HNHacker News
TopNewBestAskShowJobs

sebcat

1,241 karma · joined October 24, 2012

Mowgli could not help laughing when the Bandar-log began, twenty at a time, to tell him how great and wise and strong and gentle they were, and how foolish he was to wish to leave them. "We are great. We are free. We are wonderful. We are the most wonderful people in all the jungle! We all say so, and so it must be true," they shouted. -- Kaa's Hunting
submissionscomments
sebcat··on Pypeline: A Python library for creating concurrent data pipelines
Agreed. When it comes to naming things, I really like the way Russ Cox puts it: https://research.swtch.com/names
sebcat··on An adventure in sparse arrays
Observation: The way JS handles "holes" in sparse arrays is similar to how Lua resolves non-existent table entries to nil. This can be interesting when people don't know the difference between pairs, ipairs and for 1, #tbl iterations, when the table contains a nil value and the table indexing (index or key) may be unknown.
sebcat··on C considered dangerous
> But having to explicitly specify both destination and source sizes might prevented a lot of buffer overwrite bugs.

A good way to prevent this is to have a buffer abstraction, where the size is a property of the type, e.g.,

    typedef struct {
      size_t bytes_used;
      size_t capacity;
      void *data;
    } buf_t;

    int buf_init(buf_t *buf);
    void buf_cleanup(buf_t *buf);
    void buf_copy(buf_t *dst, buf_t *src);
    /* ... */
Of course, it doesn't prevent people from using memcpy directly.
sebcat··on IRC turns thirty
> I also want to welcome things like gRPC/Protobuffs over HTTP/2 which introduce really fast comms between clients and servers, sacrificing the visibility of the stream's contents.

Protobufs and similar serialization protocols are great for complex data. It is worth pointing out that we've had ASN.1 for a while and it's pretty fast too, at least for limited subsets of OIDs/types, in certain encodings, though XER or JER would probably not compete with BER.

HTTP/2 is a complex protocol designed to fix problems with the way people build websites today. A lot of its features does not make sense/is not needed for simple message passing.

e.g., some HTTP/2 implementations will probably see HPACK DoS bugs/vulns because HPACK is stateful, whereas if HTTP/2 wouldn't have HPACK that problem would not have existed, but the reason why HTTP/2 has HPACK is because people bloat headers with tons of stuff.

IRC works and works well for its use case. Apart from newline-delimited strings - netstrings and TLV are other examples of formats that can build great, simple and introspectable/open formats.

I'd venture a guess and say that an RFC1459 PRIVMSG message parses faster than a protobuf message carrying the same information - due to parsing an RFC1459 PRIVMSG message is so simple. Of course, if you want arbitrarily sized messages, or messages with an arbitrary number of nested messages inside it you need more complexity.

sebcat··on OpenSSH user enumeration
PoC in subsequent email: http://seclists.org/oss-sec/2018/q3/125
sebcat··on John Ousterhout: My favorite sayings
> I wouldn't be surprised if many older Unixes are still running Tcl/Tk apps.

Or newer. e.g., I use gitk daily at work.

sebcat··on How I Recovered Millions of Transactions Using Tcl (2016)
It is difficult to compare languages with operating systems on which those languages can be executed/evaluated.

On systems that implement them, Tcl can use select, epoll, kqueue for its event notification implementation, as well as pthread_cond_broadcast for threads (if built with thread support).

take a look at:

generic/tclNotify.c - https://core.tcl.tk/tcl/artifact/8804164706c8f2cb

unix/tclEpollNotfy.c - https://core.tcl.tk/tcl/artifact/892b68fa5a7c4c87

sebcat··on The magic of asyncio explained
> i can’s shake the feeling that callback passing and generator coroutines are a fad [...]

Callback passing and coroutines are well known techniques that's been around for a while. Generators are just coroutines that yield to their parent. I remember using these concepts in C and Tcl ~15 years ago[1] and they were well known then. According to wikipedia (citing Knuth), the term coroutine was coined in the late 50's by Conway.

