HNHacker News
TopNewBestAskShowJobs

floatingatoll

10,766 karma · joined March 1, 2009

I do not recommend using Keybase; this proof exists solely to maintain claim on my username to prevent impersonation attacks.

[ my public key: https://keybase.io/floatingatoll; my proof: https://keybase.io/floatingatoll/sigs/GUvyKD9s8uaWo_slfFKKYdqV-G4X-WUy9hPtZwyDUXU ]

submissionscomments
floatingatoll··on The FSF’s relationship with firmware is harmful to free software users
https://forum.pine64.org/showthread.php?pid=97828

The above link contains the answers applicable to your question.

floatingatoll··on The Revenge of the Hot Water Bottle
This isn’t a post about that. Someone else can post about that and it’ll be neat too!
floatingatoll··on The Revenge of the Hot Water Bottle
Can you rest the hot water bottles in the brazier for partial effect?
floatingatoll··on Alphabet's Calico has begun trials on a molecule for neurodegenerative diseases
I emailed the mods a link to your comment using the footer Contact link, since they can bypass the lockout.
floatingatoll··on EU Parliament pushes to ban ads targeting health, religion, sexual orientation
Advertisers are still allowed to select businesses to display their ads, and can focus their LGBT budget on LGBT-proximal businesses.
floatingatoll··on Moosend's “Free Forever” plan no longer free
We’re long overdue for a “pay for services you use” recoil now that our personal data can’t be easily sold to pay for them, and the pandemic forced a reckoning of revenue models.
floatingatoll··on Primel – guess a 5 digit prime number – each guess must be a prime
Only to win an argument by nitpick golfing. In everyday serious conversation that’s a 4-byte number, not an 8-digit number.
floatingatoll··on Primel – guess a 5 digit prime number – each guess must be a prime
It’s intentional, same as Wordle’s designed did it.
floatingatoll··on Primel – guess a 5 digit prime number – each guess must be a prime
Were you able to hit the delete key and remove the typed numbers? (Works on wordle too)
floatingatoll··on No amount of alcohol is good for the heart, says World Heart Federation
Okay, fine. It’s acceptable to damage the body to heal the body.

For example, exercise, where you damaging muscle fibers to heal, maintain, and/or improve the body.

Also for example, intoxication, by virtually every vector known to exist, often damaging the body in order to maintain the body.

Being alive is about tradeoffs, not about minmaxing. You can max out any statistic, but only at the cost of the others — sanity included. Alternately, being alive is about the exquisite joy of minmaxing, being able to hyper focus on one specific body goal at the cost of everything else in your life, including sanity (if you’re not careful).

“I’m sane without intoxicants”: so no nature, no music, no games, no social joy, then.

For example, this is either a description of an acid trip or of someone listening to orchestral music on the radio:

“It was so amazing. I’ve never felt so alive. It was, like, there was a train running through the mountains, and my room was one of the train cars, and I could see it right there, and I just stared at the wall for like half an hour and enjoyed the ride.”

I find it simpler to discuss mind and body in separate terms since people have trouble seeing transcendent experiences as intoxicants, but I hope this use of your terms helps clarify my viewpoint.

floatingatoll··on The time might come when we add some JSON specific command line options
I certainly hope not!
floatingatoll··on UK is spending £500k on a PR campaign demonising end-to-end encryption
> Your mobile banking app uses E2EE; online chats with HMRC are protected through E2EE; you'd no more have an unsecured web chat with the taxman's helpdesk than read out your P60 in the middle of a shopping centre.

The Register is only showing an example of #3, but leaves #1 and #2 unaddressed:

1. Your Identity (who everyone is)

2. Your Conversations (with whom, when)

3. Your Content (what was said)

Does the UK government have the ability to identify #1 and #2 for E2EE connections, and they desire #3 (content)?

Is the UK government only able to identify #2, and they desire #1 (identities) and #3 (content)? If so, which is more important to them: Identity, or Content?

I suspect they are much more desperate for Identity and Connections, than they necessarily are for Content, and that their attempt to overreach and backdoor all encryption could be shutdown by offering them #1 and #2 but not #3.

