HNHacker News
TopNewBestAskShowJobs

superkuh

14,397 karma · joined December 29, 2011

If you want to know more you can visit my site at superkuh.com
submissionscomments
superkuh··on Patrick Stewart taught us what good men do with power
It's important to show sometimes Picard is wrong and the institutions are wrong. And how he reacts to that.

One of my favorites is Star Trek TNG s04e22 "Half a Life". It's excellent scifi that doesn't glorify aging and death and even points out that death is bad despite it being tradition in society. It highlights that death is the worst possible outcome. Worse than nearly all potential difficulties or suffering while living. And it's one of the few episodes where Lwaxana Troi is a genuinely good person. Better even, ethically and morally, than the star fleet standard. Better than Picard. It's just a shame the episode retreats from it's message at the end and does not embrace the true morality Lwaxana explains.

superkuh··on Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM (2024)
You're talking about being right on resonance as if it won't help if it's off by 20% of the center frequency. But that's not true. Just like you can use a stumpy monopole whip for 144 Mhz even though it's 6 inches long, and it will help significantly (but behave like an omni capacitive reactance element), so will this not quite right slot antenna mode. There are many ways to excite and feed a slot antenna that do not depend on having the two excitation terminals on each side of the slot. Especially if you're doing it off frequency. Any conductor in the near field is going to couple via induction.
superkuh··on Anthropic's Mythos-class model allegedly leaked on Hugging Face
So the idea would be to use some existing model architecture and model that has been poisoned that will actually be parsable by existing inference software to try to do malicious things if it's run in a harness that allows tool use/etc? On the assumption that the type of person to download and try to run inference with the model would be smart enough to know to do that but dumb enough not to realize that "mythos" architecture wouldn't be in any inference software yet?

A small slice of demographic but I guess it must exist. Most people that would download it would just be looking at the organization of the .safetensor file to figure out the architecture to actually implement inference to run it.

superkuh··on Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM (2024)
Correct. But also, an antenna doesn't have to be exactly resonant at the desired frequency in order to help. You can see this most often in the antennas people use for HF, which to be resonant have to be giant and many meters in size, but instead they use small non-resonant antenna that still transmit enough, even at very low efficiency, to radiate an annoying amount of interference.

Not having a giant slot antenna is a lot better than having a slot antenna. Even if the slot antenna is best resonant at mid-VHF (ie, ~144 MHz which is what many GPU RAMs are blasting at at high current).

And just as important: a huge hole is a hole. Even if it's not acting as an efficient antenna. It's basically an entire side of the case missing.

superkuh··on Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM (2024)
Computers used to come in proper full metal cases. Now they don't. Even when you try to find a metal case for a personal build most cases have giant holes in the side (case windows) acting as slot antennas. And plastic case laptop designs are even worse. Radiated emissions are much easier to achieve at useful intensities these days because of it. Sure, before the conductors going in and out radiated somewhat effectively (and still do). But now even core system components inside are just being let emit without any mitigation.
superkuh··on TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
Add the below rule onto your machine's /etc/ufw/before.rules to mitigate it.

    # CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
    -A ufw-before-input -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
Any value >5 in this field means ip extended header options and so values of 6 through 15 should be dropped. Note that I don't just drop syn packets like the mptcp exploit because any tcp packet could do it in theory.

This works for me on multiple servers and home desktops and my hardware linux firewall/router. I did it a couple days ago when this was first announced. The iptables counter for matches haven't gone up at all on my VPS servers that gets lots of traffic. The counter only goes up when I manually trigger it to test. Everything continues to work nominally with these in place.

