HNHacker News
TopNewBestAskShowJobs

286c8cb04bda

414 karma · joined October 31, 2011

submissionscomments
286c8cb04bda··on This JPEG is also a webpage
It's sending the "wrong" one --

    $ curl -I http://lcamtuf.coredump.cx/squirrel/
    HTTP/1.1 200 OK
    Date: Thu, 11 Aug 2016 05:18:00 GMT
    Server: Apache
    Last-Modified: Mon, 19 Sep 2011 23:31:49 GMT
    Accept-Ranges: bytes
    Content-Length: 135938
    Content-Type: text/html
286c8cb04bda··on CocoaPods downloads max out five GitHub server CPUs
pacman has been ported to OS X a few times

  https://bbs.archlinux.org/viewtopic.php?id=53960
  https://bbs.archlinux.org/viewtopic.php?id=122544
286c8cb04bda··on Show HN: Lescript – Simple PHP client library for Let's encrypt
> certs are never "renewed" but just reissued with new dates

This is correct.

286c8cb04bda··on The chunking express: another approach to foreign-language learning
> anki is good, but for some reason they have a self signed certificate on their site, which I haven't checked out yet, so I won't link to it

It's not self signed, it's the wrong domain (Error code: ssl_error_bad_cert_domain) HTTPS requests to ankisrs.net get a certificate for *.ankiweb.net, which is the domain the app uses for the sync web service.

286c8cb04bda··on Obfuscation: A User’s Guide for Privacy and Protest
Maybe in theory, but when the DRM tracks when you're reading the book:

https://www.adobe.com/privacy/ade.html

286c8cb04bda··on Obfuscation: A User’s Guide for Privacy and Protest
The ebook version from MIT press is Adobe Digital Editions. It is also available (more expensive) in Kindle format: http://www.amazon.com/-/dp/B0135G71BG
286c8cb04bda··on Manage like a spymaster
An URL for the edification of others -- http://www.amazon.com/dp/B00L00EJU6

(I have just purchased the book, and the problem mentioned in negative reviews about the text not matching the title seems to have been fixed.)

286c8cb04bda··on C# 7 Work List of Features
I recommend this book: http://www.amazon.com/-/dp/0321877586

It focuses on the language, not any specific implementation. The examples all use the command-line compiler, not Visual Studio. So you would be able to use the Mono Development Kit.

286c8cb04bda··on Is This Justice? Charging an Eighth Grader with a Felony for “Hacking”
Jails are run by counties or cities, and are for persons awaiting trial (i.e. not been convicted) or persons found guilty and serving short sentences.

Prisons are run by a state or by the Federal government, and are for holding persons who have been convicted of a crime and sentanced to a longer term.

286c8cb04bda··on Unix swiss army knife for headless browser JavaScript
> 1470 open issues

That's a really weak argument. Here's 5000 Firefox bugs:

    https://bugzilla.mozilla.org/buglist.cgi?component=General&product=Firefox&query_format=advanced&resolution=---&order=bug_status%2Cpriority%2Cassigned_to%2Cbug_id&limit=0
286c8cb04bda··on Apple – OS X – Photos
The biggest recurring issue was deadlocks in the garbage collector. It would start cleanup in a subvolume and trip all over itself. After that, any I/O to that specific directory would never return. The only solutions was to reboot the server and fsck for a few hours.

Second frequent problem: Hitting 90% capacity in a filesystem has a non-trivial chance to ruin it forever. Hit the wrong code path, and, even if you immediately delete a bunch of things, I/O to that filesystem would be forever 3000% slower.

286c8cb04bda··on Apple – OS X – Photos
I've used btrfs (at several-petabytes-of-data scale) and wouldn't trust it any more than HFS+.

Use ZFS if you like, or XFS, or even ext4 instead.

286c8cb04bda··on PuTTY 0.64 released, fixing a security hole
> Though they provide RSA and DSA signatures how would I verify the signatures themselves?

Ideally, it goes something like this --

1. Start with the master keys. Download them from their website & import them into your keyring.

2. Fetch signatures for those keys from some key servers. (E.g. gpg --recv-keys 6A93B34E).

3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys?

If "yes", then import the release keys and verify that _they_ have been signed by the master keys. You can use the release keys to verify the downloaded binary.

If "no", then you might recurse down those keys to see if you know anyone who signed any of _them_. At this point, you'll need to consider very carefully what your trust policy is going to be.

286c8cb04bda··on Libsqlfs: A POSIX-style file system on top of an SQLite database
> I'm still certain I've seen talk of indexing metadata...

This reminded me of BFS: https://en.wikipedia.org/wiki/Be_File_System

286c8cb04bda··on Edit: A Relaxing Mix of Vi and Acme
> Presumably in this editor "_" represents the "whole line" region, which leads to also "c_" and "y_".

That's not specific to this editor. In vim _ goes from the cursor to the end of the line (but does not include the newline at the end like $ does).

286c8cb04bda··on An Unusual Language That Linguists Thought Couldn’t Exist
That's kinda close. In sign languages, individual signs can be decomposed into different elements: Hand shape, motion, position, et al. Related terms or ideas will use some of the same elements.

I'll use a couple of examples from American Sign Language:

1. The gender of a subject in a phrase is sometimes communicated by performing the corresponding motion with the specific hand shape in front of your forehead (for male) or in front of your chin (female).

