HNHacker News
TopNewBestAskShowJobs

devy

10,753 karma · joined March 11, 2011

[ my public key: https://keybase.io/yewang; my proof: https://keybase.io/yewang/sigs/oqeIeIArRK13MRWPHemV_vmPEn1K4qClxSFpwQsTB5U ]

hnchat.com:3XTKnS6ltyuLoPtjZlYF

Opinions and views expressed here are my own.

submissionscomments
devy··on How long does a freezer stay frozen when the power goes out?
Tropical Storm Isaias hit my area last week with tornados (which has been really rare.) and power went out for a few days.

Our local utility company actually has a FAQ / Tips page[1] to answer this question. It appears that the information was sourced from CDC[2] and American Red Cross[3].

[1]: https://nj.pseg.com/outageandgasleaks/duringanoutage/outager...

[2]: https://emergency.cdc.gov/poweroutage/pdf/poweroutage.pdf

[3]: https://www.redcross.org/get-help/how-to-prepare-for-emergen...

devy··on Pysa: An open source tool to detect and prevent security issues in Python code
Hi,

I have 2 questions:

1. The installation doc specified `watchman` as a dependency. Why is that used? without watchman, would pysa not work?

2. Also, why can the pysa become a separate stand alone tool instead of living in the pyre Github repo?

devy··on If you see everything, you'll get nothing
In a lot of ways, this is the same principle of "ignorance is bliss".
devy··on America's Two Coronavirus Realities
I think there is a word for this: duality
devy··on Cloudflare outage on July 17, 2020
This is not the first time human error on BGP routing configuration which then caused a significant portion of the Internet down. Is there any kind of configuration validator that can be implemented to prevent and catch this type of errors? I am fairly sure this won't be the last time we will hear about human error on BGP routing config causing Internet down.

Or is BGP intrinsically a unsafe protocol without builtin protections on this sort of human mistakes?

devy··on Cloudflare was down
Looks like CF is up!
devy··on Tesla worst for reliability in American driver survey
So technically this is a pay-for-play kind of shenanigans?
devy··on 35% of excess deaths from pandemic not caused by Covid-19
According to the article, there are 2 types of excess deaths:

- the virus can also cause death by exacerbating underlying health issues; the body’s immune system is weakened while fighting off the illness.

- the sudden emergence and rapid spread of the disease overwhelmed critical care units when the virus was at its peak, reducing the amount of care any individual patient could receive.

And the argument of "35% excess deaths not caused by COVID-19" is perhaps technically correct due to the reasons above, however, those are indirect deaths that had the root cause of SARS-CoV-2, which is the virus. Notice the difference between COVID-19 and SARS-CoV-2? The former is the disease, the latter is the virus.

As Dr. Mike Hansen said in a few of his autopsy report review videos he made in his YouTube channel[1], there are very few direct cause of death in the death certificate he signed and issued for his ICU patients, most related to blood clots and lack of oxygen but the common indirect cause is the SARS-CoV-2. In other words, if it weren't for the coronavirus infection, these deaths could either be prevented or delayed.

So I think it's more nuanced than simply saying we are attributing 35% the excess deaths to COVID-19 whereas these are indirectly caused by SAR-CoV-2 viral outbreak.

[1]: https://www.youtube.com/watch?v=y6h8TIxeg1g

devy··on Apple Acquires Fleetsmith
If you been in an enterprise RFP process, you will understand "Picking products based on feature checklists" is commonly being done to compare software products because if you don't provide the feature that your competitors provide, you are pretty much out of the competition.
devy··on Apple Acquires Fleetsmith
According to Wikipedia, SimpleMDM doesn't provide "Device Lockdown" and "Expense Management", whereas there are some vendors provide all (all green in a row). [1]

Also as far as I know, SimpleMDM pricing[2] is not the cheapest in the market either, their feature set is similar to Mosyle's, but Mosyle's cheaper.[3]

[1:] https://en.wikipedia.org/wiki/List_of_Mobile_Device_Manageme...

