Hacker News Reader

thrwaway1985882on AI fakers exposed in tech dev recruitment: postmortem

> So much this. It's not news this is a thing, it's a problem of a cost -- if there is not way to remotely id a person, remote company has to pay for a flight ticket and is at disadvantage compared to competitor who hires locally when it comes to hiring costs.

As long as the fully loaded ongoing cost of remote workers is lower than the fully loaded cost of in-person workers, you'll still come out ahead to send people an airplane ticket, hotel room, and meals. And long term I fully expect remote hiring/identity validation as a service companies to emerge.

thrwaway1985882on Meta claims torrenting pirated books isn't illegal without proof of seeding

Anybody can sue anybody, and this someone in your example would likely have standing, so why not?

A single person self representing against a company that is essentially one of the largest law firms on the planet, and can outspend them tens of thousands times over - what's to be gained?

thrwaway1985882on Obscura VPN – Privacy that's more than a promise

I'm bearish on introducing noise[0] to resist traffic analysis, and I'm exceptionally bearish when the only layer managing noise injection is "a for-profit entity that can be legally compelled to do things"

But every layer helps; I'd feel more than happy torrenting over Mullvad alone, and I'd definitely use it as an additional layer of defense with other tools to keep me private if my threat model needed to consider stronger risks.

[0] https://news.ycombinator.com/item?id=43109903

thrwaway1985882on Obscura VPN – Privacy that's more than a promise

> That does not mean there aren't serious drawbacks that are more worth pointing out such as why bother with a very complex and noisy backdoor when you can just covertly create enough nodes to do traffic correlation.

Winner winner chicken dinner.

FVEY's annual budget is $1.7bn + $1bn + $122mm (NZ :3) + $4.6bn + $classified billion.

You think those guys can't mount a Sybil attack against https://metrics.torproject.org/ ?!

thrwaway1985882on Obscura VPN – Privacy that's more than a promise

Some of the prior works in this paper[0] address noise in anonymity networks, but in general: you either add noise at the link level which malicious nodes can identify & ignore, or you add noise by injecting fake chaff packets that are dropped somewhere inside the network which are statistically identified when you look at packet density across the network.

This might or might not extend to VPN nodes depending on your threat model - I'd personally assume every single node offered to me by a company in exchange for money is malicious if I was concerned about privacy.

[0] https://www.cs.utexas.edu/~shmat/shmat_esorics06.pdf

thrwaway1985882on Obscura VPN – Privacy that's more than a promise

Synchronous packet transfer only solves the problem if you build a truly constant rate network. Traffic monitoring works when variances exist; your flow has to be fully homogeneous to provably secure against it. That means in your model your users would need to transmit and receive exactly 96kbps at all times when on net, and your nodes would talk to each other at 1024kbps at all times when on net. Otherwise, consider A->onion1->onion2->B – an attacker could potentially see the flow from onion1->onion2 decrease to 1 PPS sec when A isn't talking, and increase when A is.

Truly constant rate anonymity networks dramatically add resistance to passive traffic analysis, but they move users from a low-latency/high-throughput network to 56k dialup speeds :) Not only does this suck so most people won't use it, but the people who do chose to use it will glow neon bright to adversaries. The use of the system will be a strong indicator that, even if you don't know what the user is doing, the user is doing _something_ interesting.

And even if there was desire, these networks are intrinsically limited in size and scale if they want to maintain constant rate. Herbivore[0] is an interesting proposal in this space - use a DC-net partitioned into smaller cliques to give in-group anonymity but mass participation. And most use chaff packets – A has nothing to send so sends encrypted random data to maintain the constant rate guarantee... I'm trying to find the paper I read that suggests a global passive adversary who goes "hands on" in the network could use a combination of watermarks generated through packet dropping/artificial queues + knowledge of which packets are chaff to build a trace, but I'm struggling. If I do I'll drop it here.

