Hacker News Reader

jsnon Three Tales of Second System Syndrome

This is ridiculous. The author makes it sound like perl6 is more of a success than python3 -- despite python3 being used for real projects for years now, and perl6 being "slow and about to have its first release" (just like it was for the last, I don't know, 7 years?). I mean, come on.

jsnon Deprecating Non-Secure HTTP

Did you know that Russians had github blocked for several days? Anyway, you're talking about counter-censorship warfare. Yes, some of those measures will be somewhat effective sometimes, but the costs (not necessarily even monetary) are actually quite substantial, and it's definitely not for everyone.

jsnon Deprecating Non-Secure HTTP

I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be).

It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block all access to those URLs, or else.

So if a page (perhaps, a comment page?) on your site enters the register, and it is served over unencrypted HTTP, ISPs can use DPI to block the access to just that specific page -- which sucks, but at least your site is still accessible. If, however, you use HTTPS -- then ISPs have no other choice but to block all traffic to your site entirely. Given that choice, many webmasters (myself included) will have to choose plain HTTP.

jsnon SSH Agent Forwarding considered harmful

It's called secure shell for a reason. You know your ProxyCommand isn't tampered with because your ssh client has successfully matched the remote system key against your known_hosts file.

jsnon We are under attack

For them, using a DDoS mitigation service might be harder than it seems. Their project, "Collateral Freedom", depends on having a set of web frontends with some special properties. Namely, 1) the provider of the said frontends must be willing to ignore takedown / access restriction requests from (Chinese, Russian, etc) authorities, and 2) the access to those frontends can't be easily blocked by the Great Firewall of China / Russia / etc without causing massive problems to some unrelated widely used services.

(full disclosure: I do devops for one of the Russian sites that is currently mirrored by Collateral Freedom)

jsnon Every C99.php shell is backdoored

That's not not how 'let' works, you can't do that with 'let'. You most definitely should blame the tools here.

jsnon LastPass and the Heartbleed Bug

Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.

jsnon Ketamine 'exciting' depression therapy

I don't know why you are being downvoted. My understanding is that yes, that's more or less how it works. Speaking from experience, whatever it is you are obsessing about, a ketamine trip makes you forget about it for about an hour. I think the main feeling you get when coming down from the trip is that you were just shown a world where your obsession doesn't make any sense, and it's a very good time to question your obsessions.

jsnon Ask HN: Can we trust our CPUs?

Don't know why you were downvoted, it's a valid concern. It won't be "phoning home", though -- you only can phone the so called "global adversary" this way (because you can't send packets to arbitrary addresses).

Also, messing with TLS probably won't work at all. Messing with e.g. MTU sizes, IP sequence numbers and perhaps TCP options, on the other hand, could probably work.

jsnon Candy – a JavaScript-based multi-user XMPP chat client

1) The same as in a two-user chatroom? To hide the conversation content from everyone outside of the chatroom? 2) I heard people work on that, but I don't know any details. Might take a bunch of pairwise exchanges [tedious, but probably okay for small rooms], or moderators may serve as trust/key exchange hubs.

jsnon Quotations Of The Dread Pirate Roberts, Founder Of Silk Road

Yeah, riiiight. Nice try at FUD, DEA :)

jsnon I used Google Glass

No.

jsnon Psilocybin shows success in medical trials

Yeah, DOB (and any other DOx, I suppose?) seems pretty bad. Very bad trips are apparently both much more probable and much more unpleasant on DOB than on acid. I don't think I know anyone who tried DOB and would recommend it.

jsnon Psilocybin shows success in medical trials

It's pretty simple with LSD. You should buy it in blotter form. A piece of blotter can only contain so much of active material (fractions of a milligram). It's too small a dose for almost any psychoactive substances to have any effect on you. LSD and DOB are rare exceptions to this rule. So if you have something on a blotter, it's either LSD or DOB.

Now, DOB is very bitter, and LSD has no taste. If you put a piece of blotter in your mouth, and it tastes bitter, just spit it out -- that's probably DOB. Otherwise, it's LSD, and it's pure.

jsnon Linus Torvalds: Is Engadget really that stupid? Just corrupt? Trolling us all?