2. A signer could communicate "a chair", "then he sat down", and "so help you god, jimmy, you better go sit down right now or i'm going to make you wish that you were never born" with what is basically the same sign (first two fingers on right hand tapping top of first two fingers on left hand), just by repeating it more times and with more emphasis.

286c8cb04bda··on A Server Naming Scheme
> Why do they do this?

This short form is "for historical reasons". That's not "they're too lazy to fix it" reasons, rather there is a very large amount of hardware deployed elsewhere which you might have to interact with making assumptions. You have to fit within the lowest common denominator of all those assumptions.

> If your tools cannot handle unlimited length names, use different tools.

Because that's not possible. According to the RFC[1], FQDNs are are limited to 255 characters. Individual components (i.e. between the dots) are limited to 64 characters. Having to account for e.g. IDN, means space limits are an active concern.

[1] http://www.ietf.org/rfc/rfc1035.txt

286c8cb04bda··on Jumpers and the Software Defined Localhost
> Application configuration can be static (just hardcode localhost:3306 for your DB, for example).

I wonder how this scales when you have multiple databases, or have read-only slaves, or something like that.

Then developers have to remember to send some traffic to localhost:3306 and some traffic to localhost:3307, and who knows how many more ports.

Documentation never manages to stay up-to-date, so perhaps you could use some sort of Service Discovery Protocol to map these semi-arbitrary numbers to more memorable names.

Then, as long as you know what port the service-discovery-service runs on, you could simply query it for the address to reach your databases.

Maybe that's too much work, though. We could just stuff everything in /etc/hosts.

286c8cb04bda··on Pop: An extensible animation engine for iOS and OS X
> Also a designer can tell a dev exactly what he/she wants in terms of animation values (assuming they're using origami)

Thank you for introducing me to Origami! My time on HN today was not wasted.

(It's at https://facebook.github.io/origami/ if somebody else reading this also did not know about it.)

286c8cb04bda··on Arq 4 is out – Mac backup to S3/Glacier
> Am I the only one that would like to be able to setup a time range when it's allowed to use my bandwidth?

You can. After you setup a target open the Preferences window. Select the target therein and click the "Edit..." button.

The dialog that follows has an option to "Pause between [00:00] and [00:00]", where [00:00] is a drop-down which lets you pick the top of any hour of the day.

286c8cb04bda··on Background Job Processing for Atheists
Usually the kernel halts.
286c8cb04bda··on The Rise of Invisible Work
Owning things that you use infrequently is inefficient. If you could rent or borrow it for the actual time that you need it, then you are wasting (time|money|other) if you own.
286c8cb04bda··on Fifth Amendment Prohibits Compelled Decryption, New EFF Brief Argues
It won't work on Customs and Immigration. When you're talking to them you're not "in the US" yet. After that, yes, the privilege against self-incrimination is granted to everyone in the United States, citizen or not.

Caveat: The "border search exception" has some other pretty enormous holes.

286c8cb04bda··on Hylas-Lisp - A JIT-compiled Lisp targeting LLVM
> I want C (Objective-C) with Lisp macros too.

You might be interested in http://programming.nu/

286c8cb04bda··on Hylas-Lisp - A JIT-compiled Lisp targeting LLVM
> It would be awesome if there was a lisp that could compile directly to LLVM using native objectiveC libraries on iOS.

You might be interested in http://programming.nu/

286c8cb04bda··on .museum domains held in the US
> Then the technical people think it's a comment, not a web address.

They would be wrong. URLs beginning with // are scheme-relative -- http://www.w3.org/TR/2012/WD-url-20120524/#resolve-a-string-...

286c8cb04bda··on Tesla stock tumbles after Model S catches fire
If the chance of a catastrophic event happening is one-in-a-million, then it is equally likely to happen on the 13th and on the millionth coin toss.

> Assuming that the normal rate of battery fires after collisions is one per million, the probability of observing such a fire after only 13 collisions is rather low.

What you're arguing is that the probability of it happening on or before the 13th time is less than it happening on or before the millionth time -- Which is self-evidently true of _any_ probability, and is a much weaker argument.

> perhaps the rate is not one per million

This is much closer to the argument you should be making. I.e. "Given that a purported one-in-a-million event occurred after only the 13th test, what is the probability that their estimate of one-in-a-million is accurate?"

(I don't know the math to answer that question, but I hope somebody that does will come along and chime in.)

286c8cb04bda··on Don’t Slurp: How to Read Files in Python

  $ uname -s
  Darwin
  $ type seq
  seq is /usr/bin/seq
The man page says --

The seq command first appeared in Plan 9 from Bell Labs. A seq command appeared in NetBSD 3.0, and ported to FreeBSD 9.0. This command was based on the command of the same name in Plan 9 from Bell Labs and the GNU core utilities. The GNU seq command first appeared in the 1.13 shell utilities release.

286c8cb04bda··on Giant Concrete Arrows Across the American Landscape
> How could it be re-used?

To somewhat over-simplify, concrete is made from three things: Cement, large aggregate (big rocks), and small aggregate (little rocks). Broken up concrete works pretty well as large aggregate.

286c8cb04bda··on CoreOS: Boot on Bare Metal with PXE
> BTW, if people haven't tried PXE booting before, it's pretty easy with dnsmasq. You can basically read the sample config file and uncomment a few lines.

You don't even need a config file. Here's a command line snippet I have saved for testing PXE installs:

    $ sudo dnsmasq -hdq -i en0 -p0 --enable-tftp --tftp-root=`pwd` -Mpxelinux.0 -F10.10.10.100,10.10.10.199
Page 1 of 6Next →