HNHacker News
TopNewBestAskShowJobs

om2

2,744 karma · joined August 29, 2013

submissionscomments
om2··on Ofcom concedes defeat in 4chan case
Praising a murderer for committing a murder is not incitement and is protected speech. Under Brandenburg v. Ohio (1969), speech loses protection only if it is directed at inciting or producing imminent lawless action and is likely to produce it. A comment on a murder after the fact can’t meet this standard unless the comment is “go do another murder right now!”

Kimmel also did not praise the murderer. He implied (incorrectly as it turns out) that the killer was right-wing.

Your misstatements of the well-known facts and law in this case cast doubt on the effort you put into researching the other issues mentioned.

om2··on Venom and hot peppers offer a key to killing resistant bacteria
That article doesn’t explain why acupuncture works, just gives a hint of a possible mechanism. It also doesn’t contain any evidence that acupuncture works at all (other than as a placebo).
om2··on Local privilege escalation via execve()
- and + operators have the same precedence. And a similar bug is possible if the operators were the same (both -). So I’m not sure it’s right to blame this on operator precedence or mixed operators. It’s just that, ultimately, the “consume” needs to be subtracted, not added.
om2··on FFmpeg to Google: Fund us or stop sending bugs
> They also have the option to not spend resources finding the bugs in the first place.

The Copenhagen interpretation of security bugs: if you don’t look for it, it doesn’t exist and is not a problem.

om2··on FFmpeg to Google: Fund us or stop sending bugs
The codec is compiled in, enabled by default, and auto detected through file magic, so the fact that it is an obscure 1990s hobby codec does not in any way make the vulnerability less exploitable. At this point I think FFmpeg is being intentionally deceptive by constantly mentioning only the ancient obscure hobby status and not the fact that it’s on by default and autodetected. They have also rejected suggestions to turn obscure hobby codecs off by default, giving more priority to their goal of playing every media format ever than to security.
om2··on FFmpeg to Google: Fund us or stop sending bugs
Nation-states are a very relevant part of the threat model.
om2··on FFmpeg to Google: Fund us or stop sending bugs
In this world and the alternate universe both, attackers can also use _un_published vulnerabilities because they have high incentive to do research. Keeping a bug secret does not prevent it from existing or from being exploited.
om2··on Intent to Deprecate and Remove XSLT
Take it up with the parent of my comment, who compared them directly.
om2··on Intent to Deprecate and Remove XSLT
Implementing it without tons of security bugs is apparently pretty hard.
om2··on Intent to Deprecate and Remove XSLT
It doesn’t scale well to content that changes dynamically on the client side very well. Dynamic manipulation of the post transform XSL-FO is confusing and difficult, retransforming the whole document from source is too slow and loses state. This is a big part of why CSS won.
om2··on Intent to Deprecate and Remove XSLT
Fetch API is a pretty recent addition to the web platform. Back in the day, you could absolutely embed images of stylesheets from ftp: URLs. You could even use it with XMLHttpRequest (predecessor of Fetch). Even further back, gopher: was integrated with the web. URL schemes were invented for the web with the idea that http: is not the only one. These other protocols were really part of the web until they weren’t.
om2··on Intent to Deprecate and Remove XSLT
XSLT is also a really problematic feature from an implementation perspective (albeit in a different way than showModalDialog or MutationObservers).

I’m not a Chrome dev but I think they have decent reasons for going this way.

om2··on Libxml2's "no security embargoes" policy
We have contributed a number of upstream fixes

  $ cd gnome-libxml2.git
  $ git log --oneline --author=@apple.com | wc -l
      43
The main reason we have a fork at all is that upstream libxml2 has broken source and binary compatibility in various ways, and we can't take those changes because libxml2 is public API on our platforms. We do make an effort to upstream all security fixes, though we sometimes get to it only after we ship.
om2··on Missing Matter in Universe Found
The speed of light in a vacuum does not change. The speed of light in a non-vacuum medium can be different than the speed of light in a vacuum, however. And light passing from one medium to another changes speed (and is refracted). See https://en.wikipedia.org/wiki/Refractive_index
om2··on Missing Matter in Universe Found
This study accounts for missing ordinary matter, not dark matter. The linked article makes this clear in the first paragraph. Sometimes I wonder if the first commenters (and often top commenters) on HN read the article at all or just respond based on the headline, because these comments often seem barely related to the actual article content.
om2··on Declarative Web Push
Web Push does have the sound option now.
om2··on Declarative Web Push
It reduces notification display latency because they can be displayed directly by the system services managing push, without having to wait for an opportune time to fire up a service worker process. It does still allow customizing the notification with code, but even in that case, having the declarative notification as a fallback improves reliability.
om2··on Declarative Web Push
Battery friendly because notifications can be coalesced by the OS and processed without having to fire up a full browser engine process and JS VM just to unpack the notification and post a visible notification.

