Hacker News Reader

throw_a_grenadeon End of Japanese community

Even if not a high level, then s/he had to learn that style of communication from peers in the corp, and the tone is set by managers. It's entirely OK to blame someone who has title “Manager”.

throw_a_grenadeon Ask HN: My family business runs on a 1993-era text-based-UI (TUI). Anybody else?

How do I implement type-ahead in Qt or GTK application?

throw_a_grenadeon HTTPS by default

The problem is not the site, but the network in the middle. On-path attackers typically don't care about which site they MITM in order to inject javascript e.g. to show ads, insert tracking tokens or hijack the browser for other purposes. The site is the vector, not the target.

throw_a_grenadeon PSF has withdrawn $1.5M proposal to US Government grant program

The way how you respond and means of addressing the issue very much matters. It's possible to have equitable objectives, but using discriminatory means. For example, just declaring quota and filling to order will fulfill the objective, but will be very discriminatory in practice.

throw_a_grenadeon I spent a year making an ASN.1 compiler in D

Don't worry, it's your blog, and your way. Keep it up, if it makes you whole.

throw_a_grenadeon Internet's biggest annoyance: Cookie laws should target browsers, not websites

No, this wrong. The law says that by default you can't process personal data, unless the user gave consent. That setting matched both the expectation of users and the default as specified by the law.

The story that advertisers don't know what users selected and that somehow allows them to track the user is disingenous.

throw_a_grenadeon Thieves steal crown jewels in 4 minutes from Louvre Museum

Half yes, probably discarded, but the other half are in company books, because those were accounted as costs of operations. Even then, yes, probably worth it for the time.

throw_a_grenadeon Thieves steal crown jewels in 4 minutes from Louvre Museum

No, they can't, EU courts would strike that in a heartbeat.

Some time ago Germans tried to tax foreign drivers on their roads, so they introduced toll, nominally for all, but also lowered the same amount another car-related tax that was paid only by Germans. EU bodies saw through the scheme just fine and now they're on hook for returning the toll money to anyone still keeping the invoice/receipt.

throw_a_grenadeon Let's Not Encrypt (2019)

> How would it destroy the company?

If you're in business of selling X.503 certs trusted by browsers, then not being trusted by browsers kinda limits the marketability of your product.

I don't believe the browsers could be coerced to not distrust such a CA. In every root program I know there's a clause that membership to the program is at browser's pleasure. (Those that have public terms, i.e. not msft, but I'd assume those have similar language.)

Re: they can just do it, well, I think they'd be distrusted the same.

In Symantecgate one of the reasons for distrust was that they signed FPKI bridge, so I think no CA in the future will sign a subca that will sign FPKI certs.

> Also for example the USA is famous for installing malware on other countries head of state.

Yeah, exactly. I think they have more targeted ways that risk less detection and less collateral damage.

throw_a_grenadeon Let's Not Encrypt (2019)

I don't believe this happens. Should something like this happen, the CA would be immediately distrusted by browsers, not as punishment but to deter state actors. It would give CAs argument, “we won't do it, because it means end of business for us”. Compelling by the state to do something that destroys a company is illegal in many jurisdictions, in the law that prescribes what the state can order employees of the company and what they cannot.

throw_a_grenadeon Let's Not Encrypt (2019)

They just MITMed on the link between the victim and it's immediate next hop, most likely by coercing the ISP (OVH). (See the writeup, where the admin discusses TTL values). No amount of multiview is sufficient if you control the uplink. Both DNS resolution and IP routing worked fine and IP packets were intercepted in attacker-controlled envirenment (on-path MITM box).

What would somewhat help would be CAA record with specified ACME account key. The attackers would then have to alter DNS record, would be harder as you describe. (Or pull the key from VM disk image, which would cross another line).

throw_a_grenadeon Let's Not Encrypt (2019)

> I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load [...]

They can MITM the connection between the host and LE (or any other CA resolver, ACME or non-ACME, doesn't matter). This was demonstrated by the attack against jabber.ru, at the time hosted in OVH. I recommend reading the writeup by the admin (second link from the top in TFA).

