Hacker News Reader

helperon Strace – My Favourite Secret Weapon (2011)

Last time I tried `perf trace` I realized how many things strace does that I take for granted. Things like file handle to filename resolution and pretty printing read() and write() buffers.

Do newer versions of `perf trace` expose these?

helperon Tinc VPN: Secure Private Network Between Hosts

There's a userspace port being actively worked on that should allow you to run wireguard on most platforms (taking a performance hit).

helperon 20 Years of LWN

LWN is a class act. Most subscription services make you jump through hoops to cancel your subscription. Not LWN though. It is the only media subscription that I've seen that doesn't automatically renew when your payment term is up.

This makes me feel like LWN really respects their customers.

helperon Ubuntu 17.10 corrupting BIOS of many Lenovo laptop models

This is in reference to the issue a few years ago where it was easy to wipe EFI vars via /sys, which would happen if you rm -rf / .[1] Wiping the EFI vars would brick your system.

[1]: https://www.phoronix.com/scan.php?page=news_item&px=UEFI-rm-...

helperon Kata Containers – The speed of containers, the security of VMs

Please don't take the first two urls I found with a single google search as a comprehensive survey of Illumos kernel vulnerabilities over the last few years.

helperon Kata Containers – The speed of containers, the security of VMs

http://www.zerodayinitiative.com/advisories/ZDI-16-168/

http://www.zerodayinitiative.com/advisories/ZDI-16-274/

These were both in Illumos found by the person you are replying to.

helperon Kata Containers – The speed of containers, the security of VMs

The person you are replying to has discovered multiple exploitable bugs in Illumos via DTrace from inside zones:

Here are the first two that pop up if you google his name. http://www.zerodayinitiative.com/advisories/ZDI-16-168/ http://www.zerodayinitiative.com/advisories/ZDI-16-274/

He gave a talk at DTrace conf 2016 about all the security vulnerabilities he personally found in DTrace in SmartOS. Here are the slides: http://slides.com/benmurphy/deck

helperon Volkswagen Official Gets 7-Year Term in Diesel-Emissions Cheating

Oliver Schmidt, the person the current article is about, is a former engineer, now executive.

James Liang was previously convicted. He was an engineer working at the VW test center in LA. His group was directly working to keep CARB and the EPA from discovering the defeat device. My understanding is he was really a mid level engineer.

My source for this information is a book about the scandal and also the history of the VW/Audi engineering culture called "Faster, Higher, Farther: The Volkswagen Scandal". Its well worth the read.

helperon Bucket Stream: Finding S3 Buckets by watching certificate transparency logs

The code takes the CT hostname and tries to access a bunch of different buckets that might exist related to that hostname. So if you get a cert for foo.example.com it will ask s3 if foo.example.com.s3.amazonaws.com and www-foo.example.com.s3.amazonaws.com exist.

helperon CVE-2017-16544: A Busybox autocompletion vulnerability

How do you get privilege escalation from shell escape sequences?

helperon CVE-2017-16544: A Busybox autocompletion vulnerability

The vulnerability is that you can play tricks on interactive users' output. In general people (besides nerds) aren't shelling into these devices so it really doesn't seem like that big of a deal.

helperon Firefox 57.0 Released

Ah, it works for github.com but not for google. Seems like an issue with the google login page.

helperon Firefox 57.0 Released

Whats the status of u2f in firefox 57? Trying to login to gmail I get "Something went wrong. Remove your Security Key and try again." I enabled 'security.webauth.u2f' and 'security.webauth.webauthn' but that didn't seem to help :(

helperon French institute suspects nuclear accident in Russia or Kazakhstan in September

I did some research on this. James Mahaffey who is a nuclear engineer talks about this a bit in his book 'Atomic Adventures.': "Professional-grade Geiger counters, such as the Eberline E-120, are available as surplus, but they are usually sold without the probe assemble, which is what wears out when in constant use in a nuclear power facility. The probe is the expensive part, and installation of a new one will require calibration."

helperon French institute suspects nuclear accident in Russia or Kazakhstan in September

Digital camera sensors can actually be used to detect gamma particles. There's a legitimate app you can use on some android phones that can act as a relatively accurate cheap radiation detector. It requires you to tape over your camera lens with a piece of electrical tape and then to calibrate your phone in an area with only normal background radiation.

The app is https://play.google.com/store/apps/details?id=com.rdklein.ra....

helperon Slack is offline

Yeah and the IRC interface has been getting worse recently. When they added the shared channels across teams they completely broke being able to '@' a user from the IRC gateway. Support said something along the lines of 'yup and we're not planning on fixing it'.

I'm expecting them to completely turn off the IRC gateway in the next year or two.

helperon The Upspin manifesto: On the ownership and sharing of data (2014)

The 2014 label is a little weird. While it was written in 2014 it was only just published publicly today.

helperon Debunking the Java Performance Myth

What go compiler are you using? On my machine those run in exactly the same amount of time (go version go1.9 linux/amd64 ).