Callback passing and coroutines suits some problems well. Sure there are situations where they do not fit and if people use a hammer for all of their problems they will create new ones. I wouldn't call it a fad, though the techniques may be a bit hyped up in some circles.

[1] I don't remember when Tcl got the coroutine package, that may have been later

sebcat··on The World Economy Runs on GPS. It Needs a Backup Plan
Made me think of an old Phrack article, "Low Cost and Portable GPS Jammer". Worth a read!

http://phrack.org/issues/60/13.html#article

sebcat··on “I'm basically giving myself a permanent vacation from being BDFL”
Lexical scope, I like it
sebcat··on “I'm basically giving myself a permanent vacation from being BDFL”
To clarify: the point I was trying to make was that the explicit 'end' in Lua allows for closures that are more nice (subjective) than Python lambdas. Something both JS and Lua got right, but with which Python ended up with a much more limited syntax.
sebcat··on “I'm basically giving myself a permanent vacation from being BDFL”
OTOH, I would love Python even more if I could do:

    x = function(x) return x*x end
and not use those awful Python lambdas...

Not that it really matters though, bridges still get built.

sebcat··on Testing Memory Allocators: ptmalloc2 vs. tcmalloc vs. hoard vs. jemalloc
For more jemalloc information/context/history/trivia, I would recommend reading the jemalloc paper.

"A Scalable Concurrent malloc(3) Implementation for FreeBSD", Jason Evans, April 16, 2006

https://www.bsdcan.org/2006/papers/jemalloc.pdf

sebcat··on Ask HN: Old CS lecturer looking for advice from current and recent students
I wouldn't want academia to focus on business. That's more technical than academical. If I see a CS (computer "science") course teaching the latest front end JS tech, I would be disappointed.
sebcat··on “It’s Easier To Ask Forgiveness Than To Get Permission”
I think the relationship of power is important here. Reaching consensus among peers is not the same thing as asking for permission from an entity of a superior position of power.
sebcat··on Long-term health risks after having adenoids or tonsils removed in childhood
Had general anesthesia as a kid/pre-teen. Broke my nose, went to the hospital, doctor didn't want me to be awake when fixing it.

Felt very sick and disorientated afterwards. Had swallowed what I at the time perceived to be a lot of blood, which I vomited for one or two days. Couldn't eat, tasted the ice cream twice.

Pretty sure my nose could've been pulled into place without general anesthesia, but maybe that would've been scary too.

sebcat··on Drone Delivery Becomes a Reality in Remote Pacific Islands
The drones would have to be pretty tough to do JIT delivery during cyclone season. Maybe it can be done when the weather is good, provided that it is beneficial to do so.
sebcat··on Signalling System No 7
ASN.1 JER (JSON Encoding Rules) exists, for anyone who wants it.
sebcat··on Sweden ends contract with Elsevier, moving for open access for science articles
> You see the same thing in Vermont, New Hampshire, Maine, Massachusetts, etc.

For comparison, Sweden is about the size of California, with roughly one forth of its population.

> In the US, on average if you want to see a better form of political discourse, you have to move toward more local politics (whether state, county, city, town).

In my experience, local politics tends to be... More entertaining. Maybe because it's a lower barrier for entry.

> Sweden = local politics. It's a small nation. 25% of their population lives in just four cities.

The majority of its population lives outside of the largest four cities. There's a lot of difference between those four cities as well.

sebcat··on Ask HN: How do you continuously monitor web logs for hack attempts?
A WAF will also add an attack surface, just like anti-virus software before them.

Company X, a content publisher, has a wordpress site with a bunch of plugins. They hear that the security record of such a setup is less than ideal. They buy a WAF solution to protect them.

Company Y, also a content publisher in the same space, realizes that they don't need dynamically generated content. They don't need tons of JS. They start publishing static content and what little dynamic functionality they have is well-compartmentalized, with interactions to the outside world carefully audited.