For fun, go check out https://groups.google.com/g/alt.anonymous.messages – this is probably the classic example of a (very) high-latency but very strong anonymizing mix network.

[0] https://www.cs.cornell.edu/people/egs/papers/herbivore-tr.pd...

thrwaway1985882on Obscura VPN – Privacy that's more than a promise

The threat actor most use to talk about this is a global passive adversary: a threat actor who can see all relevant traffic on the Internet but who can't decrypt or adjust the traffic.

This adversary would have the ability to ingest massive amounts of data and metadata[0] it acquires from tier 1 ISPs all over the country[1] and the world[2]. They'll not see raw HTTP traffic because most everything of interest is encrypted, but can store and capture (time, srcip, srcport, dstip, dstport, bytes).

From there, it's a statistical attack: user A sent 700 kilobytes to a VPN service at time t; at t+epsilon the VPN connected to bad site B and sent 700 kilobytes+epsilon packets. Capture enough packet flows that span the user, the VPN, and the bad site and you can build statistical confidence that user A is interacting with bad site B, even with the presence of a VPN.

This could go other directions too. If bad site B is a Tor hidden site whose admin gets captured by the FBI and turns over access, they'll be unmasking in reverse – I got packets from Tor relay A, which relay sent packets at time-epsilon to it, (...), to the source.

There's very little you can do to fight this kind of adversary. Adding hops and layers (VPN + VPN, Tor, Tor + VPN, etc.) can only make it harder. It's certainly an expensive attack both in terms of time consumption, storage, and it requires massive amounts of data, but if your threat model includes a global passive adversary, game over.

[0] https://en.wikipedia.org/wiki/XKeyscore

[1] https://en.wikipedia.org/wiki/Room_641A

[2] https://en.wikipedia.org/wiki/FVEY

thrwaway1985882on The Mythology of Work (2018)

You did it, you posted the meme.

https://thenib.com/mister-gotcha/

thrwaway1985882on I do not want AI to "polish" me

I've only recently started using AI, and have discovered my use or rejection of it is predicated on my feelings for the task. This argument of "authenticity" really resonates.

I'm a manager, so when I'm sending emails to a customer or talking with one of my reports, I care deeply - so you might get some overwrought florid prose, but it's my overwrought florid prose.

On the other hand, I have to lead a weekly meeting that exists solely to provide evidence for compliance reasons, something out of the CIA's sabotage field manual that David Graeber has probably written about. But is now a thirty second exercise in uploading a transcript to ChatGPT, prompting for three evidentiary bulletpoints, and pasting the output in a wiki no human will ever read.

thrwaway1985882on NSA can track powered-down phones

Squint enough and you'll see a cellphone consists of two primary chipsets: a main SOC/stack that runs the operating system, and a modem/software stack that pushes cell packets. Power the phone down and you (may) fully shut down the OS/processor; you likely aren't powering down the modem.

thrwaway1985882on 0-click deanonymization attack targeting Signal, Discord, other platforms

"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW.

But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an individual. Neat attack!

thrwaway1985882on Hey, wait – is employee performance Gaussian distributed?

The vast majority of underperformers I've managed are people who are less motivated to perform, less technically skilled, not aligned to the team, have different values, etc. Almost always the answer is to keep them around and try to squeeze what value you can get. One engineer I have really values on-call firefighting which is great, except my entire org is aligned around avoiding that. I'm getting value out of him by letting him do the firefighting he likes, but ensuring he drives the postmortem process so we can avoid fires in the future.

At the end of the day, all I care about is getting an acceptable level of output compared to pay from an employee who knows the business and isn't particularly fussy. So I'll try to find the path to get low performers upskilled, find what interests them, or find another role in the company that fits & do some horse trading. Or I'll let them coast and replace them when it's easier for me to hire.

>> hiring is a goddamn mess right now.

> Any insight you can give on why? I know enough from the hirees end, but how's it on the other side?

