Hacker News Reader

new23don Evaluating Modest SaaS Business Ideas

FWIW, a few months ago we had a prospect ask, and I partially quote, "We don't see any reviews on the AWS marketplace,".

We can see too that most of competitors' reviews are clearly inauthentic. Also, in the B2B space, a public endorsement is infrequently given for various reasons. Being in cybersecurity makes it an awkward ask too - especially after SolarWinds got a lot of flack for publishing their client list on the website [1].

However, it would have to be done - as that prospect has made it clear. We are sticking by our guns though and will get there eventually with genuine reviews. But TBH, the path is not clear.

[1] https://www.theverge.com/2020/12/15/22176053/solarwinds-hack...

new23don 2021 GPS Accuracy Issue Impacting Some Garmin, Suunto, other GPS Devices

Tomorrow Never Dies

So, it can happen.

new23don Amazon still hasn’t fixed its problem with bait-and-switch reviews

Perhaps buyforlifeproducts.com? See submissions about it: https://news.ycombinator.com/from?site=buyforlifeproducts.co...

new23don Netscape Communicator 4, RSA 1024 and SHA-1 in Brexit Trade Agreement

As Prof Bill Buchanan OBE on LinkedIn points out, the Brexit Trade Agreement [1] on Page 921 goes:

The underlying certificate used by the s/MIME mechanism has to be in compliance with X.509 standard. In order to ensure common standards and procedures with other Prüm applications, the processing rules for s/MIME encryption operations or to be applied under various Commercial Product of the Shelves (COTS) environments, are as follows:

– the sequence of the operations is: first encryption and then signing,

– the encryption algorithm AES (Advanced Encryption Standard) with 256 bit key length and RSA with 1024 bit key length shall be applied for symmetric and asymmetric encryption respectively,

– the hash algorithm SHA-1 shall be applied.

s/MIME functionality is built into the vast majority of modern e-mail software packages including Outlook, Mozilla Mail as well as Netscape Communicator 4.x and inter-operates among all major email software packages.

[1]https://assets.publishing.service.gov.uk/government/uploads/...

new23don I3: Improved Tiling Window Manager

Your assessment is accurate. I have realised I may be asking for something that is indeed the _antithesis_ for this project.

For me though, the two monitors are just one screen which I should have total flexibility over. And workspaces are a way to switch context -- to a different set of tasks.

The ⊢ shaped arrangement is the result of a tendency towards more squarish (than wide-screen) canvas. I still manage to find 16:10s (as opposed to 16:9s) in that vain.

new23don I3: Improved Tiling Window Manager

> Implement multi-monitor correctly, that is by assigning each workspace to a virtual screen. Especially make sure that attaching and detaching new monitors like video projectors works during operation and does the right thing. Also provide support for rotated monitors.

My wishlist would be to have this go further and be aware of inter-monitor, relative positioning as well. For example, I use the ⊢ layout (one rotated monitor on the left, one straight monitor right in front) and it's usually an unsatisfactory experience tiling windows for productivity.

Things I do on the vertically oriented monitor on the left are mostly reading documents or watching logs.

new23don Highly Evasive Attacker Leverages SolarWinds Supply Chain

Even Ubuntu's pollinate client takes some liberties. See the article at [1] documenting the info it sends to the mothership.

[1] https://news.ycombinator.com/item?id=25346991

new23don Centos.rip

Any Ubuntu LTS version is solid.

Switch to the LTS kernel as well if you can, i.e. if your hardware does not need the HWE (Hardware Enablement) versions. The HWE kernels are mostly for newish laptops anyway and proper server hardware shouldn't need it.

new23don Improving DNS Privacy with Oblivious DoH

From the CloudFlare blog post:

> A key component of ODoH is a proxy that is disjoint from the target resolver. Today, we’re launching ODoH with several leading proxy partners, including: PCCW, SURF, and Equinix.

new23don Improving DNS Privacy with Oblivious DoH

> ODoH ensures that only the proxy knows the identity of the internet user and that the DNS resolver only knows the website being requested

Who is the proxy here, and who the DNS resolver?

new23don An Airbnb Thanksgiving Burglary

That's an awful lot of kit to take along on a climbing trip, and then to leave behind some of the useful bits in the accommodation.

new23don Improbable Inspiration: Bayesian Networks (1996)

> Then, in the late 1980s--spurred by the early work of Judea Pearl, a professor of computer science at UCLA, and breakthrough mathematical equations by Danish researchers--AI researchers discovered that Bayesian networks offered an efficient way to deal with the lack or ambiguity of information that has hampered previous systems.

The "mathematical equations by Danish researchers", for those interested, are most likely this paper:

Lauritzen, S.L. and Spiegelhalter, D.J. (1988), Local Computations with Probabilities on Graphical Structures and Their Application to Expert Systems. Journal of the Royal Statistical Society: Series B (Methodological), 50: 157-194. https://doi.org/10.1111/j.2517-6161.1988.tb01721.x

Direct PDF Link: https://www.eecis.udel.edu/~shatkay/Course/papers/Lauritzen1...

new23don AMD CPU sales skyrocket with Ryzen 5000 launch, leaving Intel in the dust

No Home/End keys and no webcam. Otherwise I would've been recommending that in this reply from one.

new23don Ask HN: How did you find what you were good at?

These fields align quite well, IMHO. Take, for example, the development and operation of robots cleaning up the Fukushima nuclear aftermath. It is a very, very tricky environment where most normal assumptions of using materials and methods of communication that work in the normal world, don't apply.

new23don Ask HN: Is there space for a new payment gateway?

