HNHacker News
TopNewBestAskShowJobs

drum55

517 karma · joined August 31, 2025

submissionscomments
drum55··on 1-Wire
They’re used for proofs sometimes, if you expect your security company to do a specific route they need to go to each token on it and touch them, you see iButtons glued to walls outside commercial buildings for that purpose. Systems like that mean they can’t just say they walked the route and go home, I’ve seen them at airport bathrooms for the same reason.
drum55··on We stopped AI bot spam in our GitHub repo using Git's –author flag
Proof of work doesn’t work here same as it doesn’t work for email. The effort to mint a valid PoW is always going to put the legitimate user at a disadvantage, whatever the implementation is. Someone with an incentive to spam will always be able to do it faster, more efficiently than you.

You can’t submit a PR because your laptop is too slow? Rent some hash rate from someone, and now you’ve just made a system of paying botnet owners to be able to make a typo fix on a github repo. HashCash was never used in the real world for a reason, it sounds cute but the incentives are so insane as to only work in a vacuum where you assume everyone isn’t cheating.

drum55··on Sense Humans with WiFi – Ruview
The authors profile is also just ridiculous, hundreds of commits a day and their entire profile is also just AI generated lists of AI generated projects each one filled with pompous sounding AI documentation with implausible goals that have rock solid battle tested solutions. I'd be surprised if there was even a real person behind any of this, if there is they certainly have never read any of "their" own code.

Time crystal detection? 100% Accuracy? Give me a break.

drum55··on Sense Humans with WiFi – Ruview
The whole website is AI slop, from the text down to the design.

If it's an actual product who knows, sort of hard to care when the website came from a Claude prompt.

drum55··on Ploopy Bean: a trackpoint for every computer
3D printed spring, magnet, hall effect sensor by the looks of it.
drum55··on WinCE64 – Windows CE 2.11 for N64
That video is very annoying and doesn't in any way replace just having a screenshot of it running.
drum55··on Restore full BambuNetwork support for Bambu Lab printers
Yeah I’ve had one, still do, it never gets used because it’s a project car. Compared with one button press and coming back to a print in a few hours, it’s a constant nightmare of debugging, print issues, and manually changing filaments that aren’t stored in an airtight container and get wet. It’s not even competition, as much as I would like to support open source tools the Prusa stuff is an order of magnitude more expensive than a A1 Mini that will make a reliable print every time.

It’s like saying a bicycle is a serious contender to a train, they both have kind of similar things going on but you’d have to be insane to suggest that they do as good of a job as one another at the things people actually want to achieve.

drum55··on Restore full BambuNetwork support for Bambu Lab printers
I’ve been running mine offline for years, I don’t know why other people haven’t been. They’re the only competent and reliable printer that isn’t a project car in itself, but they’re obviously not completely trustworthy. Easily fixed with an air gap, updates work just great from a USB drive.
drum55··on Put your SSH keys in your TPM chip
Seems a little pointless, your keys can't be stolen but they can be instantly used by malware to persist across anything you have access to. The keys don't have any value in their own right, the access they provide does.
drum55··on BlueHammer abuses Windows Defender's update process to gain SYSTEM access
More or less, no desktop OS other than Qubes and MacOS (to a very limited extent) can handle the user being even vaguely compromised, much less a user with privilege. Keys to the kingdom are already in the user domain, SSH keys, all your emails and photos, contacts, access to other devices in your network. The user can backdoor themselves to get passwords by modifying their own environment, can escalate by modifying the DNS settings of the users browser to gain more access. Root access by and large is completely irrelevant.
drum55··on Phone-free bars and restaurants on the rise across the U.S.
Intentionally interfering with 911 would probably be a poor decision.
drum55··on Axios compromised on NPM – Malicious versions drop remote access trojan
The ones you hear about are caught quickly, I’m more worried about the non obvious ones. So far none of these have been as simple as changing a true to a false and bypassing all auth for all products or something, and would that be caught by an automated scanner?
drum55··on The bot situation on the internet is worse than you could imagine
The language matters, but your original guess was actually correct, you can do tricks with sha256 where you only end up calculating a fraction of the total double hash in order to get a pass or fail.

Modern bitcoin miners do a double sha256 hash and increment in just a little bit more than a single hash of work. The input is 80 bytes, which is two compression rounds of 64 bytes in sha256, only the data in the second round has changed (the appended nonce), so you don’t bother doing the first compression round again. With other quirks you can end up doing multiple hashes at once “asicboost” due to partial collisions within the input too.