You still have to show some ID in EU, I think (at least that's how it works in CZ and SK).

jsnon Joey Hess' minimal approach

To each his own, I suppose. I've been deskless for 4 years, mostly on a couch in a relaxed position with laptop on my, hmm, laps. It's much more comfortable for me than chairs and desks. I sometimes spend 16 hours per day pressing those keys; I don't think I could've survived that in a chair behind a desk.

jsnon Cute riddle: Four kids holding one toy balloon

Easy! Make the balloon large enough to lift N - 1 kids!

jsnon Fusion power could arrive sooner than expected

That's a popular misconception, IIRC. Actually, in thermonuclear weapon the bulk of energy comes from fission. [1] Fusion is technically only used to get the high energy neutrons to get the bulk of fissionable material to undergo fission. So, ironically, calling it a "fusion bomb" is very much like calling your car an electric hybrid.

1. http://en.wikipedia.org/wiki/Thermonuclear_weapon

jsnon The Macroeconomics of Chinese kleptocracy

> he implies that the big four are holding significant amounts of Treasuries on their balance sheets

What? Where? The only mention of "big four" in his text is about big audit firms being silent about evidence of fraud perpetrated by big Chinese companies.

jsnon The Apple Boycott: People Are Spouting Nonsense about Chinese Manufacturing

But I believe I can. These kids often choose between living in hopeless poverty and earning a reasonable living. It's pretty plain and simple. You don't have to be 21 to make a rational decision in a situation like this.

jsnon The Apple Boycott: People Are Spouting Nonsense about Chinese Manufacturing

But it's obvious, isn't it? The workers choose to work there, for that income and under those conditions. This means that all alternative options available to them are worse (like working for even lower income and in worse conditions, or even not working at all). So, clearly, Apple has improved their conditions. Plus, Apple is doing it at profit -- which means that that improvement is sustainable. Isn't it marvelous? I mean, I don't like Apple products, but I have to give it to them: they change lives of thousands of workers for the better.

jsnon Super Cheap Virtual Private Servers - the Wild West of Hosting

Right, that's what GP said in the comment you replied to: that he probably should not use that VPS provider.

And yes, password-reset emails may also be a concern (not as severe, though, if reset emails are single-use and have short TTL).

jsnon Super Cheap Virtual Private Servers - the Wild West of Hosting

No, but it does mean that anyone who's able to view your traffic or your mail box content could've seen the password (anyone controlling any router or a mail relay between you and them, or your mail service provider, or even someone with tcpdump on your LAN segment).

jsnon What everyone in the SOPA debate is missing: IP is not a fundamental right

Boris Yeltsin didn't die on new year eve 1999, he died in April 2007. Yeltsin resigned on new year eve 1999, effectively relinquishing the power to Putin.

jsnon Could Revolution Come to Putin's Russia?

I was there on Sakharova st. yesterday, somewhere in the crowd on the photo. It's been 3 weeks since these things started to happen. I have to say it was almost as much of a surprise to the russian opposition as it was to Kremlin.

jsnon Nginx server not safe against ldos | feedback from sys admins?

Attack description and analysis: http://www.cs.unc.edu/~jeffay/courses/nidsS05/attacks/TCP-sh...

I agree with andrewcooke, it doesn't seem to be a problem of nginx or apache. OS TCP implementation should be modified to handle this type of attacks.

jsnon HP's new ARM-based Servers

If your nodes are not bound on some local resource, you can as well just run them in virtualization containers on Xeon. The setup will be even more flexible than with (less powerful) ARMs.

jsnon HP's new ARM-based Servers

The original Calxeda reference design from last year was a 2U rack-mounted chassis that crammed 120 processors (and hence server nodes)

also:

HP can cram three rows of these [4 CPU --jsn] ARM boards, with six per row, for a total of 72 server nodes

From that I conclude that in their calculations 1 CPU == 1 server.

jsnon HP's new ARM-based Servers

Why, for embarrassingly parallel workloads (like the ones they mention) it's a totally reasonable assumption. And for something not so parallel the gazillion of ARM nodes is all but useless.

jsnon HP's new ARM-based Servers

From http://www.theregister.co.uk/2011/11/01/hp_redstone_calxeda_... :

The sales pitch for the Redstone systems, says Santeler, is that a half rack of Redstone machines and their external switches implementing 1,600 server nodes has 41 cables, burns 9.9 kilowatts, and costs $1.2m.

A more traditional x86-based cluster doing the same amount of work would only require 400 two-socket Xeon servers, but it would take up 10 racks of space, have 1,600 cables, burn 91 kilowatts, and cost $3.3m.

Hmm, let's see. It's about 7-8 grands per Xeon server, something like HP Proliant DL360R07 (2 x 6-core Xeons at 2.66GHz). It's 3 times as many cores as Redstone, clocked at 2.66 times greater frequency each, and doing more instructions per clock tick, too. And that's without hyperthreading.

Am I missing something big, or is Redstone solution neither cost-effective nor energy-effective?