  $ ./tmp.test -test.bench .
  goos: linux
  goarch: amd64
  BenchmarkInLoop-4       2000000000               0.46 ns/op
  BenchmarkOutLoop-4      2000000000               0.46 ns/op
  PASS


  (pprof) disasm fast
  Total: 1.95s
  ROUTINE ======================== _/tmp.fast
       970ms      970ms (flat, cum) 49.74% of Total
           .          .     4ed7c0: MOVQ 0x8(SP), AX                             ;main_test.go:23
           .          .     4ed7c5: XORL CX, CX
           .          .     4ed7c7: MOVQ CX, DX
           .          .     4ed7ca: JMP 0x4ed7d6                             ;main_test.go:26
       660ms      660ms     4ed7cc: LEAQ 0x1(CX), BX                             ;_/tmp.fast main_test.go:26
       110ms      110ms     4ed7d0: MOVQ CX, DX
       170ms      170ms     4ed7d3: MOVQ BX, CX
        30ms       30ms     4ed7d6: CMPQ AX, CX
           .          .     4ed7d9: JL 0x4ed7cc                               ;main_test.go:26
           .          .     4ed7db: MOVQ DX, 0x10(SP)                           ;main_test.go:30
  (pprof) disasm slow
  Total: 1.95s
  ROUTINE ======================== _/tmp.slow
       960ms      960ms (flat, cum) 49.23% of Total
           .          .     4ed790: MOVQ 0x8(SP), AX                             ;main_test.go:14
           .          .     4ed795: XORL CX, CX
           .          .     4ed797: MOVQ CX, DX
           .          .     4ed79a: JMP 0x4ed7a6                             ;main_test.go:16
       690ms      690ms     4ed79c: LEAQ 0x1(CX), BX                             ;_/tmp.slow main_test.go:16
       100ms      100ms     4ed7a0: MOVQ CX, DX
       100ms      100ms     4ed7a3: MOVQ BX, CX
        70ms       70ms     4ed7a6: CMPQ AX, CX
           .          .     4ed7a9: JL 0x4ed79c                               ;main_test.go:16
           .          .     4ed7ab: MOVQ DX, 0x10(SP)                           ;main_test.go:20

helperon Infineon RSA Key Generation Issue

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.

helperon Sears's History Predicts Almost Everything Amazon's Doing

Really interesting nytimes article.

> The operation, which also published 50 small specialty catalogues, only recently began accepting Visa and Mastercard for purchases, and for many years, customers had to pick up their purchases at a Sears store even though other catalogues would mail items directly to homes.

Its easy to be nostalgic but it really sounds like sears had already fallen significantly behind by the time they shutdown their catalog.

helperon Reporter: Google successfully pressured me to take down critical story

Interesting. Based on your response to the Gemstash licensing kerfuffle[0] a couple weeks ago I would have guessed you were still lawyering in some capacity for Google. Are you still involved in the opensource licensing policies at Google in a non-lawyering capacity?

[0]: https://news.ycombinator.com/item?id=15085100

helperon The sudden death and eternal life of Solaris

Illumos has a lot of nice features I'd like to use. But my product is a small low power ARM device and I'd run out of money long before I'd finish adding minimal ARM support to illumos.

Things are not as simple as you suggest.

helperon Build your own Linux

+1 for buildroot. I've used it both professionally and on personal projects. All of my rpi projects run on tiny buildroot images (usually with a single go binary). I love that it produces an image I can write straight to an SD card that is ready to go without me having to plug the RPI into a monitor to configure it.

However LFS and BYOL aren't really about making it easy to build a "distro". They really are about learning how all the pieces fit together.

helperon Ask HN: Just made Director, now what?

Maybe read "The Manager's Path" by Camille Fournier[0]. It focuses a lot on the transition from being an engineer to going into management.

[0]: https://www.amazon.com/Managers-Path-Leaders-Navigating-Grow...

helperon Show HN: An improved version of HyperLogLog

There really are a lot of hyperloglog implementations in go.

I'd be interested in seeing a comprehensive comparison between implementations for speed, accuracy and space efficiency.

helperon Go 1.9 Beta 1 release notes

Its not really any different context.WithValue where the strongly encouraged idiom is to have all access go through typed get/set methods that handle the type casting for you.

helperon Go 1.9 Beta 1 release notes

That makes sense. I was hoping someone would have some concrete benchmarks for different access patterns but I don't see any in the github issue[1].

[1]: https://github.com/golang/go/issues/18177

helperon Go 1.9 Beta 1 release notes

When should one use sync.Map vs a plain old map with a RWMutex?

helperon Sprint to be exclusive carrier of Essential phone

You can still buy the phone unlocked direct from essential. This is "exclusive" to sprint in that sprint will be the only carrier to have this phone in their stores.

The supported bands are:

  -UMTS/HSPA+: 1, 2, 4, 5 6, 8
  -GSM: 850, 900, 1800, 1900 MHz
  -CDMA EV-DO Rev. A: 0, 1, 10
  -FDD-LTE: 1, 2, 3, 4, 5, 7, 8, 11, 12, 13, 17, 20, 21, 25, 26, 28, 29, 30, 66
  -TDD-LTE: 38, 39, 40, 41, 42, 43
  -TD-SCDMA: 34, 39

helperon Sprint to be exclusive carrier of Essential phone

Exclusive as in the only carrier to sell it in their stores.

You can still buy it unlocked from their website.