HNHacker News
TopNewBestAskShowJobs

thephyber

5,732 karma · joined December 29, 2013

Interested in genetic programming, bug bounties, and automation in software. Programming iOS apps these days.
submissionscomments
thephyber··on StackOverflow now gets fewer than 1000 questions a month
I always found that the SO search was frustratingly bad and users NEED to use search to find the authoritative question for your needs.

And even if I find the right existing question, the accepted answer might not be the one I need. Sometimes the question asked accepts the wrong question. Sometimes the current right answer didn't exist at the time of the answer acceptance.

SO was a good first approximation of a good Q&A site. It didn't evolve with the times.

thephyber··on Imagine an AI future where being banned means you are now economically useless
I think this is the core learning of this issue: design your accounts such that if one of your accounts is banned, there is minimal blast damage.

In security / military, this concept is "resilience". Businesses call this "business continuity planning".

thephyber··on US Government is hiding a secret court ruling about how it spies on Americans
> Many people in Congress know that their base is overwhelmingly against this

I have learned that "overwhelmingly against" is a useless concept in politics. The important question is "do they care about it enough to sway their vote?"

There is probably overwhelming support for Ukraine to defend itself in the US (and Europe), but very few people are willing to change their vote based on Ukrainian interests over their own {financial security, culture war, pet issue (abortion, guns, Epstein List, etc)}. If it's not a top-5 issue, it's not relevant to a political campaign.

2A voters and rabid anti-choice voters are polarized enough to actually show up at the capital or threaten their representatives. Extremely few people will dot at for issues lower down the priority list.

thephyber··on Anthropic trained Claude on illegally obtained Stanford professors' books
US Constitution, Article I, Section 8, Clause 8:

> [The Congress shall have Power] To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

thephyber··on Anthropic trained Claude on illegally obtained Stanford professors' books
"Slave labor" doesn't always refer to chattel slavery.

> any coerced or poorly remunerated work. [1]

[1] https://www.dictionary.com/browse/slave-labor

thephyber··on Microsoft and others tell crypto platform not to tokenize their stocks
Did you read the article?
thephyber··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Well did you?

Your comment is irrelevant to mine. I stated what is, while you stated what ought to be.

It's trivial to make any open source repo that nobody uses. It's hard to get people to adopt your library over one supported by one of the world's largest companies.

thephyber··on Imagine an AI future where being banned means you are now economically useless
No.

This article was about a family in the UK.

China social credit score is a government policy which comes with government punishments.

This incident is about Google enforcing contract terms on a Google account.

What we should learn from the story is that consolidation of all services into a single account with a single company means increased harm if any contract violations are enforced.

If you get banned from an airline for violating a company policy, your life isn't over. Flying is a little less easy or maybe a little more expensive / friction. But that's different from the government banning you from flying on any aircraft.

thephyber··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Security is a factor everywhere. And C is everywhere. There's not going to be a "rewrite everything in Rust" project until after there is some legit penalty for selling / offering software in C that could be more secure in another language.

I think Mozilla got it right when they abandoned the effort to rewrite the entire browser in Rust and instead focused on analysis of which modules needed priority rewrites. If a module has historically had zero memory-related bugs, then there are other higher priority things to spend time on.

That said, Google Project Zero should have had Brotli on their radar. Hopefully they still have people and resources.

thephyber··on Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Brotli was a library released by the Google team that developed it. There weren't lots of independent implementations; they were all from the same source code.
thephyber··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Gravitar was super popular for a year or two.

Quit being overly pedantic about how contrived the example is and struggle with the underlying fact that the compression type is negotiated between the client and server. If the compression happens on the HTTP request (as some of the comments here suggest), then the server must use that compression method or it fails to read the body of the request.

thephyber··on Docker is weird
Why?

Python and Go are both memory-managed languages. That is perhaps the hardest part of programming (outside of getting the code to do what is intended).

Go and Rust are both compiled, but Rust requires the developer to figure out all of the memory management before compilation, which slows down development to a crawl.

Almost no company will rationally choose Rust over Go if they know how the development speed tradeoff looks like.

thephyber··on Docker is weird
It's not hard to understand. It's just not rational to anyone who actually calculates how performant it is (very fast, I agree) with how long it takes to write.

Once I realized how difficult it is to write complex code that actually satisfies the borrow checker, I was perfectly happy with writing somewhat slower code in Go or Python.

thephyber··on Woman charged with computer fraud due to scam CashApp account being in her name
I think people underestimate how much the separation of roles matters to the case and to the motivations of the people in each role.

