Hacker News Reader

karldingon Linux touchpad: preliminary project funding, survey results

This was on HN about a month ago [0].

[0] https://news.ycombinator.com/item?id=22957573

karldingon Ask HN: Is there still a place for native desktop apps?

For anyone interested, this is the Oniguruma [0] regex library written by K. Kosako. It's also used in Ruby and PHP.

karldingon We at $Famous_company switched to $Hyped_technology

FWIW, there's actually a CPython patch from Instagram [0] that proposes "Immortal Instances" (and I understand that YouTube had their own set of patches for "Eternal Refcounts") which aims to alleviate some of those issues and reduce Copy-on-Writes.

[0] https://bugs.python.org/issue40255

karldingon Happiness is a freshly organized codebase

Note that .git-blame-ignore-revs is just a convention, git doesn't automatically use the file like how git treats the .gitignore file. You can add it to the repo configuration though, so you don't need to pass --ignore-revs-file every time, provided that you're running Git 2.3+[0].

    $ git config blame.ignoreRevsFile .git-blame-ignore-revs

This is extremely useful if, for example, your team decided to introduce new automated style changes, and didn't want to completely clobber the history for blame. By specifying the commit that introduced the style change, actual "interesting" changes should be correctly attributed and the style change commit is ignored in the blame output.

[0] https://github.com/git/git/blob/master/Documentation/RelNote...

karldingon Nintendo has reportedly suffered a significant legacy console leak

This is the main plot point in S01E01, when Gordon Clark and Joe MacMillan reverse engineer the IBM and dump the BIOS (and is later mentioned a few times when Cameron Howe is rewriting the BIOS).

Spoilers ahead if you haven't watched the show (quotes from S01E01: I/O):

> Gordon Clark: A personal computer, like any other computer, is just a nothing box full of electronic switches and hardware. You know, the IBM, the Altair, the Apple II... it's all the same junk. Anyone can buy all this stuff off the shelf right now. It's called "open architecture." I mean, IBM, they basically don't own anything inside the machine.

> Joe MacMillan: Except the chip.

> Gordon Clark: Yeah, well, except what's on the chip. The BIOS is on one of these chips, we just don't know which one. The ROM BIOS is the only part of the machine IBM actually designed. I mean, it is the program, it is the magic. The bad news is they copyrighted it and they own how it works. The good news is there's a way around that, sort of.

> Joe MacMillan: Reverse engineering.

After dumping the BIOS, IBM decides to sue Cardiff Electric because Joe MacMillan tells IBM about their little "side project", forcing the company to dedicate resources towards actually building a IBM PC clone. In the meeting with Cardiff Electric's lawyer (Barry Shields), they agree to do a clean room implementation.

> John Bosworth: Why can't we fire these peckerheads?

> Barry Shields: Because then you'll lose this lawsuit. Fire them, shelve their work, you're essentially admitting guilt.

> John Bosworth: Okay, so what's the solution, Barry?

> Barry Shields: We legitimize the project.

> John Bosworth: What?

> Barry Shields: Go the other way. We say Cardiff Electric as a company has been pursuing PC development all along. You take Clark's findings on the BIOS chip, you tell an engineer to build a unit that operates and performs in exactly the same way, but you don't tell him how to do it.

> John Bosworth: Hell, I don't think we have one engineer capable of building a BIOS from scratch other than "Sonny Bono" over here.

> Barry Shields: And you can't use him or any other engineer we currently employ.

> John Bosworth: So we have to hire?

> Barry Shields: Yes, someone who doesn't know us or IBM, and certainly hasn't seen the contents of this binder. Essentially, all the law stipulates is that he can't be hands-on in the actual chip creation.

> John Bosworth: And we can't fire them.

> Barry Shields: No, not right now.

> John Bosworth: So we get out of this by actually building a PC clone? This is your brilliant idea to save our hides, Barry? For God's sake, man!

