Hacker News Reader

pason Iran demands Bitcoin fees for ships passing Hormuz during ceasefire

sure, as the oil wells and the pumping stations and everything not underground, but right now there's not even an option to try. (also loss of a pipe section compared to the loss of a tanker is much better economically, easy to replace, not to mention that there's no loss of life, so ultimately it can bear more risk even if there's an active conflict.)

pason Iran demands Bitcoin fees for ships passing Hormuz during ceasefire

pipelines, railway, etc.

had the US had any real plan to empower the Gulf states against Iran there would already be backup routes

pason Veracrypt project update

> The court ordered Levison to be fined $5,000 a day beginning 6 August until he handed over electronic copies of the keys. Two days later Levison handed over the keys hours after he shuttered Lavabit.

pason Why Switzerland has 25 Gbit internet and America doesn't

finally the coverage is actually increasing ~53% now, +12pp (270k users) during 2025

https://www.berlin.de/sen/web/presse/pressemitteilungen/2026...

pason German implementation of eIDAS will require an Apple/Google account to function

Ukraine also seems to have solved this pretty well. NFC in the plastic card, selfie video confirmation, etc.

Hungary is also rolling out a "digital citizenship" app. (Also can be bootstrapped via newer plastic cards, so no need to visit the government office.)

pason Japanese, French and Omani vessels cross Strait of Hormuz

Brits also voted to leave the EU where they had the absurdly privileged position of picking (almost freely) which rules applies to them, while benefiting from others applying them fully.

...

Democracy is only as good as the people doing the voting, who are about as good (as the rules they don't protest againsts) and the content they consume, which is about as good as certain groups make it to be.

pason Artemis computer running two instances of MS outlook; they can't figure out why

what is old Outlook? for me that's Outlook Express 6 :D

pason Decisions that eroded trust in Azure – by a former Azure Core engineer

yes, so situational awareness is even more fundamental than communication

especially because people hired by people hired by people (....) hired by founders (or delegated by some board that's voted by successful business people) did not get there by being engineering minded.

and this is inconceivable for most engineering minded people!

they don't care because their world, their life, their problems and their solutions are completely devoid of that mindset.

some very convincing founder types try to imitate it, some dropouts who spent a few years around people who have this mindset can also imitate it for a while, but their for them it's just a thing like the government, history, or geography, it's just there, if there's a hill they just go around, they don't want to understand why it's there, what's there, what's under it, what geological processes formed it, why, how, how long it will be there ...

pason Decisions that eroded trust in Azure – by a former Azure Core engineer

https://bsky.app/profile/did:plc:jzhiqz7fb5dj6h7cydluryvn/po...

for anyone else who hasn't seen it

pason Decisions that eroded trust in Azure – by a former Azure Core engineer

matters less than we would like it to

after all startups/scaleups/bigtech companies that make a lot of money can run on Python for ages, or make infinite money with Perl scripts (coughaws)

and it matters even less in non-tech companies, because their competition is also 3 incompetent idiots on top of each other in a business suite!

sure, if you are starting a new project fight for good technical fundamentals

pason Decisions that eroded trust in Azure – by a former Azure Core engineer

and what's with the parents? for running containers?

pason Post Mortem: axios NPM supply chain compromise

what's CAS?

pason Post Mortem: axios NPM supply chain compromise

they can simply make an app that requires tapping a button, so people don't end up with TOTP seeds stored in their password manager on the same notebook where they run 'publish' from

pason Post Mortem: axios NPM supply chain compromise

code becomes trusted by review, but these crowd sourcing efforts to do so fizzled out, so in practice we have weak proxies like number of downloads

the implicit trust we have in maintainers is easily faked as we see

pason Post Mortem: axios NPM supply chain compromise

2FA was mandated by npm

they had 2FA, but likely software TOTP (so it was either autofilled via 1password (or similar), or they were able to steal the seed)

at this point I think publishing an npm app and asking people to scan a QR with it is the easiest way (so people don't end up with 1 actual factor)

pason Post Mortem: axios NPM supply chain compromise

they are cloning Zoom and MS Teams, and try to get people to either copy a script (which is in a textarea that's conveniently too small to show the whole script, and scrollbars are hidden by CSS, and there's a copy button, and when you paste it into the terminal you'll see last few lines, also look innocent, but there's a curl | zsh or `mshta` somewhere in there), download and run a binary/.dmg (and it might be even signed by GoogIe LLC. - the name chosen to look good in the usual typeface used on macOS).

