HNHacker News
TopNewBestAskShowJobs

somat

6,299 karma · joined December 30, 2021

Runs the outband public shell accounts at https://www.public.outband.net
submissionscomments
somat··on OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
When I set up a client sftp drop I had the luxury of saying "key based access only"

Then it was a surprisingly customer service intensive process to get the keys from the customers. I never did manage to automate it fully. Weird enterprise systems I have never heard of with strange key formats. ssh1 keys, email mangling them. Their internal processes requiring a password.

And way to many "I am sorry but that was the private key you sent me, That key is now compromised and you will need to remove it and generate new keys anywhere it was used"

I almost regret not allowing passwords, almost, despite the headaches key based is still much better.

somat··on OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
Why is wireguards auth better than openssh auth?
somat··on OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
OpenBSD is not affected, so apparently they are doing something right. But also glibc linux is not affected and pam linux is not affected, so it is only musl linux with the remote hole.
somat··on Insects don't swarm at LED lights
I get quite a few insects that fly around a camera, and that is near-ir. So many that a spider finds it worth it's while to build a web in front.
somat··on Nvidia RTX Spark encrypted firmware slows inference speed to 35% on Linux
It's slimy as hell, A person buys a thing, they now own it. However there is a locked box, with no key. The manufacture sells the key to this box for an additional fee. To unlock a thing they already own.

Yeah, Nothing morally wrong there.

somat··on Giant canyon on Mars is still tectonically active
It might be easier, 7k meters down would make parachutes more effective making the landing easier, and if they brought a helicopter friend like the last one it too would fly much easier.

Really the fact that the jpl was able to fly a helicopter at all in mars's weak excuse for a atmosphere was an engineering flex like I have never seen.

somat··on Giant canyon on Mars is still tectonically active
My suspicion is a large space monster, some massive killer from the void ran into mars at one point. The point opposite is where the resulting quake waves converge tearing apart the crust, liquefying the mantle, encouraging a volcano complex.

Also, whatever caused the Noctis Labyrinthus (west side of the valley in the article south east of the volcanoes) is a wild geologic process I don't think I have seen anywhere else. The large valley looks sort of like a rift valley, and erosion canyons are obvious, but Noctis Labyrinthus with it's fragmented plate look is weird, my best guess is a rift valley where three plates are separating, but that is a weak guess.

somat··on Nvidia RTX Spark encrypted firmware slows inference speed to 35% on Linux
It smells like something IBM would do. Coming from small computers where you own it, I was flabbergasted to learn that IBM would ship additional processors and ram with their mainframes but you were not allowed to use them until you paid the additional license fee.

So it is something that has been done for a long time now. Still feels like unethical rent-seeking that should not be tolerated by the customer.

See Also: car companies that charge additional fees for hardware already on the car. Additional services, I sort of understand(remote start via cell network), but stuff like heated seats, that is just wrong.

somat··on Giant canyon on Mars is still tectonically active
The bit of mars that fascinates me is the Hellis Planitia[1] A huge hole roughly opposite the globe from the large volcano complex[2] coincidence.. I think not.

I am vaguely surprised it was not higher rated for a rover mission. 7k meters down should do something interesting to the atmosphere if nothing else.

1. https://trek.nasa.gov/mars/#v=0.1&x=72.07800218650755&y=-42....

2. https://trek.nasa.gov/mars/#v=0.1&x=-116.4913302335018&y=16....

somat··on Fujifilm to boost tape production 5x as AI fuels archiving demand
When I was dealing with tape the main problem was that the drives were very expensive, and they never lasted as long as their expense would have you hope. They have a complex exposed mechanism full of fairly fragile tiny plastic parts.

And for long term archive storage, the main problem is not the media, it is how are you going to read the media. With the drives being considerably more fragile that the tapes. A good plan is to store an entire spare restoration kit with the media. With the understanding it probably will not work when it needs to. So store the really critical stuff printed out so the mark one eyeball can parse it.

somat··on France is getting download tax for content providers (€0.055/GB)
On the subject of gasoline taxes, they are getting increasingly worried about lost revenue from the uptake of electric cars. It is going to be a distance tax I am sure, but what would make sense is to just give the department of transportation the electric tax already existing.
somat··on Infinite Mac: BeOS
I really like the linux solution here. My windows have no titlebar/borders at all. To move a window hold the window key and drag the window from anywhere, to resize hold the window key and right-click drag.