This worked, because no-one checked CT.

throw_a_grenadeon Modern Linux tools

On the contrary, that's exactly what “modern” sounds like. I wonder when all those tools will go unmaintained. Coreutils, with all their problems, are maintained since before authors of many listed tools were born.

throw_a_grenadeon CBP Enforces Binary Sex Codes and Enhanced US Passport Validation in APIs

> None of those things are present during a border crossing, for which you want to "pass" a "port".

> but again, why a passport?

Passport isn't only for crossing the border, but to identify for the whole duration of the visit. Travellers don't have national ID documents by definition, and the passport serves this purpose.

E.g. I don't know about your country, but if someone is travelling to my country, he or she is required to keep the passport in the pocket at all times and present to authorities on demand if s/he is stopped on street[1].

So when accessing women-only spaces, like applying for international sports tournaments held in other countries, this will be the document checked.

If you'd like an example involving border crossing, again I don't know much about your country, but if one attempts to cross the border of mine, one of the results might be that you'd be interned in a facility for illegal migrants that for some reason won't be getting political asylum, but can't be deported to the home country either. It would then matter if the person is a man or a woman. Just asking the person is not sufficient, because we can't just allow men to identify themselves into women's wing, as that would violate rights of the women kept there and not free to go elsewhere.

[1] this is contrary to citizens, who aren't generally required to have any ID on oneself, and can just say the name and number if stopped)

throw_a_grenadeon CBP Enforces Binary Sex Codes and Enhanced US Passport Validation in APIs

Based on passport. If co-passenger complains, crew comes and demands travel document.

throw_a_grenadeon CBP Enforces Binary Sex Codes and Enhanced US Passport Validation in APIs

It should be used exactly so you don't have to drop your pants in public to prove your sex, e.g. to access single sex spaces like sport categories. But that requires the field to be filled accurately by whoever issues the document. The fact that this field was not filled accurately led some organisations (most famously World Boxing, but not only) to resort to sex testing. Facing such choice (either accurate data in readily available government-issued ID or SRY test around every corner), I'd prefer the paper document contained reliable data.

throw_a_grenadeon CBP Enforces Binary Sex Codes and Enhanced US Passport Validation in APIs

> But as a deeper question: why is gender even listed on a passport in the first place? Why does it matter for the thing a passport does, letting you pass through a port?

There are certain rights that are afforded only to people of certain sex, ranging from relatively insignificant to very serious e.g. special arrangements needed for women in times of war (they need to be interned separately, if not part of thei families). https://en.wikipedia.org/wiki/Protected_persons#Women . Unless and until we dispense with sex-based rights, there is a need to accurately record person's sex in the identifying document.

throw_a_grenadeon Ryanair flight landed at Manchester airport with six minutes of fuel left

Re: (2): There's a difference between sailplanes and gliders. Sailplanes are gliders that can “soar”, i.e. gain altitude just from the air that is moving up for some reason. Your friends have licence that says „Sailplane Pilot Licence”, not „Glider”.

The distinction is less pronounced nowadays, because there is no mondern aircraft designed as gliders-but-not-sailplanes, but historically there were planes that fit this niche, mostly military transport of WW1 and WW2 vintage.

Passenger jets (with engines turned off) are relatively decent gliders, but incapable of soaring. So no, you can't get more that about 20:1 glide ratio no matter how good is the weather (for sailplanes).

throw_a_grenadeon Canadian bill would strip internet access from 'specified persons', no warrant

Orban is from Hungary, not Croatia.

If you go back in time just 40 years, the countries you did (and didn't) mention, were all governed by communists. With considerable body count. Right-wing regimes in Europe after WW2 have negligible body counts compared to communists, and if you want to include WW2 and pre-WW2 times, then communists are still worse, even if you count all victims of Germany and/or NSDAP, incl. Holocaust/Shoah, towards right-wing violence.