This is obviously unpalatable to consider to "perfect anonymity is the only way" adherents, but it's probably time to consider discussing it, when the alternative is a government backdooring or banning all encryption. It's too bad The Register didn't take that chance, but we could at any time.

floatingatoll··on Iosevka – Versatile typeface for code, from code
Be sure to check out the full customization instructions, which list every single thing that can be customized in a local build of the font, at every possibly level, with screenshots for comparison, in a simple readable list:

https://github.com/be5invis/Iosevka/blob/master/doc/custom-b...

For example:

> K with symmetric legs disconnected to the vertical bar, and serifs at top left

> Ratio of the thickness of the neck of S/s/?, to the normal stroke width. essRatioUpper, essRatioLower and rssRatioQuestion will override this value for corresponded glyph categories when set.

> Extra-high _, placed right below baseline

> The lower bar of <= and >= ligation is slanted

floatingatoll··on Google Camera randomly changes some QR code URLs on Android 12
OP, I can't view this. Can you post a copy of the page to archive.xyzzy or whatever their current URL is?
floatingatoll··on The time might come when we add some JSON specific command line options
--jp is a perfect fit for shell scripting integration:

    bash$ curl ... --jp "foo=$foo" ...
This has zero shell-quoting, expansion, escaping, or separator issues. Whatever's in environment variable `foo` will be sent to the server as a single value associated with key `foo`, whether it's a zero-length empty string, or full of backslashes or spaces or newlines or whatever.

There are fancier ways to accept multi-arg, but they all have weaknesses, and this matches the way curl handles -H arguments already today (one per header, stack them if you want many), so I think it's a sound way to handle CLI arguments.

(I don't have any specific views on whether this is how curl should do JSON or not, but I recognized the CLI safety mechanism immediately.)

floatingatoll··on The time might come when we add some JSON specific command line options
nit for understanding's sake: is the second --jp missing?
floatingatoll··on American Airlines and The Points Guy are suing each other
See also yesterday's FP, about a court's ruling on HTML post-processing once it reaches the user:

https://news.ycombinator.com/item?id=29989927

Plaid could file a friend-of-the-court brief here, since they have (presumably!) strong legal grounds to assert that they are legally within their rights to scrape bank websites, as they're doing so as an authorized user-agent, and since browsers are just user-agents, etc.

floatingatoll··on No amount of alcohol is good for the heart, says World Heart Federation
It is absolutely acceptable to knowingly exchange damage to body for healing to mind, and vice versa as well. But I still appreciate that science is gradually making clear that alcohol is not perfectly harmless, and that a large-scale health foundation is finally admitting that.
floatingatoll··on Gitlab Handbook's HN Page
Hi, I think either I missed something or I see an insight that may not be in there yet, not sure if. In brief:

“Conveying without convincing.”

I think this guide is generally applicable to everyone interacting on HN, not just GitLab PRops, and while considering that I uncovered something I think would improve the value the guidelines.

Lots of online conversations get mired in back-and-forth persuasion, where each side is trying to convince the other of their viewpoint rather than just trying to convey it. This is essentially an impossible conversation to walk away from satisfied, because it’s rare that anyone can be convinced.

So, instead, focus on conveying. Ensure the facts are made clear and point out disagreements. Share your motivations and reasoning. Ask people to clarify when they say something you don’t understand, or could parse multiple ways. Leave disagreement alone, and don’t press it to change into agreement.

This is the toughest thing for anyone to do in conversation (“someone is wrong in the internet” xkcd here), but it’s absolutely the most essential skill and I don’t see it clearly called out. (Maybe I missed it though, it’s late!)

So, I would love to see that concept applied in guideline form. Teaching people to ensure comprehension rather than convincing, and to move on if it isn’t getting through, is the ultimate win in online chat, and I encourage adding it the the guide.

floatingatoll··on Ask HN: HN Search has Google Analytics enabled, can it be removed?
Emailing the mods using the footer Contact link will get a reply. This might not, if they don’t see it.
floatingatoll··on EU should ban proof-of-work crypto mining, regulator says
No, but they are definitely an excessive use of incandescent bulbs in the United States. It’s too bad they haven’t figured out how to make cheap LED strands that are more diffuse and in warm colors, as this is a significant energy burden for both homeowners and the country’s electrical grid.

