HNHacker News
TopNewBestAskShowJobs

michaelt

39,341 karma · joined June 20, 2012

Greetings from London, United Kingdom! I'm Michael.

http://www.mjt.me.uk

hn@mjt.me.uk

submissionscomments
michaelt··on Woman charged with computer fraud due to scam CashApp account being in her name
> False dichotomy?

Yes, I'm trying to say it's a false dichotomy. There are plenty of other ways you could organise a justice system, many of which would lead to more just results.

For example - a fixed price system. 8 hours wages from the two parties to the dispute buys 30 minutes with one judge and two lawyers. More than enough time to deal with a minor matter like a scratched car. Or if you prefer a continental-style inquisitorial system, you can lose the lawyers and have 90 minutes with a judge. The fees mean judges and lawyers take home 5x the average salary.

michaelt··on Woman charged with computer fraud due to scam CashApp account being in her name
Perhaps there are alternatives other than "small crimes go unpunished" and "people make false admissions of guilt, pressured by the ruinous cost of the justice system, 300 jurors needed for a single trial"

If we've got a Lamborghini justice system, delivering amazing performance to people with a spare $250k and doing nothing for anyone else - some would say that's not the right price/performance trade off.

michaelt··on eMudhra intermediate CA compromise
> users are running 5+ year old system CA bundles, which are not sufficient for connecting to some of the most popular API endpoints out there.

Really?

I was under the impression that when a new CA starts operating, they get their certificates cross-signed by older CAs, to ensure their certificates work on older devices? Lets Encrypt did something like that [1] - although they started operating in ~2015, their certificate chain started with a root valid from October 2000 to October 2021 [2]

After all, many website operators want users to be able to connect even if they're using prehistoric Android versions.

You can access Wikipedia with Android 4.4 which was released 13 years ago [3] (although apparently not on the slightly older Android 4.3)

[1] https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted [2] https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ [3] https://www.ssllabs.com/ssltest/analyze.html?d=en.wikipedia....

michaelt··on eMudhra intermediate CA compromise
Every cert an attacker issues with eMudhra's private key has to appear in the CT logs if they want it to validate in a modern browser.

But if you only want to MITM the connection used by 'pip' to install python wheels - that doesn't check for CT records at all.

michaelt··on Academics have a duty to defend open knowledge systems like Wikipedia
> it's tough to defend when their policies allow factually incorrect content to remain just because it appears on a third-party source that the editors consider reliable.

I feel this is the kind of discussion that would really benefit from a number of concrete examples.

michaelt··on How I got over 300 Tor exit nodes removed
> Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks

The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).

If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.

michaelt··on How I got over 300 Tor exit nodes removed
> The biggest question is still how they got into all those servers in the first place.

The simplest way is to just launch the servers yourself, using a cloud provider. Tor is completely OK with exit node operators being anonymous, and with exit nodes running in cheap cloud data centres.

michaelt··on Ask HN: How to deal with shipping AI-written code you don't understand?
Except in this case the label on the eggs says "Eggs may occasionally be poisonous. Users should not rely on eggs to be safe, and should carefully scrutinise eggs before and during cooking. Bob's Farm accepts no liability for injuries resulting from making omelets with our eggs."
michaelt··on Ask HN: How to deal with shipping AI-written code you don't understand?
I find the problem with "lots and lots of testing" as a solution - (assuming by that you mean lots and lots of automated testing) is it invites lots and lots of lines of code - making code reviews even more challenging.

If someone finds it burdensome to review my 50-line AI-generated bug fix, adding 200 lines of tests only gives them more lines to review.

michaelt··on I electrified my push scooter with a power drill
I used a lower price electric drill to polish some stainless steel, and after a single hour of continuous operation it was never the same again.
michaelt··on Gold is now the top U.S. export
> How many aircraft can the world need that it commonly tops the export chart of the wealthiest country?!

Consider how many American companies exclusively manufacture in the far east.