superkuh··on Cloudflare Turnstile solver library (no headless browser required)
Anubis is the only anti-"rude corporate http requests amounts" that doesn't only rely on cutting edge javascript VM features. Simple mitigations like the HTML header meta-refresh proof-of-work(waiting) work in all browsers going back 20 years. Rather than just supporting browsers from the last 3~ months like cloudflare.
superkuh··on Breaking the open web won't stop the bad bots
Subheadline: site owners unaware or don't care about humans caught in their "effective" block
superkuh··on CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
Would dropping these specialized ipv4 syn packets with extra header size beyond 20 bytes (as indicated by options value >5) with the firewall be low enough in the order of things to mitigate the attack? Like, iptables -A INPUT -p tcp --syn -m u32 --u32 "0>>24&0xF=6:15" -j DROP ?
superkuh··on Drupal is now light-years ahead of its reputation
This is where the very simple and stable "server side includes" (SSI) that every major webserver has had for 30 years come in. It's just enough templating power to make menu.html and include it in every page you care about without any significant attack surface. Working with static HTML fragments on the filesystem is such a delight compared to any CMS.
superkuh··on We should be more ambitious with the software we build
You know what would be really ambitious? Software that exists in a stable form without breaking for more than 15 years. Truly ambitious would be a stable, non-changing common linux base (like how Nintendo NES emulation target is stable) of packages that just gets supported for decades.

Perhaps that's too ambitious. But it would be of incredible utility not having to re-make the same things over and over in pepertuity with ever more abstraction layers. So much work on computer is just the constant churn and future shock of libraries adding new features which require updates which break other things. I'm tired of building castles on sand.

superkuh··on GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000's cards
Uh, no. This headline is wrong. It's FP32 unlocked from being halved, not 16 bit ops. And to be clear, over the last week I've looked many places and I've not seen any reports of this unlock being applied to any 3xxx card except the 3090/3090ti series. Even if it might apply more generally in theory.
superkuh··on Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown
You say, "Play Protect" as if it is a thing that users can choose to avoid. Or as if it justifies the behavior. I don't think either of those is true.
superkuh··on The Rise and Fall of the Plasma Screen
There's a reason that high speed switching electronics have metal cases. And it's understandable that most people don't know babinet's principle as it applies to RF antenna (basically a hole in a conductor is exactly equivalent to a conductor of that same size and shape: the case window is an antenna). The FCC wouldn't care about me because I intentionally use full metal cases for all my high speed switching electronics and monitor my RF environment from 20 to 3700 MHz over various SDR devices 24/7/365.

I'll grant that a ~meter size slot antenna (case window) is not exactly big enough to be resonant at HF but compromise antennas are the standard for HF and they still work; just because HF propagates so well even at low powers. And lets not forget they such a case window slot antenna is resonant around higher frequencies like ~144 Mhz where the GPU memory is blasting and pulling large currents over long conductors.

If the FCC actually tested a modern computers in their shipped window or completely glass computer cases they likely they wouldn't allow it to be sold commercially. But they're much too busy with politics and as long as it doesn't interfere with military use or high frequency trading they don't care about HF.

Anyway, I do see that no one is disagreeing about the radio intereference caused by plasma TVs. That's good, because they're terrible offenders.

superkuh··on Facebook Pages require paid subscription to post more than two links per month
Understandable stance, re: comments, but this even applies to the descriptions of your own videos. And actually, in comments, I can still sometimes post URLs. So it's not even consistent or applied where it would really help.
superkuh··on The Rise and Fall of the Plasma Screen
Plasma screens, like computer case windows, are incredibly rude but the people using them have no idea that their behavior is inappropriate. Both emit significant amounts of HF radio interference which bounces around the ionosphere degrading a shared resource for all of Earth. And even more VHF and up interference which only degrades a shared resource till the next hill. It's pretty much just like littering in a public park.
superkuh··on Facebook Pages require paid subscription to post more than two links per month
On Google's Youtube to post links (like in video descriptions, etc) you have to pay by adding sellable/monetarily valuable personally identifying information to your account like a phone number and ID. Otherwise even with a google account from 2006 in good standing you can't post links anymore. Attempts to edit old video descriptions with HTTP/S links (from before the policy) also don't work.
superkuh··on How abliterated models can get you pwned
Almost as crazy as running random arbitrary code from unknown third parties automatically. Yet that's the unquestioned status quo for the web and if you don't do it you're considered a weirdo. This is whataboutism, of course, and does not invalidate your claims. But really the only risk comes from the harness that does tool calling, not inference. Just running inference without it is not at all risky.
superkuh··on Drupal is now light-years ahead of its reputation
It's too late. Drupal 6 turned me off ever using a CMS again. Now I purely use html files in folders with other files in folders. It's great. No maintainence burden, no attack surface, no resource eating always running programs or database that can get corrupted or otherwise in a bad state. And especially no migrating to the new version and everything breaking (especially with non-core stuff).
superkuh··on How abliterated models can get you pwned
Nothing about abliteration matters here. Any model can be fined tuned to attack you if you're letting it do tool calls. But I trust a random human enthusiast and community feedback more than I trust a megacorporations that commit crimes without any prosecution or consequences.
superkuh··on Let's Encrypt is adding two additional remote perspectives for domain validation
What we really need form Lets Encrypt is stability and lack of change. But LE is just following the megacorps down the current TLS road. We're already down to only 30 day certs and on the second iteration of acme. Acme original protocol setups no longer work, they were broken by the dropping of support.

