one that can only see ciphertext) roughly how many unique passwords you use. Knowing the 5-character hash prefix also cuts down brute force attacks by a factor of a million -- though in practice this is only a real issue if you use one of the compromised passwords (there's only a few hundred candidates per prefix), in which case you're kind of screwed already because they're probably in dictionaries anyway.

I don't think these are /critical/ issues and the latter is basically just an argument against the HIBP service, but the point is that a user should opt-in to sharing their data in cases like this so they have a chance to make an informed decision. The k-anonymity design of the HIBP service has a degree of anonymity, it's not "provably anonymous" like homomorphic encryption or similar schemes would be.

cypharon Claude reveals ECDSA curve origins

Almost all of the smaller values of n are not valid curve values, so they were searching "harder" but just for valid seeds. If you look at the generator output in [1], you'll see that:

1. Only a very small number of valid seeds were discarded when compared to the number of n values. It seems we don't yet know why about half of the valid seeds were discarded but the explanation of a buggy curve validity checker doesn't seem implausible to me.

2. Directly to your point, most of the prime192 and prime239 curves required larger n values to find a valid seed and they are both smaller and used an earlier timestamp.

[1]: https://words.filippo.io/seeds-solved/

cypharon Claude reveals ECDSA curve origins

> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.

[1]: https://arxiv.org/abs/2309.03409

cypharon MS Paint Adds Freeform Rotation (2026)

Funnily enough, it was because of this missing feature that primary-school-me figured out that you can emulate rotation using the (somewhat inexplicably present) skew feature. Matt Parker did a video about it a few years ago too[1].

So am I saying this is needless bloat and Micro$oft have lost their ways? Yes! Back in my day we had to do it by hand -- the sheer entitlement (pun intended) to expect a computer to do computations for you. The children yearn for practical uses of trigonometry!

[1]: https://www.youtube.com/watch?v=1LCEiVDHJmc

cypharon Better HTTP/1 connection reuse in Go 1.27

This can happen without HTTP, we hit this issue in runc a decade ago[1] -- some container invocations would mysteriously error out with ECONNRESET and if you added a dummy environment variable they would work again.

Turns out that json.Encoder always appends a newline but (as GP said) json.Decoder will not attempt to read it if the JSON is complete at the power-of-two byte boundary (IIRC the buffer doubles for the first few iterations). The extra byte in the pipe when closed then causes reads and writes to go boom. We switched to using json.Marshal because it doesn't output a newline (sadly the encoded form isn't streamed as a result).

I still get twitchy around encoding/json as a result of that experience.

[1]: https://github.com/docker/docker/issues/14203#issuecomment-1...

cypharon Anthropic's Scion is heavily inspired by Mononoke

Not about the details but the marketing story is all about how "agents" are building so fast they need to design new infrastructure for the new world, etc. Extra points if you spin it as though the "agents" have built some new never-before-seen architecture that is clearly better than the "human scale" stuff.

The intended audience is obvious from first paragraph alone:

> At Anthropic, coding is no longer the bottleneck to building systems or doing research. Claude is able to autonomously iterate on research loops, micro-optimize complex programs, and build new services from the ground up at a speed and scale we haven’t seen before. The bottleneck, now, is all of the developer infrastructure built for human scale: source control, builds, and CI.

Translation:

> We are so far at the cutting edge we need to build shiny new infrastructure to replace the smelly "human scale" cruft. How could you /not/ value us at $2T?

cypharon No portable way to detect string-to-float conversion errors in standard C

I'm not a C++ guy (aside from the odd patch to upstream projects) so maybe I'm missing something but are you talking about structured bindings? AFAICS those were added in C++17, so Rust had them for much longer. Besides, I would argue Python is the real inspiration for C++ here.

In Rust "tuple unpacking" is really just a special case of pattern matching, which is a far more powerful concept and was actually taken from OCaml.

cypharon No portable way to detect string-to-float conversion errors in standard C

> In Go, the only way to consume a multi-return is to use a full assignment statement to assign each return value to a variable, and then use the variables.