> Barry Shields: No. Actually, it was MacMillan's.

> John Bosworth: You son of a bitch.

And then later, when they hire Cameron Howe as the programmer to write the BIOS for their clone, there is a whole scene on her first day where Barry Shields interviews her to make sure everything is legal, and that she wasn't involved in the reverse engineering.

> Barry Shields: Answer honestly. This is for legal record. False answers put you at risk of perjury, you understand?

> (Cameron nods)

> Barry Shields: I'm sorry, you have to answer "yes" or "I do."

> Cameron Howe: Oh, yes, I do.

> Barry Shields: Have you ever attempted to disassemble or deconstruct any product manufactured by International Business Machines, more commonly known as IBM?

> Cameron Howe: Uh, no, I have not.

> Barry Shields: Have you ever attempted to reverse engineer any product or equipment made by IBM?

> Cameron Howe: No, I have not.

> Barry Shields: Have you ever attempted to reverse engineer any microchips, microcode, or any computer hardware while under the employ of a business or corporation?

> Cameron Howe: No, I have not.

> John Bosworth: Well, welcome to the tiniest, leakiest lifeboat you ever tried to paddle to shore in.

The rest of the season highlights how Cameron is placed in a "clean room" (aka the storage closet) without looking at the binder containing the dumped BIOS.

karldingon Why is the latest Intel hardware unsupported in libreboot? (2017)

> One module is the operating system kernel, which is based on a proprietary real-time operating system (RTOS) kernel called “ThreadX”. The developer, Express Logic, sells licenses and source code for ThreadX. Customers such as Intel are forbidden from disclosing or sublicensing the ThreadX source code.

Now that Microsoft has acquired Express Project [0], I wonder if those terms will change, especially since they're trying to compete in IoT against Amazon (who acquired FreeRTOS). Of course, this is a relatively small issue compared to the rest highlighted in the post though.

[0] https://blogs.microsoft.com/blog/2019/04/18/microsoft-acquir...

karldingon The Lost Art of Structure Packing (2018)

This is why I always use static_assert [0] to assert on the struct size in projects using C11+, or use a macro to create my own (using the negative array size trick) to cause a compile error if I can't use C11 as a sanity check for these cases. This saves a lot of potential headaches.

[0] https://en.cppreference.com/w/c/language/_Static_assert

karldingon Running an independent Arch Linux rebuilder

Isn't this chain of trust essentially what crev [0] tries to do? FWIW Rust implements cargo-crev [1], but I suppose you could extend this to AUR packages with a bit of work.

[0] https://github.com/crev-dev/crev/

[1] https://github.com/crev-dev/cargo-crev

karldingon PayPal and Venmo are still letting SIM swappers hijack accounts

According to this post [0] on /r/verizon, it's not available to Prepaid and Business accounts.

[0] https://old.reddit.com/r/verizon/comments/eve25m/comment/fkq...

karldingon Apple CarPlay, Android Auto distract drivers more than pot, alcohol, says study

On a similar note, what happened to cars that would lock you out of interacting with the infotainment system whenever you were driving faster than parking lot speeds? I assume this was some regulatory/safety requirement.

I remember cars used to either implement that feature, or outright prevented you from even pairing a new Bluetooth device when your car was in Drive. But then all of a sudden it seemed like automotive companies stopped and touchscreens became acceptable. Does anyone know what changed?

karldingon The End of Starsky Robotics

The choice of naming here is somewhat unfortunate, and probably contributes to some confusion.

Level 0-5 is terminology used by SAE to describe the range of fully manual (Level 0) to fully autonomous (Level 5). One would expect that in an article about Autonomous Vehicles, L{0,1,2,3,4,5} would describe the level of autonomy that the vehicle provides, but the article instead uses these to describe arbitrary thresholds of a graph demonstrating the capability of an AI.

karldingon Calls to Cancel SXSW Intensify as Facebook, Twitter Pull Out, 30K Sign Petition

Adobe Summit 2020's cancellation was also discussed on HN yesterday [0].

