HNHacker News
TopNewBestAskShowJobs

yrro

2,593 karma · joined August 10, 2013

submissionscomments
yrro··on Nearly all UK drivers say headlights are too bright
Why isn't this flagged during the MOT?
yrro··on A day at Hetzner Online in the Falkenstein data center
Of course it impedes observability. With IPv6, I can see the IP addresses of the containers that connect to a service. With IPv4, I get (at best) the IP address of the container host, thanks to NAT.

Are you also afraid of port forwarding? Have you considered that your ISP could choose to send your router packets destined for RFC1918 addresses?

yrro··on A day at Hetzner Online in the Falkenstein data center
Indeed, a host should be able to request a /64 via DHCPv6-PD and split that between millions of container networks. But you can't do that on Hetzner (or anywhere else).
yrro··on A day at Hetzner Online in the Falkenstein data center
In practice this can be made to work but a networking expert can probably explain better than me why splitting a prefix into chunks smaller than a /64, and assigning them to virtual networks within a host is a bad idea.

In Hetzner's specific case: they won't give me one or more additional /72s: only a /56 if I pay for it. Per server.

yrro··on A day at Hetzner Online in the Falkenstein data center
It's not safer: it impedes observability.
yrro··on A day at Hetzner Online in the Falkenstein data center
The purpose of a network is to allow any two consenting parties to communicate. IPv4 cannot deliver that if either party has an RFC1918 address. NAT is a foul perversion of this foundational principle of the Internet Protocol.
yrro··on A day at Hetzner Online in the Falkenstein data center
Routable != routed.

If your containers have a Global Unicast Address then it's possible to look at connetion logs and figure out which container made a particular request, for instance.

yrro··on A day at Hetzner Online in the Falkenstein data center
I love Hetzner. That said their IPv6 support is poor. A server gets a /64 only, if you want a /56 (allowing 256 container networks) then you have to pay €15. As for virtual networks: they only support IPv4!

At least they're not as bad as Azure... :)

yrro··on Kubernetes Ingress Nginx is retiring
And here's me still using OpenShift routes... :)
yrro··on NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
trust but verify
yrro··on The cost of turning down wind turbines in Britain
Oh, that's a shame!
yrro··on Root System Drawings
The accursed bindweed: https://images.wur.nl/digital/collection/coll13/id/193/rec/1
yrro··on The cost of turning down wind turbines in Britain
I'd like to see an updated edition too.
yrro··on The cost of turning down wind turbines in Britain
No, that was allegedly Cotswold District Council, who refute Clarkeson's portrayal of events:

> A spokesperson for Cotswold District Council said: "We absolutely refute that any of the officers or councillors involved in working with Jeremy to realise his vision for the Coach and Horses had 'absolutely nothing positive to say' or were awkward."

> They added: "There were in fact several positive meetings between Jeremy and his team, and willing officers and councillors at Cotswold District Council.

> "These discussions explored how challenges to renovating this pub could be overcome, as part of the pre-application stage of this project. A planning application was never submitted.

> "Upon deciding not to pursue purchase of the pub, Jeremy sent an email via his planning agent thanking the council for being 'so open and supportive', and for trying to find solutions to some of the hurdles needed to overcome renovation of the pub. He stated that 'the march of time and the feasibility of getting this done within a window that works for television' had been the project's undoing."

https://www.bbc.co.uk/news/articles/cp3ql38yk11o

Clarkeson is an entertainer whose goal is to tell a compelling story; often one that bears little resemblance to the truth.

yrro··on The cost of turning down wind turbines in Britain
Sustainable Energy Without The Hot Air has a rough estimation of the amount of energy we can generate from offshore wind.

https://www.withouthotair.com/c10/page_62.shtml

16 kWh/day/person for shallow offshore and 32 kWh/day/person for deep offshore

To build enough wind turbines to generate 48 kWh/day per person is estimated to require 60 million tonnes of steel. That's three times the amount of steel that the United States used to build ~2700 liberty ships during the Second World War.

yrro··on The cost of turning down wind turbines in Britain
Yup.

> A solar farm that could have powered “all the households in Witney” has been refused permission by West Oxfordshire District Council. The application, by Ampyr Solar Europe, was for a site at Curbridge, south of Witney. The planning committee focused on the risk of a fire from the proposed battery storage, which they said could contaminate the water supply at a nearby wedding venue.

> Cllr Nick Leverton (Con, Carterton South) said: “Most of you will have seen on the motorway the sight of an electric car burning away… there are too many incidents where it was just a small chance and it becomes a big chance. I’ll remind you of Aberfan in 1966; 144 people died, 116 of them children.” The chair of the meeting, Cllr Michael Brooker (Lab, Witney South), is himself a firefighter and replied “I’ve never been to an EV fire. I’ve been to plenty of ICE vehicle fires.”