[2]: https://simplemdm.com/pricing/

[3]: https://business.mosyle.com/pricing

devy··on Apple Acquires Fleetsmith
> Fleetsmith has always been one of the only two commercial products I've endorsed for Mac management.

What's the other commercial MDM product you endorsed? There seems to be quite a few dozens of commercial MDM providers out there.[1]

> They do great work and have the right vision.

Can you elaborate?

[1]: https://en.wikipedia.org/wiki/List_of_Mobile_Device_Manageme...

devy··on GoPlus – The Go+ language for data science
The official Github repo of Go+ is hosted on a PaaS company called Qiniu's team repo with their founder & CEO as the top contributor[1][2]. He is a Golang enthusiast[3] and my guess is that this is probably his favorite pet project ;)

[1]: https://github.com/qiniu/goplus/graphs/contributors

[2]: https://github.com/xushiwei

[3]: https://twitter.com/xushiwei

devy··on Time to Upgrade Your Monitor
> The technical details are all right (or seem right to me, anyway), but this is too opinionated for my liking.

The author, Nikita, did exactly mention that point, mid page of the article under the heading of "Get a monitor".

   Let me express an opinion. This is my blog, after all. 
So yeah, opinionated piece, no big deal. And I happens to agree with him.
devy··on Netgear 0-day vulnerability analysis and exploit
> Rust isn't magic.

Let's not going to that debate. It's a good start to improve security postures, regardless how you spin it.

But more importantly, my point is why are they doing CGI at all?

devy··on Netgear 0-day vulnerability analysis and exploit

   In SOHO devices like the R7000, the web server must parse user input 
   from the network and run complex CGI functions that use that input. 
   Furthermore, the web server is written in C and has had very little testing, 
   and thus it is often vulnerable to trivial memory corruption bugs.
I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwares are too weak to run modern version of the linux with reasonable choices to build a custom compiled version of the web server in Rust not C?
devy··on Async Python is not faster
IMO, Async Python frameworks have been proliferated in the era of AI research projects gaining popularity. Some of these AI researchers who know Python already while working on AI frameworks like pytorch would utilize some of these async python frameworks with cookiecutter [1][2][3][3], which helps many others to quickly spin up a backend api for an AI application, in the names of "fast", both in terms of setup and in terms of responding to requests.

[1]: https://github.com/tiangolo/fastapi

[2]: https://github.com/tiangolo/full-stack-fastapi-postgresql

[3]: https://github.com/tiangolo/uvicorn-gunicorn-fastapi-docker

devy··on Ask HN: My boss ask I take my emails while on vacation
For a startup with only 6 people and you are one of the managers/leaders of managing others, there could be exceptions the team needs your decision while you are out on vacation.

This depends on the work culture at your company and in the country you are in as the labor law and norms varies. My own experience has been that it's entirely possible (imaging your 2 direct reports are roadblocked waiting for you to make a decision) and your role is so crucial that your boss depends on your to make an informed decision, your attendance on email responses could be important. Obviously, if it's a short vacation and everything is planned out and prepared for, your response on emails would probably not needed.

Again, I don't think there is a common scene here you can find on HN.

devy··on Bell, Telus to use Nokia and Ericsson, not Huawei, in building their 5G networks
> but I do think there's a strong argument for trying to build and maintaining one's own infrastructure whenever possible, even if it's a bit more expensive.

In the semiconductor/telecom equipment industry with very specialized and globalized supply chain, it's impractical if not impossible. No single country can have their entire electronic infrastructure within their own country borders, not China, not U.S., not even the European Union, certainly not Canada. So yeah, it's not about money.

> because they're big domestic projects and it's nice to have to the talent and knowledge at home.

That's wishful thinking. In the free capitalistic society with free trades, the capital(money) and efficiency drives the supply chain. With a little bit of geo-politics, perhaps it could happen, but even then it takes time and the government have to step in and invest - lots of manufacturing industries are capital heavy but margin thin, don't bet on private companies or corporations would invest against the globalization.

devy··on Study of the effect of Vitamin D, Magnesium and Vitamin B12 on Covid-19 patients
Genuine question: so how do we fix nutrient deficiency for vast majority of people world-wide?