And yes I know it's not really a linux specific thing, but that gets the point across. It is very common on linux. I could twirl my os/desktop hipster mustache and say "my obsd/spectrwm desktop handles no window chrome really well" but then I feel really pretentious instead of only slightly.

somat··on How do you take a picture of a black hole?
The EHT is a remarkable achievement in datagathering and collaboration. But I always sort of wonder, a bit of doubt if you will. seeing as the process(simplified nearly to the point of absurdity) is that of building a image generator based off what we think a black hole looks like then feeding it very vague spectral data and getting it to generate an image. isn't that a huge confirmation bias. That is. of course the black hole looks like simulated ones, that is how the generator was programmed to make them.
somat··on The case of the 9 bit AES key
In my mind rand() (and friends) and hash(thing) (and friends) are almost the same function, with a very similar set of features required, the main difference is that rand() is non-deterministic and hash() is deterministic.

They are so close that people can and often do build rand() as "internal state s = hash(s) return s" (or similar). then other people, wanting that deterministic hash() behavior thus accidentally exposed, build entire worlds(literally) out of rand().

Another problem with this is that the rand() internals are opaque and unknown and can change without violating the spec. hash(), because it is supposed to be deterministic, usually has an exposed stable algorithm.

A specific example. At one job I found they were storing long term customer order archives encrypted where the key was a hash of the date, this in itself is a little suspicious but the archives were offline and physically locked up on site, so not too bad. The real wtf was that the encryption was done on a win98 machine with a perl script that was basically "seed(date); key = rand(); encrypt(data, key)". expecting to regenerate the key if they ever wanted to look at the data. When I saw that I went "I don't know much about perl, but that does not feel stable" and did a few checks. Sure enough the behavior of rand() could change depending on the operating system or even version. making the keys highly dependent on that exact win98 machine with that exact version of perl, I think they ended up using that machine to generate and store all used keys in a database so other machines could decrypt the archives.

somat··on The case of the 9 bit AES key
You could do what openbsd did and tie all the traditional weak psudorandom interfaces into a cryptographically secure one. it will still match the drand48() interface. I still don't think I would use them for secure things but now rand() is actually random. http://man.openbsd.org/drand48

Another pet peeve is when people use the rand() when they want hash() but I will leave that rant for another day.

somat··on About the compromised eMudhra intermediate CAs
AWK is a great little language. But you know how some people get hung up on the useless use of cat, I get triggered whenever I see a grep piped into an awk.

And on the subject of the useless use of cat, I like the form because it makes input a normal command(replaceable by any other command), rather than a shell special form. I sort of wish that "tee" would not default to emitting on stdout to better act as cat's compliment.

somat··on Picasa Photo Viewer Rebuilt for Linux, Project Named Licasa
What are you complaining about, we have XV, which is about as humanly close to perfection as you can get in application design.
somat··on Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs'
The eternal cycle of discovering that engineering is hard continues.

"As soon as we started programming, we found to our surprise that it wasn't as easy to get programs right as we had thought. Debugging had to be discovered. I can remember the exact instant when I realized that a large part of my life from then on was going to be spent in finding mistakes in my own programs."

Maurice Wilkes 1949

somat··on The Quake Fan who built the map editor everybody uses
The unreal method and the quake one are almost exactly the same technically. The level has to be watertight, no leaks from the inside out, even outside areas are actually inside. I suspect for the previs set calculation to work correctly. The editors were both csg brush based and compiled to similar bsp data structures. But in one of those strokes of brilliance where the problem is inverted, the unreal editor devs said "if we start from a solid world and you subtract the rooms you want then you can never have a leaky level" goofy as hell compared to how you think about building things, but it generally worked.

Note, that I never mapped much, but my standard approach was generally to cut a few large rooms out in the general shape of the map(because despite the clever opening if you got too ambitious too quick unreal absolutely would leak like a sieve) then use a mix of add and subtract brushes to make the fine geometry, which was exactly the same as quake maps, large simple rooms to avoid leaks(this time needing to be assembled) filled with fine geometry via adds/subtracts.

This is sort of the early id, Epic engines in a nutshell, id better technically, Epic better tooling and ergonomics.

And a footnote on brushes, because I did not understand this until long after I stopped mapping, A "brush" is a 3d primitive unique from the point,face one commonly used in 3d modeling software. A brush is defined as the convex shape made from intersecting planes. So where for a point,face model you define where the points are and which points form a face, for a brush you define where the face is(point, normal) and what faces are in the brush, the shape comes out of how they intersect. I assume this was because for large simple geometry that you are going to be doing csg operations on the plane model is more attractive than the point model.

somat··on The Quake Fan who built the map editor everybody uses
I never mapped much(more curiosity than real interest) but when I did qoole was always my first choice.