See e.g. https://en.wikipedia.org/wiki/Holodomor

Just because communism didn't happen in your country doesn't mean in didn't happen elsewhere, and there are still some of us who remember exactly what it was and will protest when someone attributes violence and/or authoritarism only to right wing.

throw_a_grenadeon Germany must stand firmly against client-side scanning in Chat Control [pdf]

I'm sorry to pick non-technical details, but this PDF is typeset on „Letter” paper, which is immediately noticeable (different aspect ratio). Normally it's on „yeah, whatever” level, but since this paper (sic) aims to influence European policy, now this detail is actually important.

This whole piece reeks „I'm an 1) outsider that 2) couldn't be bothered to get to know local culture so 3) probably has no stake in the affair” and as such is liable to get dismissed after only cursory glance. We know every single enumerated point above is false, but it doesn't matter. That every single word written on the page is right nd warranted, doesn't matter. @Meredith and anyone else writing papers aimed at EU, would you kindly please switch to A4 before exporting the PDF.

throw_a_grenadeon Tell the EU: Don't Break Encryption with "Chat Control"

Because they don't know better (see also: criminals are stupid).

I think politicians should not be stupid and isolate their official business from the private one. (That would be ideal, anyway).

throw_a_grenadeon Tell the EU: Don't Break Encryption with "Chat Control"

They probably have internal chat systems (cough matrix cough) that don't go above 50 M MAU which afaik is the threshold of applicability of this law. So this particular is a non-issue, unfortunately.

But then it begs the question, why politicians feel the need to use public (>50MMAU) chat systems to conduct the protected (official) business?

throw_a_grenadeon UK, Canada and Australia formally recognise Palestinian state

If you're talking about the image, I think you need to look at the image history itself:

https://commons.m.wikimedia.org/wiki/File:Palestine_recognit... (“File History”)

Just browsing history on MediaWiki will probably show the old tex with recenn image. If you want full article, you'd have to use web.archive.org, archive.is or somethinglike that.

throw_a_grenadeon Native ACME support comes to Nginx

  ExecStart=/usr/bin/python3 -m http.server
  WorkingDirectory=/srv/www

?

throw_a_grenadeon Native ACME support comes to Nginx

I found this: https://github.com/woju/systemd-dehydrated/

It essentially creates per-domain units. However, those are timers, not services, because the underlying tool doesn't have long-running daemon, it's designed to run off cron. So I can't depend on them directly, and I also need to add multitude of dropins that will restart or reload services that use certificates (https://github.com/woju/systemd-dehydrated/blob/master/contr...). Coudn't figure out any way that would automate this better.

throw_a_grenadeon Native ACME support comes to Nginx

Unironicaly, I think having systemd-something util that would provide TLS certs for .services upon encountering specific config knob in [Service] section would be much better that having multitude uncoordinated ACME clients that will quickly burn through allowed rate limits. Even just as a courtesy to LE/ISRG's computational resources.

throw_a_grenadeon Control shopping cart wheels with your phone (2021)

Has several definitions, usually 20 Hz — 20 kHz: https://en.m.wikipedia.org/wiki/Audio_frequency, but sometimes may refer to the range of specific codec (telephony might have something like 300—3400 Hz for example, so not this case). TFA means it as “I have a peripherial readily available”.

throw_a_grenadeon Google admits anti-competitive conduct involving Google Search in Australia

So, iiuc your argument, they're too big to punish by lawful process in democratic countries. Then I argue they should be split up, which is another popular argument.

Where do I sign up to be too big to punish?

throw_a_grenadeon The EU could be scanning your chats by October 2025

European courts, of course: ECJ (so hated by UK), ECHR, and a handful of others judiciary and non-judiciary bodies.

throw_a_grenadeon Known Bad Email Clients

In upstream-unsupported versions, which are bore than 2 years old? Sure it is responsibility of the distro.

Even if it is unpatched upstream, it's perfectly fine to push the fix to master branch only and let distros backport. That's also why the bugs should be filed downstream, and distro maintainers will forward the bug upstream but only if not already fixed (so upstream won't get N duplicate bugs, where N is the number of packages).

At in any case, distro maintainers tend to behave better in upstream bugtrackers.