Someone smarter than me might know the true answer. I've heard three compelling arguments:

* tons of companies were irrationally exuberant and overhired, cut roles, and now we're seeing the impact of those workers looking for new work

* increasing shareholder greed means running a threadbare team and driving the company into the ground is better than staffing appropriately if it means next quarter looks good

* most companies are big dumb herd animals and hey, if the big guys are downsizing, so should we

But even though the market is saturated, profitability is now king, so if I'm going to hire someone I need to have a compelling answer to finance saying "how does this new role guarantee us ROI?"

All I really know and can see is the knock-on effect: I posted the same role in 2022 and last month. In 2022, I had to recruit like crazy, to the point that I had external vendors placing below-average employees at above-average salaries. Last month I had the pleasure of sifting through 700 applications, and plenty were "pass: overqualified, won't stick around".

So it seems there are tons of people out there competing for fewer roles.

thrwaway1985882on Hey, wait – is employee performance Gaussian distributed?

> However, deliberately keeping low performers around as a buffer becomes a self-own on a longer time horizon. Smart managers will negotiate hiring exceptions to replace a low performer now rather than keep that headcount occupied for safety.

This is a "the times are good" play, and it can absolutely work. But the real trick is understanding

> Once a company institutes a hiring freeze

that if you as a manager are reacting here, the die is already cast. There are plenty of unofficial "we're frozen but aren't saying it out loud" moves I & peers in other companies are seeing right now: downleveling, additional approval gates added to slow things down to a more favorable time, you name it.

Yes, over a long enough time horizon ballast will weigh down the boat, but theta is on my side right now.

thrwaway1985882on Hey, wait – is employee performance Gaussian distributed?

This is a great point. Toxicity is entirely orthogonal to performance. And you rarely have to worry about toxic low performers: if you're unlucky enough to hire them, they don't stay around for long.

But toxic top performers are IME one of the biggest challenges a manager will have to deal with. You have to root them out the moment they land in an organization because given enough they'll push out the non-toxic top performers, leaving you with a toxic asshole and a bunch of flunkies. And you have to convince everyone outside the team that yes, they get things done, but they're enough of an asshole that you'd rather risk hiring someone to deliver less but also destroy less.

All this reminds me of the quote attributed to everyone under the sun (Clausewitz, various US civil war generals, Omar Bradley, you name 'em) but apparently was said by Kurt von Hammerstein-Equord[0]

> There are clever, hardworking, stupid, and lazy officers. Usually two characteristics are combined. Some are clever and hardworking; their place is the General Staff. The next ones are stupid and lazy; they make up 90 percent of every army and are suited to routine duties. Anyone who is both clever and lazy is qualified for the highest leadership duties, because he possesses the mental clarity and strength of nerve necessary for difficult decisions. One must beware of anyone who is both stupid and hardworking; he must not be entrusted with any responsibility because he will always only cause damage.

Turns out this problem is quite old, indeed.

[0] https://en.wikipedia.org/wiki/Kurt_von_Hammerstein-Equord#Cl...

thrwaway1985882on Hey, wait – is employee performance Gaussian distributed?

> The second mistake they made is assume that companies would prioritize being lean and trimming the mediocre & bottom 5%. There are other considerations, combined productivity is more important than having individual superstars working on the shiniest features.

I'll add a perverse incentive too that I've talked about elsewhere – hiring is a goddamn mess right now.

If I trim the bottom 5% of my org (in my case, 2-3 engineers), I may not get a backfill for them. Or I'll have to drop their level from L5->L4 to make finance happy, or hire overseas or convert a FTE to a contractor.

I also have to be ready for the potential of RIFs happening, which means having an instantly identifiable bottom 5% puts me at the advantage of being ready when my boss says "give me your names".