If a European buys a product "made by" Apple or nvidia or Nike or Levis - that's not an American export, it's an export of Indonesia, China, Vietnam, Taiwan, or wherever. America still gets the profits, though.

michaelt··on Claude reveals ECDSA curve origins
Thank god NIST gifted us Dual_EC_DRBG, so I still have a NIST Elliptic Curve effort I can sneer at dismissively.

RSA was good enough for my grandfather, and it's good enough for me.

michaelt··on BIPM decides to stop adding leap seconds to UTC
As I understand it, almost nobody was actually using UTC anyway.

Almost every programming language and database I've ever used assumes 86400-second days, ignoring leap seconds. And one of the popular ways of applying leap seconds was a 'smear' [1] running every clock slightly fast for about 24 hours, rather than having a 61-second minute.

So instead of UTC we actually all use a slightly elastic timescale with the name of UTC, most of the time aligned with UTC, but with the linearity of TAI, and the desirable property that if I'm going to a concert at 19:00 in a year's time and a leapsecond is announced and implemented in the interim, the concert doesn't change to 18:59:59.

[1] https://developers.google.com/time/smear

michaelt··on Fire at Starlink site in Bulgaria after suspected sabotage in Poland
Bit of one, bit of the other.

If I open something like a stadium, and whenever there's a big game I need a load of security to deal with traffic, drunk fans, and fights - arguably most of the security should be paid for from ticket sales, rather than the taxpayer, although the taxpayer should be there as the final backstop.

Likewise, if I have a bank with a vault full of valuables and I think it needs 3 armed guards present 24/7 - probably that's going to be at my expense, not that of the taxpayer. Although any bank should get a police presence in a reasonably timely manner, once they raise the alarm about a robbery.

michaelt··on How Amazon pushes up prices all across the Internet
At the online retailers I've worked at (not Amazon) returned items get split into a small number of groups.

A person returns a $5000 RTX 5090? A manager will be paged, who will carry it over to the high value items cage, in full view of the CCTV.

A person who returns a $5 bike light? And that person has also spent $$$$ over the years with a 0.5% return rate? Straight on the pallet of mixed returns without even opening the package.

Medium-value returns and customers with an eyebrow-raising return rate get a medium amount of inspection.

michaelt··on AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs
"AI is going to lead to much less software being written" said no-one ever :)
michaelt··on Publishers Killed the Paperback, Then Blamed Readers
https://archive.is/MBOmm

> Beginning in January 2025, the company will stop stocking books regularly, and will instead sell them only during the holiday shopping period, from September through December. During the rest of the year, some books may be sold at Costco stores from time to time, but not in a consistent manner, according to the executives

michaelt··on Codex CLI installs a persistent, self-updating background daemon by default
I've used the CLIs for Codex, Gemini and Claude and they all give off the feeling of being on an very rickety, very fast runaway train.

You install an update. Oops, they added a sandbox that doesn't work inside a docker container, it's stopped working.

You install an update. Oops, you can't log in inside a docker container any more, it's stopped working.

You install an update. Oops, they started catching the copy+paste shortcut and replaced it with one that doesn't work.

You revert a broken update. Oops, the update changed the format of your login details, the old version can't read them, gotta log in again.

You install an update. Oops, can't scroll with the mouse wheel any more.

Not showstopping bugs (if you're used to persuading broken oauth logins to work) but it certainly makes updating an "ugh, what have they broken this time?" experience.

michaelt··on Hackers activate automatic defrosting in supermarket fridges across Europe
Here in the UK, there's a £500 subsidy for home EV charge points... but only if they're connected to the internet.

What could possibly go wrong?

michaelt··on "Robot" Is a Social Construct: Why Your Dishwasher Is Not a Robot
> Also I'd argue that a CNC machine is a robot as well, no different than a programmable industrial robotic arm.

It's true - a robot arm is not so different from a CNC machine.