The detectives screwed up by doing a piss poor investigation and identifying the wrong suspect (who is a victim herself in this crime).

The prosecutor cares more about whether they can sell the flawed case to an Arkansas jury or use the low plea bargain cost against the high legal defense cost.

thephyber··on Woman charged with computer fraud due to scam CashApp account being in her name
Plea bargains used to be considered unethical by courts and the Bar in America pre-Civil War.

We have the Reconstructionist South to thank for normalizing turning judges into form stamping Vogons and allowing prosecutors to routinely use a form of blackmail as a normal course of prosecution.

thephyber··on Matthew Prince on why Cloudflare offers a free version and always will (2016)
CloudFlare and the hyperscalers are the reason bandwidth costs have dropped so dramatically.

I remember hearing from a CloudFlare founder not long after they raised an early round how they had to go around negotiating large peering contracts to make enough bandwidth available for their customers. And that Australia was by far the most expensive region because they had very few undersea cables and only a single company providing that access.

End users present like you can always drive up to the gas station and there will always be plenty to fill up your 10-20 gallon tank. But behind the scenes are massive distribution networks and a market making mechanism.

Also I don't buy your premise that illegal video streaming only make money on ads. I'm under the impression they also sell access to a lot of viewer's machines to companies that want to crawl the web and appear to come from lots of residential ISP nodes.

thephyber··on NY announces game ownership bill requiring ownership rather than licensing
Your complaint is probably moot foot dragging. Companies aren't held liable for breaking a law that didn't exist at the time they released a product.

An ever-evolving game with properties of a SaaS would likely not exist under this new law.

Blizzard already knew how to build self-contained products with self-contained expansions even before WoW was released. StarCraft was the original game and StarCraft Broodwar was the expansion. It will affect game release cycles and properties of what you get with the game, but that's seems like part of the point of the legislation.

thephyber··on NY announces game ownership bill requiring ownership rather than licensing
This administration would just say that it is in the national security interest of the US to do the thing. Judges are wary to restrict the POTUS prerogatives relating to national defense, so they won't challenge it.

It's the dumbest and most obvious weakness of our system of government and it will never be fixed.

thephyber··on [dead]
An example of testing the things that are easy to test, not testing the things that are useful to the end user.
thephyber··on 4-hour battery storage is cheaper to install than gas turbines all across globe
I don't know why you're replying to my comment. That comment was only clarifying the parent's conflation of the cost of city land and the cost of cheap arable land.

I don't think local solar is a solution in foggy / cold UK. I'm not going to defend it.

thephyber··on 4-hour battery storage is cheaper to install than gas turbines all across globe
Your parent wasn't talking about prime arable land, they were talking about city land.

The point is the electric delivery problem is much cheaper if the power generation and the power delivery both happen within the same substation (eg in the same neighborhood). If the generation happens in rural Scotland but the consumption happens in London, then all of the transmission needs to be upgraded. The point of your parent's comment was to describe a trick to minimize additional transmission costs/development.

And London area land does cost, even if it is just borrowing a vacant building's rooftop.

I don't necessarily agree with your parent's comment, but I don't agree with your comment either.

thephyber··on 4-hour battery storage is cheaper to install than gas turbines all across globe
Your first 2 paragraphs have a few holes before they will be adopted as easily as you pretend.

Land for solar installs isn't close to free. My condo HOA won't even consider solar for any homeowner and the HOA won't approve a giant $50k/unit special assessment (we can't even get 40% of homeowners to vote for HOA elections... which are free).

Older buildings not designed for a solar roof aren't too easy to retrofit. My office window overlooks 2 parking lot structures that were recently retrofitted with solar and it took about 6 weeks for a relatively simple install. I'm pretty sure building owners will only install if they get a cut of the solar generation revenue (so the land isn't free) or if they are able to use it to offset tax or utility costs (also not free).

EVs as batteries are neat but... (1) most owners will likely splurge only for the $500 charger station not the complex electronics which allow the EV to charge the house/grid and (2) cars are frequently driven / parked at work during the peak charging time, so they would be unavailable to absorb the majority of the peak solar generation time.

Until there is a solar EV + charging story for dense housing (apartments and condos), I think most users in my area aren't likely to be able to adopt like you seem to think. Community Solar projects seemed nearly non-existent when I searched in 2018-2020.

thephyber··on Web Search API
No, the Search API isn't claiming it is taking over a copyright of the original crawled webpage. Quit trying to strawman this thread.