There actually is another way, but it isn't really that handy (as it is basically just shorthand for multiple assignment):

    func mustInt(v int, err error) int {
        fmt.Printf("got: (%v, %v)\n", v, err)
        return v
    }
    
    func foobar() (int, error) {
        return -123, nil
    }
    
    func badbeef() (int, error) {
        return nil, fmt.Errorf("moo")
    }
    
    func main() {
        vals := []any{
            mustFn(foobar()),
            mustFn(badbeef()),
        }
        fmt.Printf("got vals: %v\n", vals)
    }

You can use generics but it's still not that useful because you are quite limited in what you can do with the return value:

    func mustFn[T any](v T, err error) T {
        fmt.Printf("got: (%v, %v)\n", v, err)
        return v
    }
    
    func foobar() (int64, error) {
        return -123, nil
    }
    
    func deadbeef() (string, error) {
        return "weird name for a cafe", nil
    }
    
    func badbeef() (*int, error) {
        return nil, fmt.Errorf("moo")
    }
    
    func main() {
        vals := []any{
            mustFn(foobar()),
            mustFn(deadbeef()),
            mustFn(badbeef()),
        }
        fmt.Printf("got vals: %v\n", vals)
    }

You could define your own Result[T any] and do sum types (and people do) but the ergnomics for it are completely awful and readability goes out the window. (Insert grumbling about bolt-on features.)

cypharon I think I found a planet nobody knew existed. I used Claude Code to find it

The short answer is that there are a lot of stars and even more data.

When I last did astrophysics research half a decade ago (as an undergrad) the workflow for doing research boiled down to writing pipelines to clean the data and then have scripts to find interesting candidates and analyse them automatically. It was necessary to filter stuff to reduce false positives, so it's possible this candidate was just missed by such scripts.

It's also possible this star is in some PhD student's dataset and they just haven't published yet. Astrophysics papers in this vein usually focus on techniques for classification and data science so you'd expect to have at least dozens if not hundreds to thousands of interesting stellar objects before you have something worth publishing unless it was some truly novel technique. A paper just saying "we found an exoplanet" isn't particularly interesting these days, as it turns out there are a lot of them.

(I haven't looked at the data and I'm sure my skills have atrophied by now anyway, sadly.)

More power to the guy who did this (astrophysics is probably the most hobbyist-friendly science since a lot of the data is public and the only lab equipment you need is a laptop) but I suspect "ordinary" folks are far more impressed by this than astrophysics folks. A decade or two ago exoplanets were still thought to be very rare but we've since figured out they are quite common and have moved on to cataloguing them.

cypharon Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?

There is some evidence that Tor has posed significant problems for three-letter-agencies in the past, so it's not like there is nothing to be done at all.

But there is a bigger point to be made: in my experience most privacy activists argue that taking an absolutist stance personally is counter-productive -- just because it is almost impossible to completely eliminate risks from your life does not mean you should give up and not try to minimise them. And of course, the goal for most people isn't to protect against targeted attacks (since that means you already need to take fugitive-on-the-run-level precautions), it's to avoid becoming a target in the first place.

cypharon Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?

"We kill people based on metadata." - NSA Chief Gen. Michael Hayden, 2014[1]

In case you were not aware, spooks have focused on metadata analysis over "full take" (data) analysis for a very long time because they are far more effective and require less data to analyse. This has been the case at least since the early 2000s with Stellar Wind but arguably even the Stasi worked this way -- they cared a lot more about who you were talking to than what you were talking about. The Snowden revelations in 2013 talked almost entirely about metadata-only systems that were being used to invasively surveil the world.

If your point was more "I have nothing to hide" then you can find plenty of articles online to disabuse you of that notion. There's even a Wikipedia article about it[2].

[1]: https://abcnews.com/blogs/headlines/2014/05/ex-nsa-chief-we-... [2]: https://en.wikipedia.org/wiki/Nothing_to_hide_argument

cypharon Cloudflare K2: serverless event streams

I worked on OCI for quite a while, the very short and cynical answer is that Docker thought the registry was their moat for a long time and fought tooth and nail to keep it at the detriment of almost everything else. (The longer version is a bit more diplomatic.)

Even better, the OCI distribution protocol (which was Docker distribution until a few years ago) is not a static-blob-over-HTTP protocol! The blob bits are and you can route them to blob storage but you need a smart server for a few key bits of the protocol.

