Hacker News Reader

zerokernelon The Death of Microservice Madness in 2018

HTTP-as-an-ABI

That's why high assurance systems (like L4/seL4) minimize privileged code to a tiny fraction of what you find in a regular system, which absolutely makes sense and provably improves security.

Apart from the obvious advantages, minimal privileged code also means that it becomes far more feasible to formally verify the privileged code, like it has been done for seL4, which in turn is an important cornerstone to ensure that isolation (or more generally, specification invariants) does not break in any reachable system state.

zerokernelon Show HN: On-disk B+ tree for Python 3

https://pypi.python.org/pypi/BTrees

zerokernelon Redox OS Crash Challenge

Panics can of course result in exploitable system behaviour.

zerokernelon How PayPal Shares Your Data

I don't think cryptocurrencies are protecting anyone from any problem.

zerokernelon Learn FFmpeg the hard way

Honestly I don't quite know how or why engineers keep working in a "all of this is fundamentally broken always has been and never will be fixed" domain, on a motivational basis.

zerokernelon Ask HN: Is big-endian dead?

> Byte-by-byte parsing is a valid way to do parsing but not the only way. Byte-by-byte parsers tend to be slow and -- arguably, more importantly -- overly complex and rigid. It is, for example, usually very hard to do "random access" with a byte-by-byte parser, because allowing out-of-order parsing tends to blow the code complexity through the roof.

I have to agree here by experiences past. If the format in question has a chance of being performance sensitive, don't use FSM-based encodings [1]. It is inordinately difficult to optimize parsing these encodings even if you only have to handle tiny subsets, and it still won't be fast. A format like msgpack which prides itself on being very fast may be fast compared to JSON and other ways to express essentially arbitrary structures, but is DEAD SLOW compared to any direct encoding (be it a dedicated encoding you developed in literally a few hours or something like capnproto).

[1] Obviously, considering an encoding more complex than FSM means that you're an idiot and your application will almost certainly have security vulnerabilities related to the format in the future.

zerokernelon Ask HN: Is big-endian dead?

> but that's only because no one actually cares about these architectures.

This. Optimizing performance on BE is a waste of everyone's time and resources.

zerokernelon List of oldest companies: Before 1300

I'll just throw in here that faking contracts and certificates has been a huge business in the last ~1200 years or so in Europe. Many cities who claimed to have been founded a thousand years ago (or whatever) had to cede those claims since the historical papers were faked (usually hundreds of years ago).

zerokernelon LuLu: An open-source macOS firewall that blocks unknown outgoing connections

option=value, option:value, option/value and even option\value (without dashes). Not joking.

zerokernelon LuLu: An open-source macOS firewall that blocks unknown outgoing connections

> It would not be easy to do this in a technical manner

-> Homomorphic encryption is an active field of research. Legal is most likely the better solution. Probably.

zerokernelon LuLu: An open-source macOS firewall that blocks unknown outgoing connections

We'll just outlaw that. Compare: Jaywalking, avenues.

zerokernelon NeoPG – an opiniated fork of GnuPG 2

I didn't expect anything interesting to come up as replies, but here we are - thanks for those insights.

zerokernelon Let Me Ruin This for You: The Schadenfreude of Criticism

A piece of well-built criticism can be a great tool in corporate politics. It can completely destroy the chances of some proposal/project/person to succeed. Ideally without appearing to be personally oppossed. As usual, most people are (luckily?) not very good at crafting criticism and end up with a blunt and obvious argument which backfires frequently.

zerokernelon NeoPG – an opiniated fork of GnuPG 2

Don't confuse arcane and complex. Although PGP is a 90s crypto standard, so it's more than likely a nightmare to implement.

zerokernelon NeoPG – an opiniated fork of GnuPG 2

C++ has a long and successful history of application development, regardless of project size (from 0 to >100 MLOC; from 1 guy sitting in his attic to thousands of engineers). Much like Java it isn't "hip". Instead people like to use "hip" languages with an underdeveloped ecosystem. Typical example: analysis tools, e.g. code analysers, performance and profiling tools.

Comments like "couldn't they have used $niche-lang.org instead of [C++/Java/...]" bore me, to be honest.

zerokernelon Thunderbird Starts Working on Improving Its Interface

> The native Gmail? Then get a conversations view.

Thunderbird has had a ML/usenet-like conversations view forever.

zerokernelon Did Ken, Ritchie and Brian choose wrong with NUL-terminated text strings? (2011)

> NUL is not a character

Somehow NUL is still an assigned character in the ASCII code table. Strange, hmmm?

zerokernelon Did Ken, Ritchie and Brian choose wrong with NUL-terminated text strings? (2011)

And various undefined behaviours (signed overflow etc.) colluding against the programmer to the effect that compilers sometimes delete range-checking code.

Integer promotion rules are not simple, either. Integer width rules, far from simple.

zerokernelon Did Ken, Ritchie and Brian choose wrong with NUL-terminated text strings? (2011)

I would claim that there is still a difference between P-strings and, say, ASN.1 DER (which, at heart, is still TLV).

zerokernelon Why do I do this to myself? Bob's first predictions for 2018 – I, Cringely

> Both provided links are dead

HTTP works, HTTPS does not.

zerokernelon Crooked Style Sheeding – Webpage tracking using only CSS

That's pretty much the "reader mode" available in some browsers, no?

zerokernelon Crooked Style Sheeding – Webpage tracking using only CSS

> * Media query - So what, user agent gives this away mostly anyways

I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device!

Some examples:

Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1

Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) iOS/16.0.7.121031 Mobile/15C153 Safari/9537.53

Mozilla/5.0 (Linux; Android 7.0; LG-H840 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36

A Linux in comparison:

Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

While it includes the version number, no patch level (57.0.X) is included.

zerokernelon Cherry’s new switches may help bring mechanical keyboards to more laptops

Whether there is any click depends very much on the switch.

zerokernelon Cherry’s new switches may help bring mechanical keyboards to more laptops

https://www.cherry.de/cid/corded_keyboards_CHERRY_STRAIT_30_... https://www.cherry.de/cid/corded_keyboards_STRAIT_Corded_Key... https://www.cherry.de/cid/corded_keyboards_STRAIT_BLACK_Cord...

These have been around for seven or eight years.

zerokernelon German Engineering Yields New Warship That Isn’t Fit for Sea

Military procurement seems to be something working very poorly in many places. Not sure if the German military is really much worse than others, when looking at things like the F-35.

zerokernelon Cloud companies consider Intel rivals after security flaws found

Even dedicated supercomputer processors (e.g. A2, SW26010, VIIIfx) use virtual memory. In fact, most GPUs nowadays include an MMU as well, something they historically never had.

(SC applications tend to be huge fans of using enormous page sizes, like 2 GB, which mitigates page table walk costs)