HNHacker News
TopNewBestAskShowJobs

winkelmann

479 karma · joined February 24, 2024

submissionscomments
winkelmann··on Game Hacking – Valve Anti-Cheat (VAC)
> Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what.

I think a no-brainer solution here, which I am surprised isn't used, is to just immediately kick the account when a well-known signature, such as CheatEngine, is detected. If the program isn't even attempting to get around VAC, there is no point in doing the whole "delayed ban" thing.

winkelmann··on IronRDP: a Rust implementation of Microsoft's RDP protocol
I'd still pick RDP for remote managing any day, its server and client are so much better integrated (clipboard, peripherals, etc.) for this task than Sunshine/Moonlight. It also avoids the whole issue of setting up a virtual display output[1] as is required by Sunshine. I use both for different tasks.

On a related note, as of recent versions, Sunshine and Moonlight stable releases support 4:4:4 chroma subsampling and bitrates up to 500Mbit/s with HEVC, which results in almost indistinguishable image quality compared to native output[2]. Bitrates that high are unusual in normal content, but at least Apple's Media Engine (on M-series Macs) appears to be capable of decoding it.

[1] Here is a pretty good solution that piggybacks off of Parsec's driver, which is fully signed, though its EDID lacks HDR support. The project also includes a C header file for custom implementations: https://github.com/nomi-san/parsec-vdd

[2] Note: I found that I had to enable 10-bit color streaming (which is available when using Parsec's driver) to get rid of some gradient banding that isn't present in native 8-bit. I suspect it's some encoder and/or color space issue.

winkelmann··on Samsung bricked their home theater systems through automated firmware update
The question is if it still works "enough" to update to a working firmware, or if it's so broken that it can only be fixed by flashing the EEPROM directly.
winkelmann··on Mozilla's new terms of use are out of step with Firefox's direct competition
> I don't think their AUP considers the browser software a service.

One would think so, right? But why does Mozilla want me to "license" to them everything I "upload or input [...] through Firefox"[1]. Where do the "facilitated services" start and where do they end? It sure would be nice if they could draw that distinction, without it, the cautious interpretation would be that that everything is a facilitated service.

[1] https://www.mozilla.org/en-US/about/legal/terms/firefox/

winkelmann··on Mozilla's new terms of use are out of step with Firefox's direct competition
Yeah, it's annoying, but also nothing particularly new I believe. There seem to be two types of garbage links added by default:

1. "Sponsored shortcuts" that can be "easily" turned off in `about:preferences#home`

2. I guess "non-sponsored" shortcuts? I believe they pointed to Facebook, eBay, and something else (Pinterest maybe). Those have to be removed/"blocked" individually. I think they end up in `browser.newtabpage.blocked` after doing so.

I don't like that this is a thing I have to do whenever I set up a new Firefox install. It's not often, to be fair, but it still sucks nonetheless.

winkelmann··on Introducing a terms of use and updated privacy notice for Firefox
An interesting implication of this is that it would point to Firefox being considered a service from Mozilla (hence why they need a license to facilitate your use of the program).

If we now look at their "Acceptable Use Policy", we can find this:

> You may not use any of Mozilla’s services to [...] Upload, download, transmit, display, or grant access to content that includes graphic depictions of sexuality or violence, [...]

https://www.mozilla.org/en-US/about/legal/acceptable-use/

And to corroborate the applicability of the Acceptable Use Policy to the Firefox browser:

> Your use of Firefox must follow Mozilla’s Acceptable Use Policy, [...]

("Acceptable Use Policy" is hyperlinked to the aforementioned page)

https://www.mozilla.org/en-US/about/legal/terms/firefox/

So one could interpret this all to say that you're not allowed to view or download porn via Firefox. Additionally, "graphic depictions of violence" could extend to things like the sort of bodycam footage and reporting from war zones frequently seen in news reports.

winkelmann··on macOS Packaging for Ungoogled-Chromium
I haven't tried it myself, but it seems like that should be possible?

> You can sign Xcode apps within your continuous integration (CI) workflow by installing an Apple code signing certificate on GitHub Actions runners.

https://docs.github.com/en/actions/use-cases-and-examples/de...

winkelmann··on macOS Packaging for Ungoogled-Chromium
GitHub now offers "artifact attestation"[1], which would be ideal for this use case. It records what build process binaries originated from, so they can still be published elsewhere while remaining verifiable.

