HNHacker News
TopNewBestAskShowJobs

syn0byte

637 karma · joined August 28, 2018

submissionscomments
syn0byte··on 35-year-old vulnerability discovered in scp
#!/bin/bash

echo "Magic!" echo -en "\033[1F\033[2K" echo "Moar Magic!"

This script will print "Magic!" then the next echo sends escape sequences that move the cursor up 1 line with '\033[1F', then '\033[2K' clears the line the cursor is on, which is now the "Magic!" line. Then we output "Moar Magic". 3 commands but only one line of output.

The -e option on echo enables the escape sequences instead of literal chars. -n disables echos automatic newline for the sequence that deletes the first line

scp servers can of course do all the same trickery.

syn0byte··on System Down: A systemd-journald exploit
1) Devuan isn't a "minimal linux distro" Its a complete fork of Debian. Co-founded by Ian Murdock, Debian's original creator, after the systemD coup.

2) Every "core component" in any system, "minimal" or otherwise, will indeed have had more security review than the systemd code base.

3) Pid 1 - Sponsored by NSA and DoD vis a vis Redhat defense contracts.

syn0byte··on Just a few drinks can change how memories are formed
I was gonna make a sarcastic remark about how O'Douls and other NA beer must be booming business if alcohol wasn't the main attraction...

https://www.brewbound.com/news/brewers-large-and-small-take-...

Joke's on me eh?

syn0byte··on Unprovability comes to machine learning
I think it's just that calling it "maths" tends to give a false sense of certainty where none is warranted.

Example: All the really clever math you use to make an encryption algorithm is all 100% correct. Then all the really clever math you use to show that it would take the heat death of the universe to crack your clever encryption is 100% correct. The user uses 'password' as the key; How does your crypto stand up to a brute force? Is that your algorithms fault? Did your difficulty proof lie to you?

I know key length is a well understood. In terms of how algorithmically "valid" real world data that can otherwise torpedo entire complex systems, it's as good an example as any.

syn0byte··on As oil and gas exports surge, West Texas becomes the world’s “extraction colony”
Plenty of environmentalists all over the place. plenty of people not happy about it. None you will hear about because who would you hear it from? The 9 o'Clock news?(Brought to you by Ford and Chevron.) Even "grass roots" social media platforms; You subscribe to any local Texas groups on twitter/insta/whatever?

Texas is a single state with 4 times the land mass of the entire UK. Do the people Glasgow stop what they are doing, take vacation time and go to protest a new Tesco building over a historical site in London? Likewise people in Houston have little reason and large costs to fight something happening 500 miles away. Nor do they have anything to say about or vote to cast in (almost) any elections that would have (directly) altered policy in the area, which is again, 500 miles(800km) away.

syn0byte··on How a shampoo bottle is saving young lives
And with regulation you get...lots of snake oil this is useless to harmful. Prozac, Phenfen, etc. Even device and equipment makers like Theranos.

You also get Pharma-Bro types selling medication WHO considers "essential" for 750 dollars a pill. Only the one company has(had) the regulatory approval to make a drug so basic Aussie school kids can make in chem class[0].

[0] https://qz.com/851416/why-martin-shkreli-and-turings-darapri...

syn0byte··on OpsMop – Config management and app deployment from the creator of Ansible
DSLs always seem like terrible relationships. Fun and exciting at first but soon she's telling you what to wear, what to say, who you can hang out with, etc. Oh sure, you can "Do what you want", and "It's fine." But you know she will punish you for it later when you least expect it. You would break it off but now you have so much invested she is integrated into your life. Maybe she will mellow out if you "put a ring on it" and buy a support package...
syn0byte··on How the 0.001% invest
I'd love to see Brin's lawyers explain to the court how they found the real world contact info of a random user on HN.
syn0byte··on Everything you should know about certificates and PKI but are too afraid to ask
It "works" only at relatively low values of "work". By that I mean you are fine with various governments having complete control as long as it keeps the 14yo moms-basement sorts at bay.

My complaints with PKI aren't technical difficulty but administrative and bureaucratic. Consider; The NSA issues an NSL for all the root keys to YourCA Inc. Now what?

We would flee PKI like rats from a sinking ship if the capacity for a government to obtain any CAs private keys was written into code. But because its written into policy we simply ignore it.

syn0byte··on A New Connection Between the Gut and Brain
Not for cyanide. It occurs in nature far to frequently for us not to be well suited to clear it. Our bodies even convert it to B12 in some cases. A hand full of nuts (organic, free-range, et al) will likely have more hydrogen cyanide than the anti-caking agent in table salt.

https://www.health.ny.gov/environmental/emergency/chemical_t...

syn0byte··on Linux Kernel Developers Discuss Dropping x32 Support
You can easily truncate or pad to convert between 64-32bit as long as the 64bit end stays in the lower 2GB.

You could do everything else in userspace if you really wanted. At the cost of safety, type handling and optimization from the compiler as all it would see is 64bit pointers being typecast and generic 32bit numeric data. Whatever you were looking to gain would be lost in extra work, and you can forget about debugging. But theoretically...

syn0byte··on Write good git commit messages
You mean "what changes." Consistency dammit!
syn0byte··on Tell HN: Aaron Swartz's website is offline
The big pink elephant; In a lot of cases this is a rational, factual argument with the current system (In the US.)

Feel free to refute the argument's validity with empirical data. I would genuinely love to see it. I've seen apologetic researchers offer reasons for why their data isn't as damning as it seems, but never seen anything remotely close to proof of validity.

syn0byte··on 'Dark fluid' with negative mass could dominate the universe
Lots, we just patch it and move on. Iron orb should glow blue unless this one variable is this one value? "patch it" by calling that one value plank's constant and see, the models still good!