So the time value of a staffed engineer is way higher right now than it might be in a few months. It'll never be zero, because proactively managing people out makes all of our managers happy. But for now, I definitely need my low performers.

thrwaway1985882on Netflix buffering issues: Boxing fans complain about Jake Paul vs. Mike Tyson

> the manager said there were some layoffs coming up and he would have been out with those but because of the way things worked it didn't make sense to let him go earlier.

Incentives are fucked across the board right now.

Move on a low performer today and you'll have an uphill battle for a backfill at all. If you get one, many companies are "level-normalizing" (read: level-- for all backfills). Or perhaps your management thinks the job could be done overseas cheaper, or you get pushed to turn it into a set of tasks so you can farm it out to contractors.

So you keep at least some shitty devs to hold their positions, and as ballast to throw overboard when your bosses say "5% flat cut, give me your names". We all do it. If we get back to ZIRP I'll get rid of the actively bad devs when I won't risk losing their position entirely. Until then, it's all about squeezing what limited value they have out and keeping them away from anything important.

thrwaway1985882on Trump wins presidency for second time

https://fred.stlouisfed.org/series/MEDLISPRIPERSQUFEE10900

The median home in the Bethlehem, PA core based statistical area costs $200 per square foot in October 2024. In October 2019, it cost $120 per square foot.

I'm sure you can find homes that list for half the cost per square foot just as well as someone could find homes that list for double the cost per square foot. That's why the median is useful – and it has increased 66% over the last five years.

thrwaway1985882on Trump wins presidency for second time

The median price per square foot in the US is $226[0]. The insanely economically depressed rust belt area where I was born has a median price over $150 per square foot (you do _not_ want to live there). I suspect your mental model of housing prices is anchored in the past when the world has moved on.

[0]: https://fred.stlouisfed.org/series/MEDLISPRIPERSQUFEEUS

thrwaway1985882on Unfortunate things about performance reviews (2021)

Funny enough, those 5 line items are almost precisely how my company manages performance.

The only thing I'd highlight here is the importance of salary with scoring/calibration. As your salary changes, the distribution of scores changes too. Almost no time is spent talking about juniors/engineers. The most junior of developers tend to bottom out at a 3 no matter how good they really are because they're so inexpensive. You have to be near malicious to land a 2 or 1.

But I'm a senior director of blah blah now. I could move heaven and earth and triple my companies' ARR next year and I'll still get a 3 because there's no budget to make VP of blah blah, and giving me a 4 means giving my peers less and my boss won't want to do that or else they'll get mad.

I don't like tying perf to comp, but as long as everyone understands the deal they're making, it tends to work out.

thrwaway1985882on Google's TOS doesn't eliminate a user's Fourth Amendment rights, judge rules [pdf]

IANAL either, but from what I've read before the courts treat searches of your home with extra care under the 4th Amendment. At least one circuit has pushed back on applying private search cases to residences, and that was for a hotel room[0]:

> Unlike the package in Jacobsen, however, which "contained nothing but contraband," Allen's motel room was a temporary abode containing personal possessions. Allen had a legitimate and significant privacy interest in the contents of his motel room, and this privacy interest was not breached in its entirety merely because the motel manager viewed some of those contents. Jacobsen, which measured the scope of a private search of a mail package, the entire contents of which were obvious, is distinguishable on its facts; this Court is unwilling to extend the holding in Jacobsen to cases involving private searches of residences.

So under your hypothetical, I'd expect the police would be able to test "your drugs" that they confiscated from the thief, and use any findings to apply for a warrant for a search of your house, but any search without a warrant would be illegal.

[0] https://casetext.com/case/us-v-allen-167

thrwaway1985882on Google's TOS doesn't eliminate a user's Fourth Amendment rights, judge rules [pdf]

I think it'll prove far more likely that the government creates incentives to lead Google/other providers to fully do the search on their behalf.