[1] https://github.blog/changelog/2024-06-25-artifact-attestatio...

winkelmann··on Congress fights to keep AM radio in cars
This sounds like a signal strength (or maybe frequency?) issue more than an advantage of digital. I sometimes hear people report the opposite of your experience, but many factors play into that.

Your point about error correction and perfect quality is noteworthy. Yes, if there is some data loss, error correction can maintain perfect quality, but once that fails, it fails badly. And it's not even all-or-nothing: The radio may, due to an arbitrary firmware configuration, refuse to tune into a stream that is still partially intelligible if it deems the signal integrity or strength to be insufficient. Even very damaged digital streams can be somewhat useful, if you can deal with lovely artifacts like piercing chirping noises when the decoder doesn't know what do to with garbled data.

winkelmann··on New standards for a faster and more private Internet
> It is about moving the trust.

Trust isn't being moved, though. Cloudflare could, by design, always see what website you were accessing. The difference is with ECH, there is one less party (someone listening in on your internet traffic) that can see which hostname you're accessing.

winkelmann··on iPhone 15 Pro Max can degrade Thunderbolt peripherals (2023)
Hubs are part of the USB spec I'm pretty sure. The hub's controller should also handle bandwidth bottlenecks.

As for the hubs in point 2, I am actually using a chain of three USB hubs between my Mac Mini and some of my peripherals (4 hubs if you count an internal one), which so far has worked without issues; I think all three of them caused instability on the USB-A ports. Again, the ports work fine when only one peripheral is connected directly, I plugged in two disk enclosures that saturate 5 Gbit/s and didn't see any issues when reading from both simultaneously.

winkelmann··on iPhone 15 Pro Max can degrade Thunderbolt peripherals (2023)
This reminds me of two things I experienced when I added a Mac Mini (M2 Pro) to my setup.

1. When I connected my iPad Pro M1 to the Mac via a 10Gbps rated USB-C/C cable, it only connected at USB 2.0 speeds (480Mbps). However, when I used a USB-C to USB-A adapter, then a USB-A to USB-C cable to my iPad, it connected at 10Gbps. My suspicion is that when it has the full USB-C wiring on both ends, it might try to establish a Thunderbolt 4 connection, fail, and just fall back to USB 2.0, rather than trying USB 3.x?

2. On a slightly unrelated note: I found the USB-A ports (or rather, their controller) to be really unstable when using a hub, everything works fine when connecting devices directly to the Mac, but with any of the hubs I tried, I saw USB devices becoming unresponsive or resetting over time. A similar setup worked fine on my Windows PC. The most unstable was a simple (i.e. 3 USB-A ports and Ethernet) USB-C hub which I tested with an adapter ("proper" one with VL160 chip); for fun I also tested it with an ungodly chain of almost every USB-C/A adapter I had on the USB-C/TB ports, where it worked fine.

Having to do a bunch of troubleshooting to set up my USB peripherals on the Mac was a bit unexpected, at least the USB-C/TB ports seem to work well (other than that iPad weirdness), so I'm happy I went with the Pro model for the additional two ports.

(Note: While I didn't really approach this too methodically, I believe I tried enough combinations of cabling and hubs to exclude a simple issue like a faulty cable.)

winkelmann··on Nginx has moved to GitHub
The new GitHub search has some more advanced features than Google, Bing, etc. do, such as Regex: https://docs.github.com/en/search-github/github-code-search/...

Of course, they could have kept the old search (without advanced filters) open, but there is at least a sensible explanation why the new search requires being signed in.

winkelmann··on FindMy Flipper – AirTag and SmartTag Emulator
You wouldn't actually physically cycle/replace the tag. As you can see in the README, you can clone real tags, which could be advertised by the device in intervals.
winkelmann··on No more boot loader: Please use the kernel instead
FYI: In my experience, modern UEFI Firmware/BIOSes will scan every FAT32 partition found on attached storage devices for bootable EFI binaries, they don't even appear to care about the GUID/type marking, just that it is FAT32. I never let OSes share an ESP, each install gets its own.
winkelmann··on A forged Apple employee badge
> literally asking the LLM to translate an english phrase to german

I tried it a few times on arena.lmsys.org and given the prompt "Please translate "We thank you for your business" into German", the most common result was "Wir danken Ihnen für Ihr Geschäft", I got one bad result from some random tiny model and some more extensive responses from Gemini with suggestions for more idiomatic expressions. Modern LLMs are typically smart enough to understand this nuance when translating to German.