[0] https://news.ycombinator.com/item?id=22470462

karldingon No More Pink Mustache

According to this post on Blind [0], she left Facebook to become a Principal Engineer at Lyft.

[0] https://www.teamblind.com/post/Successful-career-stories-of-...

karldingon Mutable Instruments' Eurorack Modules

This already exists in some form.

There's a Waterloo start-up that spun out of a Fourth Year Design Project, Palette [0]. Their main sell was integrations into various creative tools (ex. Adobe Creative Suite, Ableton). They recently rebranded as Monogram [1][2] after announcing new hardware.

[0] https://www.kickstarter.com/projects/cchu/palette-a-freeform...

[1] https://fstoppers.com/gear/palette-gear-announces-new-hardwa...

[2] https://monogramcc.com/

karldingon Grindr and OKCupid Sell Your Data, but Twitter’s MoPub Is the Real Problem

> One more time, what mobile phone owners need is an intermediary layer in the mobile OS where they can either manually or programmatically (via e.g. a random number generator) lie to higher-level application layers about the phone's data.

On Android, if you install Xposed, there's XPrivacy [0], which essentially had this premise. Unfortunately, it only supports versions 4.0.3-5.1.1 (and is no longer maintained).

I haven't been following the rooting community for a while, so someone can probably correct me if there's a better alternative now, but I believe the replacement is XPrivacyLua [1].

[0] https://github.com/M66B/XPrivacy

[1] https://www.xda-developers.com/xprivacylua-xposed-module-pri...

karldingon PopSockets CEO calls out Amazon's tactics before House committee

There was actually a discussion on HN a couple of months back [0] about what "Amazon's Choice" actually means. The consensus then was that it's not simply based on sales.

[0] https://news.ycombinator.com/item?id=20098157

karldingon Automate GitHub Dependency Updates with Dependabot

The point that the parent commenter is highlighting is that if somehow a malicious package version is introduced, since nobody actually is auditing the changes that are being pulled in, it is possible for the tests to pass and introduce a security vulnerability. They're suggesting that the contents of the actual diff in the packages should be reviewed.

karldingon Sonos's “recycle mode” intentionally bricks devices so they can't be reused

What's the current best alternative to a Chromecast Audio, now that they're discontinued and no longer as readily available?

My current living room setup is a Chromecast Audio connected to an AVR via the optical out connection, which powers my speakers, but I'm curious if there's any alternatives. The eBay sellers are really starting to price-gouge, and I'm not naive enough to believe that my Chromecast Audio will last forever.

karldingon Bazel 2.0

According to this comment [0] by laurentlb (one of the people working on Bazel who also commented in this post) from a year ago, Blaze is just Bazel but with integrations to Google-internal tools.

[0] https://news.ycombinator.com/item?id=18823546

karldingon C-for-all: Extending C with modern safety and productivity features

Here's the discussion from 2018 [0], which has some responses from people involved with the C-for-all project.

[0] https://news.ycombinator.com/item?id=16657385

karldingon Personal and social information of 1.2B people discovered in data leak

One of my coworkers generates a fake middle name for every service they sign up with. According to him, this serves as a unique identifier allowing them to determine when a service is selling their data to a third party (or data is being leaked).

karldingon How We Built a Vectorized SQL Engine

You might be interested in BikeshedDB [0].

[0] https://github.com/tbg/bikesheddb

karldingon Microsoft has removed the “use offline account” option when installing Windows

> This also means that everyone get the same tools (same version, same bugs).

Everywhere I've worked solved this by having the toolchain available via a network share that you would mount/copy, or checked into p4 so that everyone would be on the same version and you would know what compiler version was used to build a particular release. I suppose you could achieve the same thing by building in a Docker container..

