HNHacker News
TopNewBestAskShowJobs

halomru

498 karma · joined January 3, 2016

submissionscomments
halomru··on Two years spent spamming spammers back
>sales cold calls, though... you know people are going to do it. It is their job.

Sales cold calls are illegal in my country and happen to me once every few years. My email address isn't so lucky.

>Sure, junk mail is annoying and most of it gets thrown out.

And more importantly: I can put a simple "no advertisements" sign on my real mailbox and cut down junk to almost zero. I wish I could do that to my virtual inbox.

Email junk is far worse than any real-live equivalent in my culture.

A better metaphor is having my business and private conversations while walking over a Middle-Eastern market where random people try to sell me stuff.

halomru··on Zombie Moore's Law shows hardware is eating software
GPUs and i7 CPUs have radically different design philosophies. The i7 has great performance per core and giant caches, while the GPU has lots of (relatively) slow cores with tiny caches, and effectively only SIMD-instructions.

For simple, highly parallelized floating-point number crunching nearly any GPU will blow your i7 out of the water, no matter how you program your i7. Only a tiny fraction of the surface area of the i7 has stuff useful for that task, but GPUs are designed for that works. Conversely, any GPU will be absolutely terrible at running Microsoft Word.

halomru··on Akamai takes Brian Krebs’ site off its servers after ‘record’ cyberattack
Possession seems to be a very nebulous concept in English and US law (probably because of their common law systems).

In contrast, German law defines possession as "having effective control" (with some more nuance obviously). Possession is also entirely different from ownership in German law. I can not control an object I have no knowledge of. If you place an object in my house, I only gain possession of it once I discover it.

I think this is one of the cases where the civil law approach of rigorous definitions is clearly superior to the common law approach of establishing precedent.

halomru··on Original bulletin board thread in which ‘:-)’ was proposed
At some point between 1982 and the late nineties ;) replaced :-) as the joke indicator. But with modern WhatsApp rendering ;) as a suggestive grin instead of a simple wink I imagine the current generation of teenagers has found a new innocent joke marker.
halomru··on The GitHub GraphQL API
SQL (at least the subset used for querying and modifying data) contains no physical knowledge either. In a SELECT-query a physical table and a logical view look and behave the same.

If you only give your users access to views instead of physical tables you get the same result as GraphQL, just with different syntax.

halomru··on G.E., the 124-Year-Old Software Start-Up
>paying well (i.e., actually being a good place to work).

I don't think good pay and good place to work are synonymous in any way. They happen to be correlated because both are methods to attract talent, but one does not cause the other.

halomru··on Show HN: In-view.js – Get notified when DOM elements enter or exit the viewport
Sure, it's great in that one metric. But annoying me with the offer to get a bunch of emails I don't want isn't making me like your site.

Even if I was the odd one and nobody else would mind those pop-ups: In the context of multiple experiments showing that a few hundred milliseconds additional page load time have a very real impact on engagement rates it stands to reason that interrupting the user experience with unrelated email sign ups should have a similar effect.

halomru··on HTTP/2 makes media loading 3–15 times faster on mobile
>What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

Injecting ads is a relatively harmless but hugely profitable application we are already seeing.

On the more serious side, changing news feeds has huge potential for governments. It's the perfect propaganda tool, and with advances in machine learning the cost of doing this on a gigantic scale shrinks every day.

halomru··on Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
Having the checksumming system unmodifiable would be similar to disallowing modification of speedometer and odometer. Important measurement instruments were always kind of a special case.

You could use this to limit modification of some crucial systems (ABS, airbags, etc. Those will always be one septate microcontrollers anyways because of their hard real time requirements).

Or as you said you could keep all modified cars out of public traffic, while still allowing experimentation on private roads. Both variations are more heavy-handed than I would prefer, but a lot better than the status quo.

halomru··on HTTP/2 makes media loading 3–15 times faster on mobile
>This is because of the widespread assumption that anything that goes over port 80 is HTTP 1.1, which makes some middle-boxes interfere with or destroy traffic when any other protocols are used on that port.