If I remember correctly, it had better csg and a neat method to link planes so they would texture as one surface.

somat··on OBS Studio 33
To misquote the classic about programming languages.

"There are the live video compositors everyone complains about and there are the ones nobody uses."

But really, it is great to see a piece of open source software as the default choice in a field where they tend to suffer, desktop applications.

somat··on Woman charged with computer fraud due to scam CashApp account being in her name
A national id number should have never been considered any more privileged or authoritative than a name in the first place, any business that does so is being criminally negligent.

I mean, that is why they exist, to replace names, or perhaps more accurately act as a surrogate key for names. The government specifically said don't use the SSN as a secret, and businesses did so anyway.

somat··on Woman faces six years in prison over Cash App account she never opened
It sort of makes sense, why would you bring a case to trial that is not complete? A complete case will always win. The trial is the final check if the case is complete.
somat··on ThinkPad I9990303 Error Catch-22
I was trying openbsd and the xhci driver was dropping the external usb drive I had the system on crashing it, The vague hope was that forcing ohci would make the it stable enough to use.
somat··on A Markdown File Should Just Open
This is probably getting into old man yells at cloud territory, but it's markdown... Open it in a text editor. That is the most of point of having markdown, nice looking plain text. typeset text is the side effect, if the point were typeset text I would hope that a better format than markdown was used.
somat··on ThinkPad I9990303 Error Catch-22
I have a GDP pocket laptop that I bricked, I had installed a special development bios with all options unlocked, then, hoping to disable USB3 I proceeded to disable all USB. And a cautionary note, never disable USB on a laptop where all devices are USB. laptop was now completely useless.

First thing I found out was the GDP pocket has no bios clear function(header or equivalent). I found one comment in a forum where somebody also had hard bios problems and was able to reflash it with an external programmer. Worth a try, So I bought a cheap programmer, level shifter, soic clip kit off amazon. and.... nothing was working, at this point not knowing if I was doing it wrong or if the process was even possible I sort of abandoned it. And the carcass sat on the healing bench for a year.

Prompted by the bag of parts on the bench and stumbling on another comment on how miserable shitty cheap soic clips are, I bought a good clip, carefully wired it up, and it flashed first try. plugged the battery back in and the infernal thing booted right up, it still had a charge.

So it is possible to reflash a pc firmware(bios) with an external programmer, probably best to remove the chip, but that is not always necessary. and if it is a soic package, get a good clip, I am happy to name drop Pomona electronics for making a quality product that actually worked and saved my little laptop. https://www.pomonaelectronics.com/products/test-clips/ic-tes...

somat··on PingCap TiDB Leaks
There was a quote from back in early web days that has stuck with me, Still relevant today.

"good opsec will save you from bad crypto. but the converse is not true, good crypto will not save you from bad opsec"

somat··on Whatever Happened to Fire Escapes
A particularly dramatic example of this is Baltimore's Bromo tower https://www.bromoseltzertower.com/about/virtual-tour It was turned into some sort of artist studios, and as a minor architecture nerd i was having fun looking at the floor plans. The two staircases right next to each other confused me. Turns out it is that same requirement to have two independent stairwells and that was probably the least worst place to put them. Still stupid however.

Are the two elevators a code requirement as well?

See also: The Newby–McMahon Building https://en.wikipedia.org/wiki/World's_littlest_skyscraper Where they sort of want to use the upper floors. but it can barely fit one staircase, two would take up the entire floor, a building code quandary.

somat··on eMudhra intermediate CA compromise
> no HSM would ever generate these

You trust the magic black box far more than I do.

My big fear about HSM is that they are inscrutable by design. There is no way to verify they are working as advertised. Plus side, all sorts of fancy hardware to protect your keys. Down side, all sorts of fancy hardware that obscures flaws in the implementation.

somat··on OpenBSD 8.0
It is largely if there is someone interested in maintaining the port. My favorite port is the luna88k an obscure Japanese unix workstation/server from the early 90's. I don't know how common they were in Japan, rare is my guess, and non-existent elsewhere, but there is one(only one as far as I can tell) dedicated Japanese developer willing to put the work in to keep it current. and every release a month or two after the official release he announces that the package build is done(it takes that long on the hardware).

I don't know how many users of luna88k there are, I don't frequent anywhere near the same ecosystem they would, but have never seen one, So from my point of view it is one person making releases for himself and I love that dedication. I don't have, nor do I want a luna88k, but it great that it exists.

So as far as I can tell that is all it takes to have a published obsd port, one person willing to put the work in.

Page 1 of 34Next →