Even in the case where the app needs local processing to show the best notification, having this as fallback removes the risk that the app misses the deadline to display a visible notification and therefore loses its push subscription (which is a behavior Chrome and Firefox have too).

We're also not removing classic Web Push, so web apps can deny themselves the benefits of Declarative Web Push if they don't like it.

om2··on Declarative Web Push
It's standards track and we've had positive signals from Mozilla and Google. Apple is just the first to ship in this case. Are you also mad when Apple is _not_ the first to ship a feature? Is there any way to win?
om2··on Declarative Web Push
In Safari 18.4 (currently in beta) tags are supported and notifications can replace each other.
om2··on Declarative Web Push
iOS and macOS native app notifications already work the way Declarative Web Push does, not like classic Web Push. This is giving web apps the same ability to be battery friendly and more reliable that native apps already have.
om2··on Sets, types and type checking
What’s the difference between a union type and a disjoint union type? In that C# proposal I couldn’t tell which syntax was which branch of your dichotomy.
om2··on Apple Passwords’ generated strong password format
It's not really meaningful to measure entropy of a single password, only of a distribution of passwords. You could assume a password comes from some distribution, but how would you know? Does "grefn" come from a distribution of "pick a 5 letter dictionary word and then randomly change one letter or a distribution of "pick 4-7 random ASCII characters"?
om2··on Mathematicians prove Hawking wrong about the most extreme black holes
At least the way it’s described in the Quanta article, it seems like the mathematicians assumed a charged scalar field, which is not something that exists in nature. All charged particles are associated with spinor (spin 1/2) or vector (spin 1) fields. A scalar field corresponds to particles of spin 0 - the only scalar field we know of is the Higgs field, and corresponding Higgs particle is not charged. If god-like powers include a way to change the laws of physics, then your take holds up, but proving something is possible if the laws of physics were different is not very interesting.
om2··on Statement from Scarlett Johansson on the OpenAI "Sky" voice
There’s more evidence of Altman being personally involved in this incident than in him being personally involved in the OpenAI exit agreement, and he has denied the latter. I’m not sure I believe his denial in the latter case.

Having an NDA in exit terms you don’t get to see until you are leaving that claim ability to claw back your vested equity if you don’t agree seems more severely unethical, to be sure. But that doesn’t mean there’s more reason to blame it on Altman specifically. Or perhaps you take the stance that it reflects on OpenAI and their ethics whether or not Altman was personally involved, but then the same applies to the voice situation.

om2··on Statement from Scarlett Johansson on the OpenAI "Sky" voice
I haven’t hear the GPT-4o voice before. Comparing the video to the video of Johansson’s voice in “her”, it sounds pretty similar. Johansson’s performance there sounds pretty different from her normal speaking voice in the interview - more intentional emotional inflection, bubbliness, generally higher pitch. The GPT-4o voice sounds a lot like it.

From elsewhere in the thread, likeness rights apparently do extend to intentionally using lookalikes / soundalikes to create the appearance of endorsement or association.

om2··on A canonical Hamiltonian formulation of the Navier–Stokes problem
I have tried to teach myself both Hamiltonian and Lagrangian classical mechanics and there’s one mental hurdle I have not been able to get over. The problems are generally set up with starting position and momentum known, and ending position and momentum known, and then the math tells you the path taken along the way. But what if the ending position and momentum is unknown? How does one use these formulations of mechanics to predict the future and not just postdict the past? Is this just how beginner problems tend to be set up?
om2··on A canonical Hamiltonian formulation of the Navier–Stokes problem
> the cost of changing v is p and the cost of changing x is F

I’m sure the equation is right and all but this seems sideways in terms of an intuitive explanation - velocity changes position, and force changes momentum. Force doesn’t directly change position (only indirectly via changing momentum) and momentum doesn’t change velocity, having momentum is consistent with a constant velocity. It doesn’t even make much sense to me to think of integrals as being about “costs of changing”, would that not be a derivative?

om2··on Implementing Vertical Form Controls
They use of horizontal layout is to some extent a chicken and egg problem, since support for vertical writing has been poor in many web browsers.

Vertical writing is often used in books, however, including ePub books that are internally HTML. With good enough support, it would be pretty reasonable to do a vertical layout for a serious news site, and horizontal form controls in the middle of that would likely be out of place. Physical newspapers, magazines, books, and manga in Japan are predominantly vertical.

om2··on Speedometer 3.0: A shared browser benchmark for web application responsiveness
Nothing actually stops the score from going higher than 140, it will just max out the visual dashboard at that point. On Speedometer 2, Safari on M3 Macs ended up over 500. At scores that high it’s harder to have intuition, thus the changed scale of the new test.
Page 1 of 16Next →