...

it seems the correct muscle memory response to train into people is that "if some meeting link someone sent you doesn't work, then you should create one and send them the link"

(and of course never download and execute anything, don't copy scripts into terminals, but it seems even veteran maintainers do this, etc...)

see Infection Chain here https://cloud.google.com/blog/topics/threat-intelligence/unc...

textarea at the bottom of this comment: https://github.com/axios/axios/issues/10636#issuecomment-418...

pason Why the US Navy won't blast the Iranians and 'open' Strait of Hormuz

ask any Factorio aficionado! the rookie answer is a conveyor belt, the better answer is a railway.

pason Why the US Navy won't blast the Iranians and 'open' Strait of Hormuz

also easier to put some soil over them. MBS for example loves moving lots of sand in a nice straight line!

pason Why the US Navy won't blast the Iranians and 'open' Strait of Hormuz

but if you know there are 3 CIWS, you know they can move the pew-pew pipe at some radians per second this axis, and that axis, you put the drones in a formation to maximize the need for muzzle movement, estimate how many rounds are in them (or how long can they fire before getting overheated)

and send that number + 1 drone.

of course it's a bit oversimplified, but really with decoys, and putting cheap shaped charges on them ... they can fuck up the launch/landing surfaces, the AA capabilities, there's absolutely no way to jam them if they have the "last mile" set to automatic.

(yes, in theory a dumb and big fireball or good old flack can take out a lot of them, seems trivial, but in practice we don't see that, instead we see faster drones trying to intercept them)

pason Why the US Navy won't blast the Iranians and 'open' Strait of Hormuz

what's the connection to the opioid epidemic?

pason Artemis II is not safe to fly

I guess the conclusion is that the manned missions since the Moon landing were for Cold War reasons. (With that kind of mentality.) And when that ended they made even less sense.

For example when they had to go up to refill the wiper fluid on the Hubble in '93 it was no biggie, because as shitty as the shuttle was, it was at least reuse-minded, and there were regular missions (and budget for that). The ISS assembly coasted on the Clinton era budget surplus, but then it was evident that prancing in LEO is great for hijacking Soviet satellites, but not much else.

And compared to the Hubble the JWST was a classic Eminem mission (one shot, one opportunity ... no, wait! that's on Mars!), even if it took 5-10 more years than planned, it seems it was completely worth it.

pason Artemis II is not safe to fly

... so the real problem is that to get back and slow down nicely would require so much more launch mass, right?

(By slow down I mean to change to an orbit that has more drag and wouldn't take forever to return to Earth.)

pason Artemis II is not safe to fly

Safety culture requires the ability to learn from mistakes, the capability to ground planes (without that turning into a political problem), and someone to foot the bill. (Which did not always happen, Boeing MCAS with a SPoF AoA sensor without retraining. A chain of cost-cutting decisions. And of course there were usual problems with market distorting subsidies to both Boeing and Airbus.)

NASA's missions are way too big, because the science payloads are unique, so they "can't do" launch early, launch often. And then things sit in storage for years, waiting for budget. (And manned flights are in an even worse situation of course, because they are two-way.)

And there's too much sequential dependency in the marquee projects (without enough slack to be able to absorb problems if some earlier dependent outcome is unfavorable), or in other words because of time and cost constraints the projects did not include enough proper development, testing, verification.

NASA is doing too many things, and too much of it is politics. It should be more like a grant organization, rewarding cost-efficient scientific (and engineering) progress, in a specific broad area ("spaaace!"), like the NIH (but hopefully not like the NIH).

pason Axios compromised on NPM – Malicious versions drop remote access trojan

pnpm does global + per-repo

pason In math, rigor is vital, but are digitized proofs taking it too far?

there are questions where the abstraction of real numbers becomes leaky, and some axioms (or their lack) poke through.

https://en.wikipedia.org/wiki/Axiom_of_choice#Real_numbers

pason Dobase – Open-source, self-hosted workspace with installable tools

we evaluated them in 2023, because we wanted to move off JIRA, and their name came up, and we did the initial import, and I spent some time trying to understand what's where and how, and the whole experience was lame. it was aggressively confidently pushing its own features (always be upselling!) but the basics were just not there. It's like Microsoft.

We moved to Linear, which is 2 years younger than ClickUp, but it's solid in what it offers.

pason False claims in a widely-cited paper

the hypothesis seems pretty important and interesting, even if hard to study (and hard to classify companies, and sustainability, way too many degrees of freedom, so it would need preregistration, etc)

pason False claims in a widely-cited paper

What's undergrad business faculty? The people who teach undergrads or undergrad TAs?

pason False claims in a widely-cited paper

They could at least send the paper with the reported problems out to a new set of referees.

And just as they decided to take responsibility for publishing, they can take responsibility after a similar review for retraction (or issuing an errata or whatever fancy way they want to signal the result of the process).

pason Miscellanea: The War in Iran

> The analysis I have read point out that this attack actually further legitimizes the regime and takes steam away from internal unrest, especially if Iran comes out on top.

Yes. Unfortunately both things can be true (irreversible decline) and solidified regime due to any external intervention.