Addding new methods of validation does not help nearly so much as just supporting existing methods for more than a few years would. The race to the bottom will end up with an incredibly fragile system that breaks the moment automation does. Combine this with the trend towards HTTP-only and any given website will only have a lifetime of a couple years without direct human intervention. This is a drastic change from the status quo of websites simply lasting forever and being accessible till their webservers stop.

It is 100% a corporate-for-profit-only mindset and architecture. LE is not designing or accomidating human person goals and needs.

superkuh··on Alternatives to animal testing are finally taking off
The massive increases of medical research spending to useful outcomes directly track the decrease in testing in humans and then animals. False positives from doing research in systems that are not the systems the medicine will be used in results in the observed waste and lack of progress compared to, say, the 1950s.

I am not saying we should not have stopped directly testing in humans or animals. But I am saying that the result has been worse outcomes. And any further shifts away from the biological systems that need the medicine (like using computational crap like LLMs) will further increase this disconnect.

superkuh··on Ousted Savannah police officer gave ICE agent husband access to Flock system
So, when are both of these people going to be indicted, have their court hearings set up and face trial for their crimes?
superkuh··on Butlerian Jihad
This wasn't a normal 'article'. It was just a commercial wiki page on a well known topic. And a distasteful 'fandom' one at that. No information there was special or unique to it in particular. The real point was to have URL about the topic to start the conversation.
superkuh··on Zuckerberg's Meta Takes Down No Kings Instagram During Protest Day
What the big social networks provide is the ability to transact money. No distributed non-corporation system can ever provide the money flows that make people use corporate social networks. Or, they can, but the instant they do they're legally attacked and destroyed. So no independent/distributed network can ever really draw those people who make up the majority who are chasing money or following those who chase money. The audience won't exist.
superkuh··on Owner of Former UWS Barbecue Restaurant Indicted for Wage Theft: Manhattan DA
The vast majority of theft is of this type but it is almost never prosecuted.
superkuh··on Butlerian Jihad
I did not. Erewhon is just one of my favorite books so when I see a thread about Dune I tend to talk about it. Normally I'd read the link but this was a generic "Fandom" wiki page and unlikely to be very useful to read.
superkuh··on Butlerian Jihad
More interesting backstory into the name: it's actually a reference to https://en.wikipedia.org/wiki/Samuel_Butler_(novelist) and his 1872 proto-scifi satircal novel: https://en.wikipedia.org/wiki/Erewhon which talks about a society that had a machine intelligence uprising and so banned all complex machines.
superkuh··on Butlerian Jihad
The Butlerian Jihad is a reference to samuel butler's 1872 proto-scifi satircal novel: https://en.wikipedia.org/wiki/Erewhon which talks about a society that had a machine intelligence uprising and so banned all complex machines.
superkuh··on eBay Restricts Listings of Radio Equipment, but Exempts Ham-Band-Only Gear
The problem is that eBay employees are the judge here. Do you think they are going to have enough expert domain knowledge to know the difference? Do you think they will error on the side of banning anything RF or allow things and expose themselves to financial and legal liability?

The end result will be a ban in practice even if the meaning and spirit of the FCC regs would not. Because now eBay is the judge.

Page 1 of 34Next →