I'm not convinced that's a real problem once traffic leaves your servers/CDN. In practice I have seen lots of protocols use port 80, since 80 is the port that's most likely to be unrestricted on even the strictest corporate firewalls.

halomru··on HTTP/2 makes media loading 3–15 times faster on mobile
That's simply to give web developers another incentive to use TLS. There is no real technical reason beyond that.

>any resource, even an image, being loaded from an insecure endpoint results in a warning

By nessesity, unsecured resources undermine TLS's integrity guarantees. An unsecured image on my bank's website would mean that anyone who MitMs my connection can swap that image to show a message that appears to be from my bank.

The internet is no longer the trustworthy place it was in the eighties. HTTP2 is one attempt to make developers catch up with ye that.

halomru··on Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
> how do you expect a cop to run a hash sum on the vehicle software

Any flash chip that holds vehicle software gets a tiny hardware component that once a minute hashes the entire memory and broadcasts the checksum over the car's message bus. Somewhere in the car there's a read-only hardware interface to the message bus that cops and mechanics can use.

If you don't trust the message bus you need a bit more silicon to provide a signed challenge-response protocol, but then we're still talking about cents per flash chip.

halomru··on Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
By far not everyone modifying a car is a skilled mechanic. Many are, but by the same logic most people modifying car software will be skilled programmers.

>software modifications are pretty impossible to detect

I think there are two classes of software modifications: those that negatively impact the environment or other people and those that don't. The first is by its nature easy to detect from the behavior of the car, and I see no reason to regulate the second class.

Some people will introduce bugs, but I'm not convinced that's a problem that needs to be solved; self-preservation will make people careful not to introduce bugs in the break system, serious problems should be few and far in between

halomru··on Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
No, but neither can anyone else.

I can't proof that the neutral network always behaves correctly, but with testing and statistics you can verify the network up to a chosen certainty (below 100% obviously). Or you can actively search for problems with fuzzing techniques. All without solving the halting problem.

halomru··on Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
>there is the problem of people modifying the software of their car, which should not. One should not just tinker with the algorithms used to control the engine, breaking and stability control.

Why is that a problem that has to be solved? In purely mechanical cars, people already can and do tinker with the engine and breaks. But only a tiny fraction of people do, and those usually take care not to risk their lives. In the limited cases where modifications cause problems for other people, regulations are enforced through scheduled inspections and random stops of suspicious vehicles. This system has worked quite well for the last hundred years or so.

If software really is different and shouldn't be modifiable, I think this needs a little more justification.

halomru··on SW-delta: an incremental cache for the web
Where JQuery was once a necessity for building complex dynamic crossbrowser web pages, on today's browsers the popular parts of JQuery mostly just make the syntax sightly shorter and fix tiny inconsistencies.

JQuery functionality is for the largest part integrated in modern browsers, JQuery is living on because of momentum, it's ecosystem and the desire to support older browsers.

React meanwhile is popular in some places, but hasn't reached nearly the age and ubiquity that would warrant a native browser implementation.

halomru··on The brave new world of robots and lost jobs
>Otherwise, to minimize resource usage, let's all give up on civilization and go back to caves.

We can't go back, unless we are willing to kill off most of the population. If we give up just one hundred years of technology we have to destroy every forest in an attempt to grow enough food. All seven billion humans giving up on society and going back to a hunter/gathered society would lead to an immediate collapse of most ecosystems.

We are certainly consuming too much to be substainable right now, but at the same time the amazing efficiency improvements that civilization has brought us are the only thing that make it even possible to live on this planet with seven billion other humans.

halomru··on Show HN: Accelerating SHA256 by 100x in Golang on ARM
>there are no algorithm changes (otherwise the results would be different

Insertionsort, Mergesort and Timsort are three wildly different algorithms with different speeds, but on every possible input they produce the exact same result

halomru··on Security experts have cloned all seven TSA master keys
That depends on what you are trying to achieve with the locks? I think most cases where the lock would be actually useful could be covered with tamper-evident stickers. (You seal the zippers, TSA reseals with their own stickers)
halomru··on Lepton image compression: saving 22% losslessly from images at 15MB/s
PNG is a very nice, extensible container format. In principle you can use it to store arbitrary image data, and still make use of all established metadata fields.