> Cllr Andrew Lyon (Lab, Witney Central) said “Water is the stuff of life… what do they do if they wake up in the morning and can’t turn the tap on?” Meanwhile, Cllr Adrian Walsh (Con, Ducklington) said “Month after month as a committee we get bombarded with these solar farm applications, and we don’t appear to have any strategy as to where they should be located.”

> The council’s officers had recommended that the application be approved, but 9 councillors voted against, 1 for, and 3 abstained.

These people are absolute buffoons.

https://oxfordclarion.uk/clarion-weekly-12-september-2025/

yrro··on Apple takes down ICE tracking apps after pressure from DOJ
The neat thing about the US is that governments are overthrown regularly by automatic operation of law: 12pm on the 20th of January 2028, in the case of the 47th president. I'm sure you know this but I feel everyone needs to remind themselves of this immutable fact regularly until then.
yrro··on Apple takes down ICE tracking apps after pressure from DOJ
Add Apple to the list of collaborators who need to be punished once the regime is overthrown.
yrro··on Samsung 870 QVO 4TB SATA SSD-s: how are they doing after 4 years of use?
Have a look at the SSD Statistics page of the device statistics log (-l smart). This has one "Percentage Used Endurance Indicator" value, which is 5 for three of these disks, and 6 for one of them. So based on that, the drives still have ~95% of their useful life left.

As I understand it, the values in the device statistics log have standardized meanings that apply to any drive model, whereas any details about SMART attributes (as in the meaning of a particular attribute or any interpretation of its value apart from comparing the current value with the threshold) are not. So absent a data sheet for this particular drive documenting how to interpret attribute 177, I would not feel confident interpreting the normalized value as a percentage; all you can say is that the current value is > the threshold so the drive is healthy.

yrro··on William Gibson Reads Neuromancer (2004)
I've had this sequence of quotations from various classic cyberpunk stories burned into my mind for the last 30 years. The slow zoom into the disembodied head on the cover of Neuromancer, while the visual and audio effects increase in intensity over the narration, "lines of light, ranged in the non-space of the mind" is particularly striking: https://youtu.be/VuZonQVN4uw?t=556

Was that read by Gibson himself?

yrro··on A love letter to the CSV format (2024)
But now that's not CSV. It's CSV with some kind of ad-hoc header...
yrro··on Microsoft admits it 'cannot guarantee' data sovereignty
I would like to hear Amazon answer the same question under oath.

https://aws.eu/

yrro··on Stdio(3) change: FILE is now opaque
It looks like FILE is not opaque in glibc. Create a translation unit that includes <stdio.h> & declares a FILE variable and it compiles fine. For comparison, create a translation unit that declares your own struct (but does not provide a definition) and declares a variable of the same type, and you'll get a "storage size of 'x' isn't known" error when compiling.
yrro··on Libxml2's "no security embargoes" policy
If I received an email like that I'd reply with an invoice.
yrro··on Writing a basic Linux device driver when you know nothing about Linux drivers
Does O_EXCL work with linux USB devices?
yrro··on New Linux udisks flaw lets attackers get root on major Linux distros
https://www.freedesktop.org/software/polkit/docs/latest/polk...
yrro··on New Linux udisks flaw lets attackers get root on major Linux distros
> For some reason, instead of only applying its contents to the user environment for the child process like any sane person would do, they are trusting its values for the library calls in the privileged parent itself.

The only safe way to use pam_env's `user_readenv` parameter is as the final rule of `type=session`. This behaves as you'd expect, affecting the child process only.

It appears that openSUSE enables the option for other rule types (auth and/or account), in which case it affects the parent process as well. Oops!

For the record, user_readenv has been disabled since:

    commit 4c430f6f8391555bb1b7b78991afb20d35228efc
    Author: Tomas Mraz <tm@t8m.info>
    Date:   Mon Oct 11 14:24:30 2010 +0000
    
        Relevant BUGIDs:
        
        Purpose of commit: bugfix
        
        Commit summary:
        ---------------
        2010-10-11  Tomas Mraz  <t8m@centrum.cz>
        
                * modules/pam_env/pam_env.c: Change default for user_readenv to 0.
                * modules/pam_env/pam_env.8.xml: Document the new default for user_readenv.
... PAM 1.1.3. And it's been deprecated for a while, to be removed in a future release entirely.
yrro··on Show HN: Unregistry – “docker push” directly to servers without a registry
Well put, but it's a shame this comment is the first thing I read, rather than comments about the tool itself!
yrro··on Debian bookworm live images now reproducible
Any packages with "Essential: yes" (run 'apt list ~E' to see them) are required on any Debian system. Additionally, the 'build-essential' pulls in other packages that must be present to build Debian packages via its dependencies: https://packages.debian.org/sid/build-essential
yrro··on A note on the USB-to-PS/2 mouse adapter that came with Microsoft mouse devices
That's a great site. Finally I think I understand WTF Lenovo mean by "IPMI over Keyboard Controller Style (KCS) Access"
← PreviousPage 2 of 34Next →