Hacker News Reader

mhioon Evolving Threat: http2shell is an RCE in node, Python, and more

That was the first exploit logo I can recall

mhioon Can we replace a $150k Looker with a bucket of HTML files?

Can you imagine how much a SAP token will cost though

mhioon Axios compromised on NPM – Malicious versions drop remote access trojan

What does an interceptor in the RequestInit look like?

mhioon Axios compromised on NPM – Malicious versions drop remote access trojan

and for yarn berry

    ~/.yarnrc.yml
    npmMinimalAgeGate: "3d"

mhioon Motorola announces a partnership with GrapheneOS

Cunningham's Law in full effect!

mhioon WinApps: Run Windows apps as if they were a part of the native Linux OS

or a GPU that supports virtualization

mhioon WinApps: Run Windows apps as if they were a part of the native Linux OS

A number of intel consumer CPUs support SR-IOV. The iGPU splits out to 7 "virtual functions" or pci devices to map to a VM. On latest Core Ultra's you need a 2x5 model.

- https://www.intel.com/content/www/us/en/support/articles/000... - https://github.com/strongtz/i915-sriov-dkms

mhioon Every satellite orbiting earth and who owns them (2023)

That generally falls to the International Telecommunication Union globally, as a satellite without a radio is basically junk.

Then maybe the 4(+) countries that can field anti sat weapons beyond that.

mhioon Every satellite orbiting earth and who owns them (2023)

For anyone interested in current data like this, Jonathan McDowell maintains GCAT which is a General Catalog of Artificial Space Objects (and does so fastidiously).

https://www.planet4589.org/space/gcat/index.html

Be warned if you planning to ingest this dataset, the dates are fun =)

mhioon Upgrading an M4 Pro Mac mini's storage for half the price

Toms Hardware usually includes a "Sustained Write Performance and Cache Recovery" test

The test measures the write cache speed and the time to the fall to the native NAND write speed. There are usually irregularities in the sustained write speeds as well.

https://www.tomshardware.com/reviews/wd-black-sn850x-ssd-rev...

The other test I've seen is based on writing and using up free space, SSD performance can drop off as the free space fills up and garbage collection efficiency goes down. I think this impacts random writes particularly

In the enterprise space, drives tend to keep more over provisioned NAND free to maintain more consistent performance. Very early on the SSD timeline, it was advisable to only allocate 80% of consumer drives if you were using them outside of desktops and expected the workload to fill them.

mhioon MCP-B: A Protocol for AI Browser Automation

A playright-mcp server, or any bidi browser automation, should be equally capable of discovering/injecting and calling the same client JS exposed MCP-B site API?

It's like an OpenAPI definition but for JS/MCP? (outside of the extension to interact with that definition)

mhioon Why email startups fail

50% of that is spam that is blocked. At least 50% of the rest is spamish but not spam spam.

So don't feel too overwhelmed!

mhioon Implementing fast TCP fingerprinting with eBPF

https://bpfilter.io/ https://github.com/facebook/bpfilter https://lwn.net/Articles/1017705/

mhioon Show HN: PLJS – JavaScript for Postgres

What are the advantages to pljs over plv8? I thought the context creation would have been the big one, but it doesn't appear so in the current benchmarks.

How did the project weigh the intermittent updates of bellard quickjs and the community fork quickjs-ng?

mhioon Hurl: Run and test HTTP requests with plain text

Yeah...

    [Captures]
    csrf_token: xpath "normalize-space(//meta[@name='_csrf_token']/@content)"

The use the name with mustaches

    {{csrf_token}}

- https://hurl.dev/docs/capturing-response.html

mhioon Building Private Processing for AI Tools on WhatsApp

What's the motive "to gain trust and encourage users to use AI on WhatsApp"? Meta aren't a charity. You have to question their motives because their motive is to extract value out of their users who don't pay for a service, and I would say that whatsapp has proven to be a harder place to extract that value than their other ventures.

btw whatsapp implemented the signal protocol around 2016.

mhioon Doxx/Darkflare: DarkFlare TCPoCDN (TCP over CDN)

The headers are seen by the monster-in-the-middle CDN.

It's obfuscation at best. I'm not sure the encrypted traffic will look particularly php-ish for example. Compressed formats might look vaguely passable.

I can't see any stenography code or libraries in the repo.

mhioon SpaceX Super Heavy splashes down in the gulf, canceling chopsticks landing

The pins/struts are a 2 point system that double as the booster lift points in general operations. The booster mostly hangs in tension which the existing tank structure can support. I would guess they share some of the structure beefiness with the grid fins.

Legs require at least 4 points, probably more. Shock absorption hardware, ability to unfurl to an acceptable width. Require reinforcement (cross bracing) near the base of the tanks to handle the loads pushing inwards toward the center of the tanks.

mhioon Zod: TypeScript-first schema validation with static type inference

How does haxe modify a typescript project pre or post compile?

mhioon Zod: TypeScript-first schema validation with static type inference

Not really - https://github.com/Microsoft/TypeScript/issues/16607.

ts-morph provides an easy way to use the TypeScript Compiler API to view and edit the AST before compile. Once you get your head around the API, which has good examples but isn't thoroughly documented on the web.

https://github.com/dsherret/ts-morph

mhioon React on the server is not PHP

Next.js won't require a Deno backend. You can define backend data fetches [0] along with the UI Pages and routes for an API [1].

Of course the NextJS application could call out to a Deno backend as well, but the external app is not required.

- [0] https://nextjs.org/docs/pages/building-your-application/data... - [1] https://nextjs.org/docs/pages/building-your-application/rout...

mhioon Playing with BOLT and Postgres

Would the profiles and resulting binaries be highly CPU specific? I couldn't find any cross hardware notes in the original paper.

The example's I'm thinking of are CPU's with vastly different L1/L2/L3 cache profiles. Epyc vs Xeon. Maybe Zen 3 v Zen 5.

Just wondering if it looks great on a benchmark machine (and a hyperscaler with a common hardware fleet) but might not look as great when distributing common binaries to the world. Doing profiling/optimising after release seems dicey.

mhioon A few secure, random bytes without `pgcrypto`

gen_random_uuid() produces a v4 UUID.

Taking the first 5 bytes of a v6 UUID (time) and last 5 (node) would be a bad random day.

mhioon We spent $20 to achieve RCE and accidentally became the admins of .mobi

PSL = Public Suffix List

https://publicsuffix.org/

mhioon SQLToy

Why is that? There doesn't seem to be anything particularly esoteric in the implementation.

mhioon WireGuard-rs – Official Rust implementation of WireGuard

Thanks for the info.

Is "lock your toolchain" via rustup? It appears to be the equivalent of rbenv/pyenv/nodenv/asdf etc but part of rust.

mhioon The new PostgreSQL 17 make dist

Debian already had them

https://salsa.debian.org/postgresql/postgresql/-/blob/16/deb...

https://salsa.debian.org/postgresql/postgresql/-/compare/16....

mhioon WireGuard-rs – Official Rust implementation of WireGuard

How do rust projects work over rust versions?

Is rust stable enough from 20-24 that the project would likely remain in a state to compile on a new rust tool chain? Do "Editions" completely solve this?

mhioon Major Xero outage takes out payroll

Related to the AWS us-east-1 issue that has been resolved

https://news.ycombinator.com/item?id=41115094

https://health.aws.amazon.com/health/status

mhioon SQLite: 35% Faster Than the Filesystem

Nope. Triggers and user defined functions don't help across processes either.