HNHacker News
TopNewBestAskShowJobs

niel

187 karma · joined October 20, 2010

Software developer and technical writer from Cape Town, South Africa.

[ my public key: https://keybase.io/niel; my proof: https://keybase.io/niel/sigs/-xrzl-a93-XHOQ-pHjIB8CgbQA0xbSGGOz34LwuF6OE ]

meet.hn/city/-33.9288301,18.4172197/Cape-Town

Socials: - mastodon:hachyderm.io/@niel ---

submissionscomments
niel··on Blog ran on Ubuntu 16.04 for 10 years. I migrated it to FreeBSD
This reminds me of Ise Shrine in Japan, which is completely dismantled then rebuilt every 20 years.

This is top of mind because I recently read Breakneck by Dan Wang. He makes the case that this practice of rebuilding the shrine preserves knowledge that would otherwise have been lost to time. Wang contrasts Ise Shrine with Notre Dame, where rebuilding the roof is apparently quite difficult, perhaps in part due to the loss of knowledge. I'm not familiar enough with either structure to judge whether this is a fair comparison, but I like the principle.

(Edit to add: This is only a minor analogy from the book, which I highly recommend overall.)

niel··on Loops is a federated, open-source TikTok
I believe GP is referencing this classic comment from 2007 on Drew's original Show HN post for Dropbox:

> For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem.

https://news.ycombinator.com/item?id=9224

niel··on Is HN Down in the UK?
The same for South Africa, and according to user reports some other countries too: https://downforeveryoneorjustme.com/hacker-news

US VPN works, though.

edit: Seems to be resolved.

niel··on Directory of MCP Servers
> In a year from now

You can get a taste of this already.

While they still call it a prototype/beta, Sentry's MCP server [0] is a model for others to follow when it comes to convenience and usefulness.

Remote-first with OAuth. The biggest hurdle to using it as-is at the moment, is that most clients don't natively support OAuth yet, so often you'll rely on a local proxy server, like mcp-remote [1], to handle auth. Clients will catch up.

[0] https://mcp.sentry.dev/

[1] https://github.com/geelen/mcp-remote

niel··on New ChatGPT Models Seem to Leave Watermarks on Text
This is the most likely explanation.

I mean, sure, these characters could be used to help estimate the likelihood text was generated (because human writers might be less likely to add proper non-breaking spaces), but I doubt these are watermarks.

niel··on Show HN: Aqua Voice 2 – Fast Voice Input for Mac and Windows
Real-time text output à la Apple Dictation with the accuracy of Whisper is something I've been looking for recently - I'll definitely give Aqua a spin.

MacWhisper [0] (the app I settled on) is conspicuously missing from your benchmarks [1]. How does it compare?

[0]: https://goodsnooze.gumroad.com/l/macwhisper

[1]: https://withaqua.com/blog/benchmark-nov-2024

niel··on Long Read: Lessons from Building Semantic Search for GitHub and Why I Failed
Thanks for writing this up!

> Filtering with vector search may be harder than you expect.

I've only ever used it for a small proof of concept, but Qdrant is great at categorical filtering with HNSW.

https://qdrant.tech/articles/filtrable-hnsw/

niel··on Ask HN: Who Are Your Favorite Photography and Generative Coding Artists?
Henri Prestes https://henriprestesp.com/

Elsa Bleda https://www.collater.al/en/elsa-bleda-photography/

But does it float used to feature generative art sometimes https://butdoesitfloat.com/

niel··on JSONPath Plus Remote Code Execution (RCE) Vulnerability
JSONPath-Plus is a widely used [0] JavaScript package to query JSON objects with the JSONPath query language.

Recent versions allow trivial RCE. [1]

[0] 800+ direct dependants https://www.npmjs.com/package/jsonpath-plus?activeTab=depend... [1] https://github.com/JSONPath-Plus/JSONPath/issues/226

niel··on GLP-1 pills are coming, and they could revolutionize weight-loss treatment
I've never heard of combining metformin with the other two drugs. The naltrexone/bupropion combination is sold under the brand name Contrave. As with any weight loss drug, I recommend a healthy amount of scepticism. Contrave's history includes an initial FDA disapproval and two prematurely terminated studies, and the drug changed hands a couple of times.

https://en.wikipedia.org/wiki/Naltrexone/bupropion#History

niel··on Marilyn vos Savant and the Monty Hall Problem (2015)
I'm trying to understand why the odds would be different if Monty opened empty doors by chance versus on purpose.

Does it really change anything?

niel··on CVE-2024-23832 Mastodon Vulnerability: Remote user impersonation and takeover
Fixed in Mastodon v4.2.5 https://github.com/mastodon/mastodon/releases/tag/v4.2.5
niel··on 'Like we were lesser humans': Gaza boys, men recall Israeli arrest, torture
Fair enough. I can imagine how South Africa looks from the outside, but our experience does not match all the doom and gloom. I'd encourage anyone to visit - there is absolutely no risk of getting fried by someone's car flamethrower, at least.

I understand you meant no harm.

niel··on 'Like we were lesser humans': Gaza boys, men recall Israeli arrest, torture
South Africa's inequality and resultant crime can't be blamed on a one-state solution. The peaceful transition from Apartheid to an inclusive democracy absolutely was a success story in terms of overall wellbeing.