In practice you probably shouldn't do that without changing the file extension and the magic bytes to avoid confusion among users and poorly written software.

halomru··on The takeover: how police ended up running a paedophile site
Well, NSA's mission is foreign intelligence and counter intelligence. Fighting crime isn't related to their tasks at all. And I would really prefer if it stayed that way.
halomru··on The takeover: how police ended up running a paedophile site
>And it was legal for people to send this image to others, and to post it online unhindered

Even if child pornography were legal, that doesn't remove all laws about personality rights. You can't make and freely distribute any pictures of me without my consent (or the guardians consent in the case of minors).

halomru··on Jailbreaking the Microsoft Fitness Band
Not sure if you're serious? The fitness band doesn't store your SSH keys, but with a heartbeat sensor, GPS and an accelerometer it allows unprecedented insights in your daily life (your heartbeat accelerated inside the maternity ward? Just imagine the datamining possibilities). We are dealing with extremely private data here, and a consumer device should be protected accordingly.
halomru··on Show HN: The SC4-HSM, a fully open USB hardware secure module
>I don't know how you make something capable of user interaction AND immune to keys, pocket fuzz and soapy water. It's a tall order.

One consumer device that has consistently delivered that is the waterproof, rugged feature phone. In fact, taking an old Samsung B2100 and writing a Java app to serve as a Bluetooth HSM probably leads to a cheap, serviceable solution.

halomru··on African American Vernacular English Is Not Standard English with Mistakes (1999) [pdf]
With all other words relating to absence of negation English uses the "binary toggle" interpretation (which is only binary as long as the described concept is binary). For example "Nobody is never not doing it" is equivalent to "nobody is at least sometimes doing it" is equivalent to "everybody never does it".

Two negations on different parts of the sentence also don't reinforce each other: "not everyone is not doing it" if equivalent to "some people are doing it".

To me treating double negative as reinforcement of the negation is a weird, unintuitive corner case that doesn't fit in the broader framework of the English language.

halomru··on How a comment on Hacker News led to 4½ new Unicode characters
But if the shape of embedded in the text, font choice becomes meaningless.

> undue effort on every computer maker, ect, to keep up.

The effort to update the font files every few years? Unless you insist on supporting a new Unicode version the second it comes out, I don't see the big effort here? Of course there is effort for font makers, but this is quite centralised.

halomru··on How a comment on Hacker News led to 4½ new Unicode characters
Emoji are widely used in text such as instant messages and forum posts.

They are mostly in Unicode for use in SMS, but there are plenty of use cases in other forms of text.

halomru··on Being privacy-aware in 2016
With a VPS-self-hosted VPN all your connections to the outside originate from a static, unique, unshared IP, making it trivial to track and correlate your behavior across all protocols. Instead of containable identifiers like cookies, your IP has become a guaranteed unique identifier.

To leverage this, it's fairly easy to detect you're on a self-hosted VPN: your IP is in an IP range assigned to a hosting/colocation provider, is not a TOR proxy (there is a public list of those) and doesn't belong to any remotely popular VPN (easy to enumerate for a little money, lots of lists exist).

In exchange for that you have eliminated your ISP (or public wifi) as a threat but instead added the hosting provider to the list of threads. And for any adversary that stands above the law, the routing infrastructure of your hosting provider is already a valuable target.

halomru··on Searching 20 GB/sec: Systems Engineering Before Algorithms (2014)
>what the end user is satisfied with as instant (maybe <1min).

There's a number of thresholds you can hit:

5 minutes: this is taking a while, better grab a coffee

1 minute: this is taking a while, I can let my thoughts drift a bit

10 seconds: it will be done soon, I'll just stare at the screen till it's done

1 second: it's not slow, but sluggish and interrupting my flow

200 milliseconds: that result came instantly when I pressed the button

50 milliseconds: the results update instantly when I use this slider

Hitting another of these milestones transforms the user experience and allows the dataset to be experienced in a new way, allowing more spontaneous exploration of the data

halomru··on Google Maps is about to get a lot more ads
>I needed a bigger kick in the butt to try something else

At least in Germany Open Streetmaps has vastly better maps than Google Maps. On a global scale Google or Bing maps are very consistent while OSM depends on the local community, but they are well worth checking out.

For satellite images Google Earth is hard to beat, but Bing has good images as well

← PreviousPage 5 of 6Next →