But a 5-axis CNC is not so different from a 3-axis CNC, a 3-axis CNC is not so different from a laser cutter, a laser cutter is not so different from a vinyl cutter, a vinyl cutter is not so different from a large-format printer, and a large-format printer is no so different from an inkjet printer.

michaelt··on "Robot" Is a Social Construct: Why Your Dishwasher Is Not a Robot
> They react to their environment. That's the classifier.

An industrial robot arm, out of the box, only has internal sensing (joint position, torque etc) and a start/stop button - can't sense the external environment at all.

But I've got a light on my porch that turns on when it gets dark.

By the 'react to the environment' definition the former is not a robot, and the latter is.

michaelt··on "Robot" Is a Social Construct: Why Your Dishwasher Is Not a Robot
I once had a robotics professor who argued any definition of 'robot' broad enough to include roombas and self-driving cars and industrial robot arms (even if made narrow enough to exclude remote-control toy cars, cars with cruise control, CNC mills and washing machines) would inevitably define cruise missiles as robots. Meaning the world had 'killer robots' before we had digital computers.

Instead, he argued the definition of a robot is "I know it when I see it"

michaelt··on A statement on the Tor Project's relationship with Mullvad
I interpreted this as just a clumsy rewording of the old quote, "I disapprove of what you say, but I will defend to the death your right to say it"

Free speech advocates support the right of everyone to set up a stall in the marketplace of ideas, but don't have to support every idea that sets up a stall.

A publisher of gay erotica might support free speech, and find themselves alongside revolutionary communists, hitler-heiling nazis and radical islamists distributing bomb-making manuals - but the groups aren't allies or friends outside of that.

michaelt··on Trump administration is suspending Microsoft from a green card program
Before Covid-19, when you asked tech folks about outsourcing to central American countries (or even within the US to places with lower wages than the bay area), the answer would always be "nothing can replace in-person meetings around a real whiteboard"
michaelt··on GPT‑6 and Intelligent UI for everyone
> Like, the average person who is seeking a recipe needs a photo to know what to shoot for

The menu: Rosemary and garlic roast lamb, Extra-crispy roast potatoes, Honey-roasted carrots and parsnips, broccoli.

The photo: [1] Roast turkey, mashed potatoes, baby carrots, broccoli, brussels sprouts. No lamb, no parsnips.

If you shoot for what's in the photo, you're going to have a bad time.

You're also going to have a bad time when you try to make an apple crumble with no flour, no sugar, and no butter, because they're not on the shopping list.

[1] https://images.openai.com/static-rsc-4/gyzrX8zp3O2KLEPm0FAqh...

michaelt··on Ask HN: How would you feel if we nationalized Google?
The hypothetical situation is a benevolent, honest and competent US government, 100% guaranteed, for all eternity?

That sounds great, regardless of the Google stuff.

michaelt··on ChatGPT is adding real cartoonists' signatures to fake New Yorker cartoons
In this instance the training data was New Yorker cartoons signed by Brendan Loper, and the material presented to the end user is New Yorker-style cartoons signed by Brendan Loper.

To me that seems a exceedingly broad definition of fair use.

michaelt··on Powerless F1 drivers frustrated by Bahrain F1 software glitch
There's more than one type of simulator, and F1 has certain 'spending caps', after a spending war bankrupted bunch of teams.

Wind tunnel time and aerodynamics simulator time are included in the cost cap, as are car parts and most staff (but not driver salaries, travel or marketing)

Drivers can spend all the time they want in standard consumer sim racing rigs, practising the tracks. But when it's the type of extra-high-fidelity simulator that lets you make the car better - that's subject to the cost cap.

michaelt··on Improper redaction reveals Google Data Center water and electricity usage
> I had routinely come across some outlandish accusations made about our water/power usage from the locals. But for obvious reasons I could never dispute them.

It'd be pretty easy for the company to dispel those outlandish accusations - the PR department could just report the true numbers.

michaelt··on Cloudflare OHTTP gateway
https://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(...
← PreviousPage 2 of 34Next →