drum55··on The bot situation on the internet is worse than you could imagine
Yes, Anubis is just non standard and obscure, the proof of work bit is completely irrelevant (except for getting people on their phone to not visit your website).
drum55··on The bot situation on the internet is worse than you could imagine
Anybody can prompt Claude to implement this, which was my point, it doesn't stop bots because a bot can literally write the bypass! My prompt was the proof of work function from the repository, asked it to make an implementation in C that could solve it faster, and that was about it.
drum55··on The bot situation on the internet is worse than you could imagine
It doesn't matter if your hottest loop is using string comparisons, as another poster pointed out in C you aren't even doing the majority of the second hash because you know the result (or enough of it) before finishing it. The JavaScript version just does whole hashes and turns them into a Uint8Array, then iterates through it.
drum55··on The bot situation on the internet is worse than you could imagine
Bravo, you even implemented the midstate speedup from Bitcoin, that's way more impressive.
drum55··on The bot situation on the internet is worse than you could imagine
Ironically I used a LLM to write a bypass for this ridiculous tool, doing hashing in a browser makes no sense, Claude's very bad implementation of it in C does tens of megahash a second and passes all of the challenges nearly instantly. It took about 5 minutes for Claude to write that, and it's not even a particularly fast implementation, but it beats the pants off doing string comparisons for every loop in JavaScript which is what the Anubis tool does.

    for (; ;) {
        const hashBuffer = await calculateSHA256(data + nonce);
        const hashArray = new Uint8Array(hashBuffer);

        let isValid = true;
        for (let i = 0; i < requiredZeroBytes; i++) {
          if (hashArray[i] !== 0) {
            isValid = false;
            break;
          }
        }
It's less proof of work and just annoying to users, and feel good to whoever added it to their site, I can't wait for it to go away. As a bonus, it's based on a misunderstanding of hashcash, because it is only testing zero bytes comparison with a floating point target (as in Bitcoin for example), the difficulty isn't granular enough to make sense, only a couple of the lower ones are reasonably solvable in JavaScript and the gaps between "wait for 90 minutes" and "instantly solved" are 2 values apart.
drum55··on ICAO issued new power bank restriction on flight
That's a bit surprising to me, wonder what the root cause of that was. It seems to be shared across multiple products at once so maybe they had a bad batch of cells?
drum55··on ICAO issued new power bank restriction on flight
I've never had any issues with brand name, not dollar store power banks and I've been using them for more than a decade. I'd totally expect a $5 pink power bank from a alphabet amazon seller to be an issue, but anything modern and reasonable like Anker are very unlikely to cause you any issues. Balancing, protection are very much solved issues at this point for the cell chemistries we use.

If LiPo was the issue, using LiFePo4 or LTO cells for planes would be a totally reasonable alternative too. LTO cells are so safe the manufacturer of them has videos on youtube of them hammering nails into the cells, cutting them with a saw, and crushing them with a press and they don't really care.

drum55··on ICAO issued new power bank restriction on flight
That's a kind of meaningless comparison. Peanuts are about 8kJ per gram supposedly, by your measure we should ban even small amounts of peanuts on planes because 100 grams of them contain more energy than a hand grenade. Without talking about the time frame over which the energy can be released you'd have to make sure that everybody went onto the plane completely naked lest their clothes ignited.
drum55··on ICAO issued new power bank restriction on flight
There are fire extinguishers and smoke detectors in the holds of aircraft.
drum55··on We broke 92% of SHA-256 – you should start to migrate from it
> it is possible that we'll find relations that carry across the entire double-SHA-256 pipeline

Bitcoin mining is a partial second preimage of 0x00 though, not a collision, that statement just seems to be so outside the realm of what they’re claiming to have done. Even MD5, the most widely known to be broken hash, would be secure when used in the same way bitcoin uses SHA256 (other than being too short now, bitcoin miners have done 80 bits of work at this point many times over).

drum55··on Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
Should providing a public service absolve all sins?
drum55··on Dumping Lego NXT firmware off of an existing brick (2025)
My first ever programming was with the original brick, I made a scanner with the light sensor and a terrible python script that took the values from the serial port and turned them into a bitmap.
drum55··on ATAboy is a USB adapter for legacy CHS only style IDE (PATA) drives
“ Some of this firmware code was written with AI assistance. It currently contains an IPC re-entry, and possibly other bugs that could cause the RP2350 to crash under certain circumtstances. ”

Seems like an admission they’ve not really read the code either.

drum55··on I think WebRTC is better than SSH-ing for connecting to Mac terminal from iPhone
What portion of the security-critical code is written by a human? A shell is literally keys to the kingdom in every regard.
drum55··on Show HN: PIrateRF – Turn a $20 Raspberry Pi Zero into a 12-mode RF transmitter
https://raw.githubusercontent.com/psyb0t/piraterf/88c5fc416d...

That's because it's in the .gitignore.

It's just very obviously made with claude, from the style, to the commits of tens of thousands of lines of code a day, to the parts where Claude commits something sensible and the author goes back to add in curse words. Nobody has ever developed software in the same way that claude tends to, where suddenly a whole readme appears in a commit fully formatted and filled with emojis.

drum55··on Show HN: PIrateRF – Turn a $20 Raspberry Pi Zero into a 12-mode RF transmitter
I occasionally saw a readme with a couple of Emoji in it, but the behavior where every title, every bullet point, every sentence ends with one or more of them is utterly obnoxious. There's something about the sources that chatGPT uses which causes it just sprinkle Emoji absolutely everywhere, it's one of the most obvious tell tales that it came from chatGPT without a prompt to tell it otherwise.
drum55··on Wikipedia deprecates Archive.today, starts removing archive links
It was true and visible when reported, yeah.
← PreviousPage 3 of 4Next →