The Search API is acting as a database of a collection of webpages where the collection layer is the copyrightable thing. This is analogous to Google being able to copyright its search engine without having copyrights to all of the underlying content within the search corpus.

If your quibble is about the crawling / scraping, I'm not going to argue. It's easy for mass scraping to fall into unethical / illegal territory and I think that is the original sin of the AI foundation models.

Databases are copyrightable whether their content are facts (one example of content) or other data. I used the word facts because I knew from memory that was protected in US IP law.

Citation: https://www.bitlaw.com/copyright/database.html

thephyber··on Web Search API
Cite your source.

Here's mine[1], stating that yes databases do get some copyright protection from the collection layer to the extent that some creative addition happens.

I never claimed the individual facts/data were given copyright to the collector. Let's stick to what I said if you are going to quibble with my comment.

[1] https://www.bitlaw.com/copyright/database.html

thephyber··on Apple and a hacker's future
> According to haveibeenpwnd, the email address I've used since gmail was invite-only is in at least 39 data breaches.

This is a stupid nihilistic take. Gmail hasn't been breached that many times. Your original credentials from the first breach were passed around from black market to other black market and were repackaged. They didn't get your newest password 39 different times. The black markets are a lot like middle quality data brokers -- they don't actually care if their data is the most accurate or up-to-date.

If your credit profile was completely hovered, that's another story. Credit bureaus are simply a knowledge database and are a massive liability. But my credit hasn't been similarly destroyed so there is likely another major variable between our risk profiles. Maybe your physical mailbox has been breached multiple times.

Security hygiene is a lot like physical hygiene. You just need a few rules and you are mostly good. Don't sleep around too much, choose your partners wisely, and use protection when you do find a new partner until you both trust each other enough.

As it pertains to Meta, nobody should trust this company after what they did with iOS contacts on the original Facebook app.

And nobody needs to use Muse. You aren't opting out of society on a Unabomber level if you choose not to use this one AI agent app by a less than trustworthy company.

thephyber··on Web Search API
You do realize that US IP law does work that way, right?

You can have a copyright of a collection of facts even if you don't have a copyright of each individual fact in the collection.

thephyber··on Micron CEO Says Memory Supply Will Be Much Tighter in 2027 and 2028 Than in 2026
Welcome the Abundance Agenda. There are entire books being written about how we need to streamline the bureaucracy and policies to actually accomplish the goals of the environmental movement, not just create a self-licking-ice-cream-cone of Vogons, forms/checklists, and tit-for-tat lawsuits.

Your concern, while well intentioned, is a red herring. At best it can highlight that enforcement of negative externalities is imperfect, but then again everything is.

thephyber··on Micron CEO Says Memory Supply Will Be Much Tighter in 2027 and 2028 Than in 2026
No, this is not an issue.

A "SuperFund Site" specifically exists because the previous company no longer exists in a form that any assets can be extracted from the legal entity. There's no point in suing something which can't pay damages. It's not just "a business with a toxic piece of land". The term "SuperFund" means the EPA has taken over the responsibility of managing the cleanup after the previous company is gone (eg. The legal entity split off some of their their albatross debts/liabilities such as toxic land that no longer can be used for revenue onto a disposable company that they spun off)

Also land doesn't come with a warranty when it is transferred. So long as the previous owner disclosed all of the relevant information about any hazards known to the seller that is legally required, the old owner is off the hook. If you sell a house with lead paint which was built on landfill that exists near high voltage power lines and the seller described those facts in the escrow period to the buyer (usually in a mass of paperwork), you can't be held liable if the buyer's family develops health issues in that house.

Please don't try to speculate yourself into non-existent legal scenarios.

thephyber··on The Philadelphia Inquirer built Scrape, an AI tool to surface hyperlocal news
Agree that the permutation becomes a problem, but the organization should be super simple: the state mandates the use of some standard index file format for all municipalities governments, not unlike how sitemap.xml works for a website index.

There is a community-run project that standardizes each election's results across states, counties, and precincts. It could be a template for local info releases.

thephyber··on Micron CEO Says Memory Supply Will Be Much Tighter in 2027 and 2028 Than in 2026
If only we didn't have 100+ years of factories shitting where we eat we might not have thousands of governments wanting assurances that companies don't harm people in their area.

Silicon Valley is littered with SuperFund sites of bankrupted companies who conveniently couldn't afford to clean up the toxic mess they left behind when they became the vessel full of debt after the corporate shell game moved on.

Page 1 of 34Next →