Our math says the universe comes up short on mass by over 3/4ths? Must be invisible matter we can't see or interact with see, the models still good!

Over simplification in the extreme, but also a far cry from the rock solid foundations it claims to be.

syn0byte··on QEMU Advent Calendar: A surprise disk image each day until Christmas
Short Answer: Yes.

Historic(2015) VM escape example https://venom.crowdstrike.com/

I doubt anyone is wasting a good zero-day on disposable qemu netboot images. Someone may try a venom(like) image for 'fun'.

syn0byte··on Backdoor in event-stream library dependency
Are those points not the same for closed source products? "You don't know where the code came from" and "your best indication if its safe is how popular it is."
syn0byte··on Popular dark-web hosting provider hacked, 6,500 sites down
No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30%

At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki.

It's not that you don't know where its hosted, it's that you don't know who is using it or where they are. That includes publishers with hosted content, even from the host itself. 5Eyes couldn't just drop a tap in front of Danial's Host and see anything useful, just intermediate nodes with no idea what was on the other end. (barring a >51% attack where they own the first and last nodes in the circuit.)

syn0byte··on The Media Industry and the “Make-Google-Pay” Fantasy
The one making more "campaign contributions" of course.
syn0byte··on Italy’s olive crisis intensifies as deadly tree disease spreads
"Bertolaso said he was sending the scientists to L’Aquila to carry out “a media operation” in order to “shut up any imbecile,” most likely a reference to Gioacchino Giuliani, a technician at the nearby Gran Sasso physics laboratory who had reportedly raised a series of alarms about impending strong quakes in the weeks beforehand."

Scientists, acting in a public service context, charged with negligence after a natural disaster they dismissed as unlikely resulted in 300+ deaths. That isn't the same as putting scientists on trail for reporting factual but inconvenient data. All their sentences were overturned as well.

https://www.sciencemag.org/news/2016/10/seven-year-legal-sag...

syn0byte··on Elementary OS – Fast, open, privacy-respecting replacement for Windows and macOS
I think its part of that UX consistency you were praising. Vala's got 'nice' coupling with Gnome in the same way C# has 'nice' coupling with the Windows UI.

valac also compiles to C so no weird ABI stuff. No external runtimes or VMs required. I hate to say it but Gnome did something pretty neat with Vala.

syn0byte··on Build a do-it-yourself IMSI Catcher for about $20
Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your targeting a specific person that's as simple as deploying a catcher within range of their home and/or office and chances are good you will get most if not all TIMSI negotiations.

Like trying to stop MITM attacks on the internet by randomizing MAC addresses between sessions. IMSI are printed on a sticker stuck to the phone. How secret can it really be?

Even if TIMSI worked well, there are other techniques: https://arxiv.org/pdf/1607.05171.pdf

syn0byte··on Suicide increasing among American workers
That fact is very likely to be part of the reasons they attempt it in the first place.
syn0byte··on How Smart People Sabotage Their Success
or "Why it's your own fault you aren't successful despite your abilities and skills."
syn0byte··on Japan's cyber-security minister has 'never used a computer'
In a lot of cases it simply isn't feasible today.

Remember; a Denny's waitress in 1980 has as much or more spending power than the medium salary with a college degree in 2018.

syn0byte··on Q: Run SQL Directly on CSV Files
The devil you know; I find myself with the opposite problem on occasion. "If only I could just grep and awk out what I wanted instead of using some contrived query and arcane data connectors"
syn0byte··on Mondelez cuts ties with 12 palm oil suppliers, citing deforestation
In unrelated news; Mondelez launches a new Indonesian agriculture export subsidiary...
syn0byte··on Short-Run Effects of GDPR on Technology Venture Investment
"Negative effects on technology" according to who, by what metric, and what technologies would be stunted exactly?

GDPR isn't going to slow down research projects into new approaches to OS design, or physical hardware development. No one is stopping their generalized AI thesis work over customer data laws.

The entire media coverage of GPDR and to an extent Brexit, seems like big business throwing a tantrum akin to a spoiled child. Flinging themselves on their bed crying that their entire life is over because they can't stay out past midnight.

All these reports are investment graphs and earnings reports. Slight to moderate downturns at a time of record highs in the market. Thinly veiled blackmail and ultimatums by those that have against those that have-not. "Let us do whatever we want or it would be a shame is something happened to your 401k.(or your research grant for that matter)"

syn0byte··on Facebook’s GraphQL gets its own open-source foundation
Generalization of Hanlen's razor: Never attribute to malice what can be explained by laziness/greed/stupidity.

FB has GraphQL stable and doing exactly what they want it to do. Now they can pass it off to a foundation for maintenance and blame without having to pay out of pocket.

syn0byte··on Generating custom photo-realistic faces using AI
Fermi's paradox doesn't need a resolution besides the vastness of space. The concept of such logical extrapolations from a sample size of 1 irritates me to my core.

Devils advocate; I doubt that. "super-stimulating" ourselves into oblivion requires a level of willful complacence we manage to avoid, at least on the whole as a species. Otherwise things like Vegan diets wouldn't be fads because no one would willfully choose crappier food options for the sake of abstract reasons like "ethics" or "morality" that have zero impact on our daily lives.

syn0byte··on Copyright Office Ruling Imposes Sweeping Right to Repair Reforms
I think in cases like this they mean "programming" in the same way we use "cooking". Almost everyone can 'cook' at least a few things but only a few people are actual "cooks".

You could buy a commercial product to do what's fairly trivial (write to a couple of HW registers) that only support select models (because they all have their own registers/addresses). You could also just learn what HW registers are and some general techniques to change them and figure it out for any model that rolls in the shop as you need it. The better mechanics can even extrapolate fixes to completely new but related issues.

← PreviousPage 6 of 7Next →