Your point that their usage doesn’t accelerate over time is valid, but as the link notes, this is still a significant energy burden on the country and should be addressed over time. It can be worked on in parallel to efforts to curb the growth of crypto coin energy waste, so there’s no harm in encouraging reductions to both.

floatingatoll··on EU should ban proof-of-work crypto mining, regulator says
Those resources use a significantly lower total amount of energy per annum and per transaction relative to cryptocoins, as they do not depend on brute force scans of cryptographic hash spaces in order to perform and secure transactions.
floatingatoll··on EU should ban proof-of-work crypto mining, regulator says
That’s a good idea; if you write that up as a blog post and submit it to HN, I’d read it!
floatingatoll··on Locked out of 'God Mode', runners are hacking their treadmills
DHCP advertise an http proxy to it with a PAC file and block non-proxy communications. It should do the right thing eventually, at which point you can catalogue the usual traffic exchanges and then block anything not in them and/or just the software update URLs (which requires inspection over time, as there may be many).
floatingatoll··on Matrix Multiplication
Well, now I understand matrix multiplication well enough to do it longhand in a pinch. Thanks for that!
floatingatoll··on Faker.js is now a community controlled project
To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions.

The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone claiming to be the author’s credentials.

Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

floatingatoll··on Faker.js is now a community controlled project
If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.
floatingatoll··on Mozilla's Firefox Relay to be added to disposable-email-domains blacklist
A world with no accountability is a world without individual safety.

One’s individual right to remain anonymous does not necessarily take precedence over the societal right to hold one accountable. The pendulum of that tension swung all the way to fully anonymous over the past decades, and we now have the most unsafe Internet that has ever existed.

It will, guaranteed, swing back from full anonymity, as already began with many things one could previously access anonymously (such as email verification only) online or in person: Cellular service (ID required), FedEx shipping (ID required), many Discord chats (verified phone number required to defend against sock puppet attacks), and LinkedIn name changes (birth certificate and photo ID required). Whether it swings back to “no right to pseudonyms” or instead cones to rest on lesser outcomes such as “identity protected by law” and “a warrant is required” is up to politicians to decide.

Politicians do not accept and consider anonymous letters, so adhering to the outgoing belief in perfect anonymity may severely construct your ability to influence the outcome of the pendulum’s backswing away from it. I hope that when you write your politicians about this issue, you are doing so in handwriting from your registered voter name and address, so that they are considering your input at all.

floatingatoll··on Rail Theft Soars in California
Take a map of homeless population density per postal code (where LA would figure in the top 5, if not top 1).

Apply a map of retailer container shipping traffic per postal code (where LA would, again, figure in the top 5, due to the ports and their surrounding infrastructure such as warehouses and garment manufacturing).

What other areas of high homeless density also have as high a density of goods throughout as this particular cluster route in LA?

Is the security and prosecution of crimes in those areas as lax as it is in the LA train yard?

If so, then perhaps the only thing preventing thefts there is that no one’s done the math yet and found it. Or that they’re keeping it to themselves and not earning national attention, because no reporter has done a drone flyover of the carnage yet, or because they’re keeping it to such a low volume that no one has noticed.

I would expect this is the work of a small group of people who are spreading word about the security gap left by too few security guards on the ground, and that Southern Pacific has been trying to maximize profits by not hiring more security guards for their LA interchange and having all the insurance companies involved pay for the lost items. I suspect the nationwide news showing these photos is going to antagonize those insurance companies into spiking the rates of all involved shippers, but it’s unclear to me whether Southern Pacific is vulnerable to — or insulated from — insurance company outrage in this regard.

So maybe it’s a bit soon to pass moral judgment upon homeless people, and instead wonder “what group of opportunists are exploiting a logistics weakness and inviting desperate homeless people to join the free money party?”. Hard to imagine desperate people turning down free money at essentially zero risk, but they weren’t doing this on their own before. Find the ringleaders and deal with them instead.

floatingatoll··on Mozilla's Firefox Relay to be added to disposable-email-domains blacklist
Many Discord servers are configured to require a validated phone number. It is up to the admins of the servers to decide whether enforcing this requirement is appropriate for their community’s needs and requirements.
← PreviousPage 5 of 34Next →