This is kind of the idea behind the hermetic environments that Bazel enforces, and is essential if you want bit-for-bit reproducible builds.

karldingon Facebook emails show internal concerns being raised about Cambridge Analytica

Quote from the linked website:

> Thursday, April 7, 2005

> 4:12:44 PM EDT

> Mark Zuckerberg starts a conversation with Aaron Greenspan on AIM

> [...]

> ThinkComp: i don't care who wrote it

> ThinkComp: or where they are

> ThinkComp: it's your responsibility to get it done

> zberg02: yea but it's also my responsibility to get other stuff done as well

> zberg02: you know how it is to run a business

> ThinkComp: believe me, i totally understand that :-)

> ThinkComp: i'm drowning in taxes

> ThinkComp: and have 20 other projects going on

> zberg02: yea

> ThinkComp: but those projects affect maybe 30 people collectively

> ThinkComp: and there's no danger element

> zberg02: and i really do get that you care about people's security

> ThinkComp: you could have opened yourself up to another lawsuit had you left it open longer

> zberg02: not quite

> ThinkComp: oh yes

> ThinkComp: very much so

> ThinkComp: FTC code section 5

> [...]

karldingon Uber, losing billions, freezes engineering hires

According to the article, Uber ATG (the self-driving division) isn't affected.

> The freeze does not apply to Uber's autonomous vehicle and freight-shipping divisions.

karldingon Bill Gates Resume (1974)

As a data point, the University of Waterloo releases data about hourly earnings for students enrolled in the co-op program. The first co-op term for students in Mathematics (the faculty Computer Science is under) is typically taken after completing 2-3 semesters of schooling.

According to the data for students doing internships in the United States, the average first year Computer Science (or more accurate, first year Faculty of Mathematics) student is making $30.57 USD an hour [0]. However, going to the States is typically a function of one's experience, and so this is more common in upper years.

If you take the average for work terms in Canada, the average first year (or more accurately, first year Faculty of Mathematics student) makes $18.84 CAD [1].

[0] https://uwaterloo.ca/co-operative-education/about-co-op/co-o...

[1] https://uwaterloo.ca/co-operative-education/about-co-op/co-o...

karldingon Raspberry Pi Model Railway Automation

If you're interested in reading more, there's a student's write-up of the course here:

* Impressions [0]

* Optimizing The Kernel [1]

* The 72-hour bug [2]

* Train Tracking [3]

Notably, QNX started as a CS 452 project.

I'm not too sure about the future of that course. The last I heard (Winter 2019), the professor, Bill Cowan, had decided to stop teaching. Last term, they were clearing out the CS 452 lab and were moving the trains elsewhere. I had wanted to take the course then, but unfortunately the course wasn't being offered, and it was my last term before graduating.

[0] https://www.taylorpetrick.com/blog/post/cs452-impressions

[1] https://www.taylorpetrick.com/blog/post/cs452-optimization

[2] https://www.taylorpetrick.com/blog/post/cs452-72-hour-bug

[3] https://www.taylorpetrick.com/blog/post/cs452-train-tracking

karldingon YouTube was launched as a dating site

It's poking fun at how there's a new flavour of JavaScript framework seemingly every week: Angular, React, Vue, Mithril, etc. Each one has a killer feature or some new spin on how to write your JavaScript code.

The word "vanilla" is used here as an adjective to describe something that is "lacking distinction: plain, ordinary, or conventional" [0].

As such, the joke is that Vanilla JS is being presented as some amazing new framework, but it isn't anything more than regular JS that you would write. In a sense, it's the anti-JS framework, requiring no additional scripts or dependencies.

[0] https://www.merriam-webster.com/dictionary/vanilla

karldingon Facebook, Instagram, and WhatsApp outages

If you frequent small (generally Asian) restaurants, it's quite common to see signs saying they only accept cash in Vancouver. Otherwise, if they take credit, they may attempt to incentivize paying with cash via discounts.

karldingon OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

HN discussion about the 0-day [0].

[0] https://news.ycombinator.com/item?id=20008313