It's probably not a feasible solution to require these people eat healthy nutrient-rich foods due to economical and culture and personal choice reasons. Are vitamin supplements a feasible solution?

devy··on Apple Doubles the Price of RAM Upgrade on Entry-Level 13-Inch MacBook Pro
Those are for iMacs, and cost $719.99
devy··on Apple Doubles the Price of RAM Upgrade on Entry-Level 13-Inch MacBook Pro
Yeah, on those rare spec chips that are not on the retail market, Apple probably have to place custom order to the memory chip manufacturers for a low-yield production, which is definitely causing the unit pricing to be much higher than the mass produced memory chips. Economy of scale. (even if Apple is still a big customer, it's still a small order to make if no other computer makers use that spec of the chips)
devy··on Huawei builds up 2-year reserve of 'most important' US chips
Because ASML uses lots of technologies and IPs originated from the U.S., consequently is subject to export control & entity list restrictions.

Semiconductor industries has been growing into a very tightly coupled and globalized eco-systems these days. No one country can own or domesticate the entire ecosystem or supply chains, albeit companies headquarters in the U.S. still own a significant portion of the technologies and intellectual properties.

devy··on Huawei builds up 2-year reserve of 'most important' US chips
> The Brookings Institution thinks that the US can shut China out of high-end semiconductor production indefinitely. That seems like a pretty foolish conception to me.

U.S. had done that to Japanese Semiconductor industry in the 80s and 90s[1], which was why South Korean semiconductor industries flourished and Samsung became the king of Memory chips (it used to be Toshiba etc.) And today it's Huawei. Who's gonna be the next in the future?

[1]: https://www.nber.org/chapters/c8717.pdf

devy··on A bug in macOS 10.15.5 impacts bootable backups
> Did setting SF_FIRMLINK ever succeed for real?

It should have been working fine right? Otherwise CCC team would have reported this bug in the earlier release. As what Mike Bombich said in the original post:

   The chflags() system call can no longer set the SF_FIRMLINK flag on a folder on an APFS volume. 
The keyword was "no longer".
devy··on Canon Releases Software to Turn Their EOS DSLRs into Webcams for macOS
I just realized that Nikon does the same - albeit not releasing a specific software/firm but rather a guide for 2 options they listed there:

https://www.nikonusa.com/en/learn-and-explore/live-streaming...

devy··on Dutch Scientists Find a Novel Coronavirus Early-Warning Signal
This was dated in March 31, 2020.

For a very rapidly developing global pandemic event, any news that's more than one month old could potentially proven to be false or irrelevant. For example, Hydroxychloroquine, CDC adivce on wearing Masks, ventilators demand, etc.

devy··on An SSL cert that is valid for any and all domains and all levels of subdomains
So this is a self-signed TLS certificate. Perhaps pair the CSR with mkcert[1], it will be even more useful (without seeing the warning messages in browsers.) to be used locally.

[1]: https://github.com/FiloSottile/mkcert

devy··on TSMC Announces Intention to Build and Operate Advanced Semiconductor Fab in U.S.
Employee salaries.
devy··on Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently
Redaction, for one, is a desired feature that don't usually come with free PDF viewers on macOS like Preview.
devy··on Tesla superfandom becomes toxic, negative for electric revolution [op-ed]
I've been reading Electrek for many years, Fred Lambert is definitely a huge fan of Tesla no doubt. When Fred wrote,

   Obviously, it’s ridiculous for Musk to call someone who is a Tesla investor 
   and who wrote thousands of articles about Tesla’s positive impact on the world “anti-Tesla” 
   simply because he didn’t like a few of my articles during a time when the company was making 
   some very questionable moves. Musk even ended up reversing some of those moves later that year.
It is painful to read that, as I am sure Elon surely knew how that felt, as spoke at CBS 60 minutes about when Elon's own heroes dismissed him.[1]

One should always tolerate different opinions, as Ian Bremmer put it.[2]

[1]: https://www.youtube.com/watch?v=CyGqMZQAMio

[2]: https://twitter.com/ianbremmer/status/801590659291480068

← PreviousPage 8 of 34Next →