winkelmann··on Timeline of the xz open source attack
Completely benign documentation change to fix a typo: https://github.com/MicrosoftDocs/cpp-docs/pull/4716

I have no idea what that IP address is supposed to be about...

winkelmann··on Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
I assume the operation has most likely been called off. Their goal was probably to wait until it got into stable distros. I doubt there is a large number of unstable Debian or Fedora Rawhide servers with open SSH in the wild.
winkelmann··on How I replaced deadly garage door torsion springs (2002)
> I wore gloves

I don't know if this also applies to garage door springs, but when working with lathes for example, it is often recommended to not wear gloves. I imagine if the spring comes loose, it might slash open your hand, but with a glove, it could fully grab it and basically wind up your hand and arm around itself.

winkelmann··on How I replaced deadly garage door torsion springs (2002)
Something I've noticed is that, when under the guise of safety/"don't do this thing", netizens seem to have few inhibitions sharing information from topics they barely understand or have experience in. Some caution is always good, but I feel like people are too comfortable using it as an excuse for sharing unsubstantiated information as fact.
winkelmann··on GitHub Copilot makes insecure code even less secure, Snyk says
Whenever I read articles like this (AI assistants having a negative impact on resulting work), I wonder about how much it affects "experienced" AI users. I've been interested in AI since the Cleverbot days, and have extensively used GitHub Copilot and ChatGPT since they came out. When I ask ChatGPT something that has an objective answer, but one I can't easily verify from my own knowledge or low stakes experiment (e.g. does this fix my syntax error?), I always make sure to not "ingest" it into my knowledge or product before finding one or more external corroborating sources. This doesn't make ChatGPT significantly less useful to me, from my experience, verifying an answer is typically much easier than researching the question from the ground up by conventional means (Google, GitHub Code Search). Similarly, when using GitHub Copilot, I am acutely aware that I need to critically evaluate the suggested code myself, and if there is something I am unsure about, it's again off to Google or Code Search.

Personally, the most risky AI stuff I do is if I am completely stuck on something, I might accept AI suggestions without much thought just to see if it can resolve whatever issue I am running into. But in my mind, those parts of the code are always "dirty" until I thoroughly review them; in the vast majority of cases, I end up refactoring those parts myself. If I am asking AI to improve a text I wrote, I rarely just take it as-is, I typically open both versions next to each other and apply parts I like to my original text.

In my opinion, stuff created by AI is inherently "unfinished". I cringe whenever people have AI do something and just roll with it (writing an essay, code, graphic design, etc.). AI is excellent for going most of the way, but in most cases, there need to be review and finishing touches by a human, at least for now.

winkelmann··on Show HN: Real-time image generation with SDXL Lightning
To be clear: I did not downvote any comment, and I don't agree with anyone who did, since I don't believe the reports of the website not working for someone on i(Pad) OS to be made-up.

That being said, I don't think the refresh button (actually a seed randomizer) is related. I was definitely already playing around with it on my iPad when you posted your comment. However, I am not sure about the timeline in relation to the first comment (above yours).

winkelmann··on YouTube's search function is atrocious now [video]
You can also do before:2030 (or some other date in the future). It shouldn't change the results except removing the "recommended" garbage. It's crazy how much more usable it becomes. You could probably write a Userscript or something to automatically add it to every query.
winkelmann··on Show HN: Real-time image generation with SDXL Lightning
This and Groq were really surprising to see. I still remember, not too long ago, waiting around for ages just to get a messed up image generation from some site where you got like 20 generations for free with an account. The fact that we're at the point where you can just go to a website and get lightning-fast text and image generation without sign-ups or captcha solving is amazing. I didn't have this type of performance uplift in the cards for early 2024, especially to the extent that they (Groq and fal.ai) can afford to open up their demos completely.

Side note: In my opinion, the fast generations also make up a lot for the shortcomings in image generation quality. I find that even if it messes up, a good result is usually just a seed or small prompt change away.

winkelmann··on Show HN: Real-time image generation with SDXL Lightning
Maybe it's an iOS thing? I just spent about an hour generating stuff from my iPad.

*Edit:* The previous poster specifically said they use an iPad, that's odd. Worked fine on my 12,9" iPad Pro, Display Zoom is set to "more space", i.e. more content shown. In case it has an issue with not enough screen space?

← PreviousPage 2 of 2