Company Y could also get a WAF, but why? It increases the attack surface, Company Y probably don't have the time/expertise to audit it, it is not clear what benefits it will have.

sebcat··on Origins of the finger command (1990)
> The use of symbols in the code (e.g., "←", which seems to be the assignment operator) is also interesting.

Looks like they had their own character set

[1] https://en.wikipedia.org/wiki/Stanford_Extended_ASCII

sebcat··on Sky Diving Cured My Depression
Skydivers suffer from depression too. It would be interesting to know if skydivers as a group are more or less depressed than non skydivers or people who skydive less frequently. Are the effects the same for someone with +1000 jumps or is it the change in environment/trying new things that is the key to stave off an episode?
sebcat··on Panerabread.com leaks millions of customer records
My (potentially limited) understanding: Certification by an ASV doesn't free you from any responsibilities. You could still violate the DSS even if an ASV clears you.
sebcat··on Wapp – a single-file web framework by the creator of SQLite
> Of course, fork() is not especially fast

fork itself is pretty fast, relatively speaking (unless you have a large virtual address space and 4K pages or similar). fork+execve+process-runtime-initialization is much slower.

On my X201 (anno 2010), with 10000 iterations, sequential fork+exit(0)-in-child+wait takes:

    $ /usr/bin/time ./forkfest
            2,49 real         0,38 user         2,19 sys
while sequential fork+execve("/usr/bin/true",...)-in-child+wait takes:

    $ /usr/bin/time ./forkfest2
           10,99 real         3,10 user         7,94 sys
EDIT: also, My X201 is clocked at 1199 MHz (50%) for power saving reasons
sebcat··on Patriot Missiles Are Made in America and Fail Everywhere
Also: http://www.dsca.mil/major-arms-sales/sweden-patriot-configur...

"The total estimated program cost is $3.2 billion"

The reason for both of these deals seems to be somewhat correlated to Iskander units in Kaliningrad.

sebcat··on Mute uninteresting log noise with machine learning
Yes. Using loglevels/priorities, facilities and identities in a sane way, your logs would already be classified.

Let's say there's a service failure and I want to know what the service has done prior to the failure. I wouldn't want a classifier to filter the logs in that case, so that use case is out of the picture. What other use cases than filtering are there for this? Maybe as a way to provide feedback to developers to fix the log messages, as in "this thing that we log all the time can be determined to never affect the process of trouble-shooting our services, and the classifier thinks it's noise, so we'll remove it".

sebcat··on Ask HN: One tab on Chrome takes about 100MB memory, why?

    $ ldd chrome | wc -l
         124
Shift-Esc is Chrome's own task manager. I don't know how they count.
sebcat··on Ask HN: One tab on Chrome takes about 100MB memory, why?
If I Shift-Esc in Chrome with one tab open, it shows that this tab ("Add Comment") consumes 0 bytes of shared memory and 163 828 kB of private memory.

Current window size is 1280x800. Assuming the render buffer is ARGB32 and assuming one render buffer (which is probably an incorrect assumption) that should be ~40MB. The GPU memory is listed as a separate entry in that view, but I don't know if that is also included in the "private memory" listing.

Going turn off javascript and restart and see what it says then.

EDIT: 164 856 kB w/o JS. So no change (relatively).

sebcat··on Relibc: C Library in Rust for Redox and Linux
musl: https://www.cvedetails.com/vulnerability-list/vendor_id-1685...

Can't find separate listings for libc in FreeBSD, OpenBSD but the list is smaller than glibc if you check e.g., VuXML or https://www.cvedetails.com/vulnerability-list/vendor_id-97/p...

Looks like glibc is the worst sinner here.

sebcat··on History of the browser user-agent string (2008)
At first I though feature detection as in Sobel, LoG, &c, which made me really confused when reading the replies.
← PreviousPage 4 of 14Next →