I will refer you to a tweet from 2 hours before your question here, from Paul Graham himself: https://twitter.com/paulg/status/1333840629936377862

It says, "Every Christmas season, I realize how little progress online shopping has made since the late 1990s. I'm still unsure if the item's really in stock, still typing many characters in forms, still getting my credit card rejected with random opaque error messages."

Make what you will of it, choose wisely and tread carefully. All the best.

new23don Ask HN: ARM laptops that support Linux for every day use?

A Raspberry Pi 400, a portable monitor and a battery pack. Half a laptop for less than half the price.

new23don Ask HN: Unsolved hard problems like protein folding?

There are some interesting challenges at https://challenges.org/take-part/#challenge-list with a prize!

new23don Ask HN: Are you using EC2 metal instances?

Your use-case does not sound like it needs control over C-states and P-states [1].

[1] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/processo...

new23don Ask HN: Why Isn't Paulgraham.com on HTTPS?

The certificate will expire some day and then there will be a huge uproar about it with solutions/advise without knowing the full setup.

new23don Ask HN: Do you drive stick shift?

I drive a manual for the simple reason I enjoy driving like one enjoys a sport. I am much more in control with the ability to shift into any gear just as I've thought about it, and keep it in that gear for as long as I deem necessary.

That brief moment in an automatic where the car figures out you wanted a change kills the experience of the machine being an extension of me.

new23don AWS Network Firewall – New Managed Firewall Service in VPC

Thank you for raising this! I work for a firewall vendor myself and its drives us mad when competition uses the word URL when they can only look at SNI in a TLS handshake. By competition I mean most others are doing it too.

I guess one of the reasons they choose to say URL over FQDN or hostname is that the latter two are less likely what typical developers might venture out looking for - but I could be wrong. At least the requirements when they emerge would want URLs to be whitelisted and that is what the intercepting proxy world had been delivering.

new23don AWS Network Firewall – New Managed Firewall Service in VPC

GCP's built-in firewalling capabilities are quite basic and on par with AWS' Security Groups and NACLs. This new offering is Suricata backed which offers much more sophisticated packet inspection, and is probably built off their recently launched Gateway Load Balancer tech [1].

A key difference is that third-party appliances, and now with Suricata, hostname based (rather than IP addresses) filtering can be applied at the VPC level. This isn't possible in GCP's native offerings.

Disclaimer: I should add that I work for a third-party firewall appliance company myself so have been looking at these developments with a lot of interest.

Although a deep-dive analysis is pending on my side, on the face of it this would seem a security-lite offering as another hacker on this thread has put it. If one were to consider what protocols are supported for hostname based filtering, what depth of checks are run, how ECH/ESNI is handled, and at what level of granularity policies can be attached to individual applications, the offering is a bit underwhelming to say the least. Compare that to our product [2] (on AWS and GCP), and ours is more straightforward to deploy, incorporates the best protocol level decisions already, and has a closer association with individual applications. (You basically stick in the protocol and hostname (even for SSH) in the description field of each Security Group or Firewall Rule.)

[1] https://aws.amazon.com/blogs/aws/introducing-aws-gateway-loa... [2] https://chasersystems.com/

new23don Firefox 83 introduces HTTPS-Only Mode

From intermediate (MITM) caches, yes. But end-clients can still cache it though.

Our market is more backend API traffic so doesn't impact as much.

new23don Firefox 83 introduces HTTPS-Only Mode

Fully support this argument and Mozilla's initiative.

I work for a firewall co and we had taken a strategic decision to not allow plaintext traffic onto the internet (from cloud deployments). It's just lazy on the client or server operator's part to not have it so.

new23don NAT Slipstreaming

If one were to calculate the CVSS score or such for this, it would be pretty low.

new23don Amazon RDS on Graviton2 Processors

Thank you!

Should you be interested in the v2 preview, drop us an email (from your work email) or follow our LinkedIn page.

new23don Amazon RDS on Graviton2 Processors

Several defence-in-depth checks including DNS and protocol legitimacy are carried out in v1, so no it wouldn't just allow ESNI through.

Happy to invite you to the v2 preview if you drop us an email (from your work email) or follow our LinkedIn page.

new23don Amazon RDS on Graviton2 Processors

Yes, just through AWS and GCP marketplaces.

ESNI (now Encrypted Client Hello: https://tools.ietf.org/html/draft-ietf-tls-esni-08) is still in draft.

v1 of the firewall that is currently published ignores the extension but will deny in case SNI is absent.

v2, due in a couple of weeks, will actively seek presence of any of ECH extensions and deny them. This is to prevent domain-fronting style of exfiltration attempts. We expect HTTP Clients in the enterprise to not have moved over to ECH any time soon. However, the firewall has a lot of checks and balances built-in to mitigate this in the future when it arrives.

new23don Amazon RDS on Graviton2 Processors

We have. We are an egress firewall company and have been testing our product on Graviton2, privately, for some time now. The ARM builds will be GA in a couple of months but so far we've concluded that:

1. These offer an excellent price to performance ratio for an egress firewall like purpose because of low instance pricing and high network throughput.

2. For our stack written in C and Rust, any performance penalty isn't noticeable. It's basically a NAT gateway filtering by hostnames for TLS & SSH outbound.

new23don Ask HN: Diamond cutting – any other industries using optimization software?

Logistics.

Lots of research papers I noticed from Chinese universities about a decade ago on how to best package given dimensions and with constraints like what material cannot be packaged alongside what, into containers of given sizes.