Back in the day I made proposals for distribution formats that didn't have these flaws and were more distributed (and previous proposals like AppC's discovery had similar ideas) but they were roundly rejected by the Docker people.

cypharon From Thin Air to Bootable Images: The Tine Build System

Disclaimer: I work at Amutable but not on tine (though we did discuss this internally a fair bit, as you might expect).

Nix does have a similar model in some respects (in particular the idea of input-hashed build graphs) and so solves a lot of similar problems but there were a few important factors that made us not go with Nix (or NixOS) and instead go with Buck2.

As the blog post mentions, the ability to build directly from a wide variety of upstream distribution artefacts and maintain temporary deltas was incredibly important to us. Our team has a lot of old-school packaging experience (I've done packaging for (open)SUSE for over a decade now and we have former and current Fedora, RHEL, Ubuntu, and Debian packaging folks with even longer histories) and our view is that distributions do a lot of thankless and incredibly valuable work and the most painful part of maintaining a distribution is the deltas you have to maintain forever after you've hard-forked packages or repackaged them. Buck2 allows us to create models for these concepts (which are in tine) without needing to boil the ocean repackaging upstream packages. But Daan and Martin are far better equipped to get into the weeds on this topic.

On the more general topic of why not use NixOS, as discussed in one of our other recent blog posts[1] we are make heavy use of sysexts and the /nix/store combined with the general linking model of NixOS (while very technically impressive) does not play particularly well with that model. I should also mention that we have a NixOS guy on our team too so you'd better believe NixOS came up in conversation. :D

[1]: https://amutable.com/blog/it-starts-upstream-kernel#image-ba...

cypharon Platform-independent SIMD in Go

> Those a usually wrapped in a mutex, or used with sync primitives like sync.Map.

The same can be said of C or C++ constructs (and many "anti-Rust" people have historically said that) -- the point is that their use is not enforced by the language and so bugs can lead to panics.

I write a fair amount of Go and Rust so I really don't think either language's flaws are fatal, but it comes off as weirdly defensive to redefine memory and data safety to be "well if you use it properly it's safe". It's totally fine to say this is a problem the Go language did not find important enough to require compile time enforcement and so solving it is done by convention and testing with the race detector (which a similar answer C and C++ give to this problem).

cypharon WordPress: Unauthenticated path traversal leading to conditional RCE

This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1].

Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so it's little surprise bugs like these just keep popping up every few weeks.

To eliminate these from your codebase you need to rethink and really focus on being aware of how you deal with files. If the program you're writing has root privileges then you need to be more careful about misdirected writes to /proc or other pseudofilesystems.

[1]: https://github.com/cyphar/libpathrs

cypharon UTF-8000: Unlimited UTF-8

Even better, it's arguably both -- surrogate characters are valid codepoint values so technically UTF-16 is fixed-width but programs need to have special handling for surrogate pairs meaning it is practically variable-width.

Truly the worst of all worlds.

cypharon Show HN: An e-ink frame that hears birds and draws them as 1800s illustrations

I think there is ample evidence that the Wright brothers were (unlike many other inventors) uniquely suited to solving the problem of heavier-than-air flight, as they solved several open problems that nobody was making progress on (the main ones being control authority, propeller designs, the scientific basis for wing designs, and the ability to test designs and practice without dying) -- they even discovered and solved previously-unknown problems (such as adverse yaw, something their contemporaries should've independently discovered if they were on the right track).

A full rundown would be too long but [1] is a pretty good video going through the history of flight and how most of the other candidates for "first flyers" people bring up don't count and how it's difficult to argue that any of their contemporaries were even close to the Wrights.

[1]: https://www.youtube.com/watch?v=EkpQAGQiv4Q

cypharon The EPA is planning to scrap public review rules for data center pollution

If the need is driven by a bubble economy, when the bubble pops the demand disappears too. This can even lead to a separate bubble popping (see: the dotcom and telecom bubbles).

Yes, datacentres can be reused for other purposes but dark fibre didn't save the telecom bubble and the utility of train tracks didn't save the railway bubble.

cypharon Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare

If your site is static you can host it on CF pages for free with unlimited* egress.

* of course it's not unlimited unlimited but I've not heard of anyone being cut off.