The entire appeal seems to hinge on the fact that Google didn't actually view the image before passing it to NCMEC. Had Google policy been that all perceptual hash hits were reviewed by employees first, this would've likely been a one page denial.

thrwaway1985882on Gross Apple Marketing

> Show that to someone with no understanding of Apple and it's products, or AI, and you'll have someone equally confused.

Apple is selling a magical button that unprofessional idiots can press to be perceived as professional. Who in the world is going to be confused by that?

thrwaway1985882on Gross Apple Marketing

> I’ve watched that little animation several times, and they tell a better story in a minute twenty-five than all of Apple’s AI commercials combined.

If I showed that video to someone who isn't steeped in decades of Linux, I suspect they'd ask me what an Ubuntu is. As compared to the "schlub writes an email" video, which was compelling, funny, and actually shows the product they're marketing.

thrwaway1985882on New iMac with M4

For professional use, the idea of "opening up and upgrading a machine" feels wild. You're either given one by your employer or buying one yourself, and either way, it's on a 5 year deprecation schedule. It's a negative ROI for me as a solo or for my employer to ever do anything with a device that isn't "oh it's broken? too slow? new one being UPSed this afternoon".

thrwaway1985882on Smartphone buyers meh on AI, care more about battery life

What makes a Polaroid any more "real" than an iPhone picture to you? Can any photo truly be real? (Deleuze has some interesting thoughts on the matter)

thrwaway1985882on SAML: A Technical Primer

All my x509s for SAML signing are self-signed, and all my self-signed certs live for 9999 days and I plan to let someone else figure out the fallout from that as I'm going to be /retired/. No one has ever really complained. Some IdPs I've integrated with use certificates that are signed by public CAs and it's always a hassle because the ergonomics around it are terrible.

IMO, I think rotation is wildly useless too. It might make sense in a world where my signing certificate was decoupled from the metadata someone else has to very likely load by hand.

thrwaway1985882on SAML: A Technical Primer

> Let's just say my interaction with managing websites that used SAML was less than pleasant.

My interactions supporting it as both the identity provider & the service provider have lead to me being the SAML person at work, and I'm now very used to people either laughing at my misfortune or giving me pitiful looks.

It combines all the wonderful antipatterns you can name: a protocol where near everything is optional and two standards-compliant implementations can refuse to cooperate in any number of ways, hair raising security decisions (XML-DSIG?! configurable crypto? ughh), and half-baked features (back-channel SLO, anyone?)

It's a Lovecraftian horror that actually makes me appreciate JWTs.

thrwaway1985882on Things my girlfriend and I have argued about

> If you take a step back and look at the things you argue with your significant other about (or anyone else close to you), it's humbling to see how silly it often is.

One piece of advice I got from an old family friend when getting married two decades ago ... the next time you find yourself arguing with your spouse, when you feel that slight bit of anger or annoyance bubbling up, lift your shirt up and show them your belly button. You don't have to stop talking, just lift your shirt up and show your belly button while you're making whatever point you are making.

I've tried this a few times and it works wonders - doing something silly makes me stop and realize how silly the argument I'm in is.

thrwaway1985882on AnandTech Farewell

Replacing "downloading 2kb of text on a device with minimal technical specs" with "buying a top-end computer to download hundreds of megabytes of video & shove it into an LLM to mangle and hallucinate the message down into 2kb of text".

Thank god for progress. What would we do without it.

thrwaway1985882on Show HN: Ruroco – like port knocking, but better

> Well, tcpdump is explicitely not what you want to do in this case as Moxie points out

Why's that?

E: oh, if you aren't familiar with OpenBSD I might get the confusion – pflogd/the kernel (not me!) watches the actual network device and dumps to a file. So the actual "knocking" daemon I bodged together is one part running as a privsep user watching a log file and giving IPs to the other part which just adds to the pf table allowing access.

My threat model didn't include people who can fuck with pflog(4) to attack tcpdump(8) - I'm sure they're out there, and if they wanted to be they'd already be in my network (or already are).