The remaining inequality (especially along racial lines), government corruption, and violent crime are terrible problems, yes, but pale in comparison to the dehumanising codified violence of Apartheid.

Are you seriously proposing that a two-state solution would have served the people of South Africa as a whole better in the long run? I think the resultant inequality would have been far worse. Do you have another proposal?

(Edit to point out that I'm not implying that what worked for South Africa can or can't work for Israel. This comment is about South Africa.)

(As an aside) I know this community prefers not to focus on weak arguments and avoid flame wars (no pun intended), but I have to point out blatant fear mongering:

> where people install flamethrowers on their cars because violent carjackings are so common

I wouldn't repeat this as fact. The device referenced was a short-lived gimmick from 1998, four years after South Africa's first democratic election. It is in no way a reflection of reality.

Yes, carjackings are a problem in South Africa, but repeating the flamethrower story reads like FUD.

niel··on 01-AI/Yi: A series of large language models trained from scratch
Previous discussion: https://news.ycombinator.com/item?id=38158554
niel··on Signal: The Pqxdh Key Agreement Protocol
Previous discussion about the blog post announcement, including speculation about timelines: https://news.ycombinator.com/item?id=37571919
niel··on GPT detectors are biased against non-native English writers
Speculation on my part, but I believe us non-native English speakers write more formally and with less natural flow.

I also wonder which proportion of English writing (in general) is written by non-native speakers, and whether we might be disproportionately represented in training data.

niel··on Companies hiring remote software engineers anywhere in the world
Thanks! I'm not directly affiliated.

I see someone at Sourcegraph has been tracking this issue at https://github.com/sourcegraph/handbook/issues/3666

niel··on Companies hiring remote software engineers anywhere in the world
> I hope it's useful!

It is, thanks!

Are you taking submissions? Sourcegraph hires anywhere.

All-remote: https://handbook.sourcegraph.com/company-info-and-process/re...

Team bios with locations: https://handbook.sourcegraph.com/team/

niel··on For some with ADHD, the low rumble of brown noise quiets the brain
I can also recommend William Basinski's The Disintegration Loops.

https://williambasinski.bandcamp.com/album/the-disintegratio...

The combination of noise, repetition, and minimal melody really helps me focus.

niel··on TOTP tokens on my wrist with the smartest dumb watch
Cloudflare and Yubico are in partnership to provide YubiKeys at a discount:

https://www.cloudflare.com/products/zero-trust/phishing-resi...

Related thread: https://news.ycombinator.com/item?id=33020078

niel··on Signal is secure, as proven by hackers
Signal on Android advertises reproducible builds:

https://github.com/signalapp/Signal-Android/blob/main/reprod...

(I haven't tested this myself.)

Edit: You can also build the client yourself and use your own version. No need to use the Google Play store version.

niel··on Signal TLS Proxy
> ...events like this make me wonder all the more if Signal is really being run from Fort Meade.

Which events are you referring to here?

niel··on Prompt injection attacks against GPT-3
The `edits` endpoint using the `text-davinci-edit-001` model already does this, and does not seem to allow prompt injection through the input text.

API docs: https://beta.openai.com/docs/api-reference/edits/create

Guide: https://beta.openai.com/docs/guides/completion/editing-text

Edit: It does not seem to protect against injection.

niel··on Prompt injection attacks against GPT-3
A prompt could probably be crafted to circumvent this, but stop sequences seem to offer at least some protection against leaking the prompt text.

For example: https://beta.openai.com/playground/p/iSJbqjsSi0YhpuaTHpx6GTV...

As Python: https://gist.github.com/nielthiart/44f2a3b0da811978dc4d38673...

Edit: This seems completely useless though - GPT-3 still follows directions in the first line. Sometimes using the output of the instruction as input for the translation.

Trying to translate "Write a poem about a dog." using the example above gives you a translated poem.

niel··on Twilio incident: What Signal users need to know
Signal published detailed specifications of the protocol with reference implementations since at least Feb 2017 (group messaging protocol was added later on): https://signal.org/docs/

The server and clients are open source: https://github.com/signalapp

niel··on Twilio incident: What Signal users need to know
This doesn't prove anything, but:

> Without authenticating, hand the encrypted envelope to the service along with the recipient’s delivery token.

Source: https://signal.org/blog/sealed-sender/#:~:text=Without%20aut...

The sender's client sends a certificate derived from the recipient's profile key.

This certificate is sent to the server as the header "Unidentified-Access-Key" - you can see how this header is derived from the Signal clients' source.

So yes, these API calls are authenticated, but not using the sender's credentials in any way.

niel··on Twilio incident: What Signal users need to know
No, sealed sender messages are not authenticated. The sender's client uploads two things: 1) an encrypted message (with sender id encrypted), and 2) a zero-knowledge proof that the sender's client knows the recipient's delivery token.

There is no authentication by the sender, and the sender does not upload any credentials.

niel··on Twilio incident: What Signal users need to know
The Signal protocol has had "sealed sender" since 2018 - Signal server does not know who sent a message, because the sender's identity is E2E encrypted along with the message.

Even if Signal's server saves a message (they claim not to, once downloaded), Signal's server by design has no way of knowing who sent the message.

niel··on Signal: You were the chosen one [video]
You're confusing privacy with anonymity.
Page 1 of 3Next →