Hacker News Reader

~~Written by the same people?~~

EDIT: ha, confused with https://wiki.xxiivv.com/site/uxn.html

xorion Windows drive letters are not limited to A-Z

The real question is can Windows defender scan these drives?

I've been wanting to do this for ages. Originally I wanted to do this at the home router level, but that quickly got shut down when I got a test net up and running and my friends could control the Chromecasts in my house.

For us a "tailscale" equivalent with SoftEther is what we used to manage the DNS/Tunneling for our fileshare/services.

So cool to see more people playing in this space. Please post more! <3

xorion NSA spied through Angry Birds, other apps: report (2014)

"How do you get corporate secrets out of a software engineer? Sit them next to another engineer on a plane."

xorion Wired is dropping paywalls for FOIA-based reporting. Others should follow

Well they aren't in Canada for me yet, but that's probably because we aren't the public that needs to know.

xorion Show HN: my party game where AI decides if you’re funny

"Show me what you got"

xorion Show HN: Parallel DOM – Upgrade your DOM to be multithreaded

I understand, but things like https://github.com/GoogleChromeLabs/comlink enable it. Similar to how iFrames don't have access to their parent page you need a facilitator. My question is why not use a js facilitator that could work in all browsers, rather than just Chrome.

I find it an interesting choice that the author decided to invest in new iFrame technology rather than existing multi-thread technology in the browser.

xorion Show HN: Parallel DOM – Upgrade your DOM to be multithreaded

I see it now, I don't know how I missed it.

xorion Show HN: Parallel DOM – Upgrade your DOM to be multithreaded

Why reach for iFrames over other technology like WebWorkers?

xorion Show HN: Storing Private Keys in the Browser Securely

I'm confident then that you can skip the base64 encoded header and just have the server use the jwt passed in the bearer token and the new signature you propose. (As the base64 encoded version can be reconstructed from the JWT itself)

But I think ideally I would use a wrapped JWT with `"alg": "ES256"` and just pass it as normal in a bearer token[0] as JWTs natively support signed primitives.

[0]: https://jwt.io/#debugger-io?token=eyJhbGciOiJFUzI1NiIsInR5cC...

xorion Show HN: Storing Private Keys in the Browser Securely

When you `.get` a credential you can provide a challenge that it signs which you can make the JWT. With an added bonus that this passkey can exist on your phone or password manager which you can use to authenticate on a different device while still feeling confident in it's security.

xorion Show HN: Storing Private Keys in the Browser Securely

Yeah that does it for new keys generated, any old keys in IDB obviously still are exposed.

xorion Show HN: Storing Private Keys in the Browser Securely

Rather than generating key data on the client in the open, and storing it in IDB, I would recommend the Credential Management API[0]. Hand off the responsibility to proper generation and storage to the user agent. Then do your signing of the JWT with them instead.

[0]: https://developer.mozilla.org/en-US/docs/Web/API/Credential_...

xorion Show HN: Storing Private Keys in the Browser Securely

so I don't fully understand what you're preventing

    const db = await openDatabase();
    const keyPair = await getKeyPair(db);
    await crypto.subtle.exportKey("jwk", keyPair.privateKey)

exports the private key if I have a XSS vuln.

The recommendation for IP address in the JWT is good, but I don't understand your last recommendation of 1) sending the JWT, 2) additionally sending the base64 JWT in a header 3) sending the signature in the header. The crypto.subtle api only works on https domains so you're not defending against mitm attacks on unsecure networks either. And if we can't trust TLS what can we trust on the web?

xorion Rabbit R1 source code [part 1]

Not much here explicitly in the source code dump. A little insight into their worker node infra but no "secret sauce" imo.

xorion Overlay networks based on WebRTC

Hyperswarm has been my go-to for stuff like this, but you bring up a good point that I don't think it's encrypted.

https://github.com/holepunchto/hyperswarm

xorion Moonwalkers: Shoes that make you walk faster (pre-order)

I don't know if 5 miles is long enough for the people who actually need it, but if I was a postal worker, these would be pretty sweet. And 1400 USD is cheaper than some car insurance here in Canada for young males.

xorion IRS Will Soon Require Selfies for Online Access

JPGs are not security, and moving JPGs can be fabricated very easily. Some v-tuber software with a deepfake GAN strapped to it I feel like would fool 1-on-1 meetings too.

I got my weekend project.

xorion Evervault

> we can't decrypt your data.

But I thought the point of the cages, is that _do_ decrypt the data. And any government mandated backdoors would then go into that process. You're not doing any homomorphic encryption here.

I guess my issue, is that you see both the keys and data, not just one.

xorion Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks

It's actually built into vanilla android https://support.google.com/googleplay/answer/9283534?hl=en

xorion Show HN: I Put St. John's College Great Books Reading List into a Google Sheet

They've updated their list with a few new ones. https://www.sjc.edu/academic-programs/undergraduate/great-bo...

xorion Building Your Color Palette

I agree, I thought the same thing when I hit that section. "What's wrong with that?"

xorion A Curious Moon

Well that was the most compelling trailer I've ever experienced for a SQL reference book. Well done.

xorion Show HN: Hyax – An All-in-One Selling Platform for Creators

I think they're still working on that https://hyax.com/pricing

xorion Show HN: Cookie Recipe Generator

I love it, I'm making cookies tonight. Some humble suggestions.

- might be best to include the C as units for temp

- somehow allow scaling recipe to whatever my eggs actually weigh, (I know I can estimate manually bumping the output up and down, but it'd be nice to do exact calculations)

- generate cookie previews :P

xorion Show HN: VPN with automatic region routing, port-forwarding and custom filtering

For some reason the text fades in, then disappears. You seem to have a js error.

xorion Orca: an esolang for audio-visual live coding

Unfortunately the actually git "push"ing of code is slower. I'm a paying sr.ht member and that's the one thing I wish was faster.

xorion The Webpage, an online RSS reader and news aggregator, styled like a newspaper

https://en.wikipedia.org/wiki/Halftone

They used to generate this by holding a "screen" up to create the grid.

xorion The Cruise Origin

> In a case where fault must be determined between an autonomous vehicle and a human driver, human judges / juries are going to overwhemlingly side with the human.

I think you're right, but _because_ there is sensor data to back it up we won't have to "take the person's word for it" that the driver-less car "cut off" the human when the human was going twice the speed limit (as an example).