HNHacker News
TopNewBestAskShowJobs

Buge

3,959 karma · joined July 4, 2013

submissionscomments
Buge··on Flying with Miniature Horses
When the government pays for things, it distorts the economics, because the true cost of that thing is being hidden from the consumers. By including the cost of enforcement in the cost of the service itself, the market can balance better.

For example, when allowing horses, that means the plane uses additional fuel. Usually the cost of the fuel is included in the ticket, so as fuel becomes scarcer, prices go up, and less people fly. But when the government starts paying for some of that fuel, it will hide that price increase from consumers, so they will fly more than they should, and use fuel faster than they should.

Also, almost 90% of Americans have flown[1], so it's not like filers are some tiny minority.

[1] http://survey.airlines.org/

Buge··on Flying with Miniature Horses
By forcing airlines to allow horses, that means the airlines have to expend effort for that. That means they have to raise prices. That means all airline fliers are paying for it. I don't see a reason why all US citizens should pay for it instead of all US fliers paying for it.

As far as depriving other passengers, it's up to the airlines how to do that. They are incentivized to provide a good experience to fliers in order to keep people willing to fly with them.

Buge··on Kaspersky AV injected unique ID allowing sites to track users in incognito mode
Previous discussion: https://news.ycombinator.com/item?id=20703699
Buge··on Extended Validation Certificates Are Really Dead
We can make EV useful if we add an Expect-EV header similar to the Expect-CT header. And ideally add preloading to the header too.

This allows EV to have real benefits without requiring any user alertness.

Buge··on Why has examine.com disappeared from search results?
You're arguing search engines should disincentivize gaming SEO? That seems to be exactly what Google has done here.
Buge··on Administration Using the Full Power of the Surveillance State on Whistleblowers
Kind of funny, since some people claim The Intercept has an anti-Obama and pro-Trump bias.

https://www.reddit.com/r/politics/comments/90qn1h/ecuador_wi...

https://www.reddit.com/r/politics/comments/90qn1h/ecuador_wi...

https://www.reddit.com/r/politics/comments/90qn1h/ecuador_wi...

https://www.reddit.com/r/politics/comments/90qn1h/ecuador_wi...

Even HN sometimes compares The Intercept to Infowars https://news.ycombinator.com/item?id=17582751

Buge··on FBI: Delivery drivers involved in Amazon theft ring
That's not really the last sentence in the article. There's an ad break, then a bit more stuff.
Buge··on Siri records fights, doctor’s appointments, and sex, and contractors hear it
It's a direct quote from the whistleblower:

> The whistleblower said: “There have been countless instances of recordings featuring private discussions between doctors and patients, business deals, seemingly criminal dealings, sexual encounters and so on. These recordings are accompanied by user data showing location, contact details, and app data.”

> That accompanying information may be used to verify whether a request was successfully dealt with. In its privacy documents, Apple says the Siri data “is not linked to other data that Apple may have from your use of other Apple services”. There is no specific name or identifier attached to a record and no individual recording can be easily linked to other recordings.

> Apple told the Guardian: “A small portion of Siri requests are analysed to improve Siri and dictation. User requests are not associated with the user’s Apple ID. Siri responses are analysed in secure facilities and all reviewers are under the obligation to adhere to Apple’s strict confidentiality requirements.”

Strangely, the whistleblower's quote directly contradicts Apple's privacy documents. The whistleblower says the recordings are linked to some other information, but the privacy documents say the recordings are not linked to other information.

But the whistleblower's quote does not contradict Apple's quote to the Guardian. The whistleblower never says the recordings are linked to the user's Apple ID.

https://www.theguardian.com/technology/2019/jul/26/apple-con...

Buge··on Robinhood Stored Passwords in Plaintext
Are you aware that Github, Twitter, and Facebook also logged passwords?

https://www.zdnet.com/article/github-says-bug-exposed-accoun...

https://arstechnica.com/information-technology/2018/05/twitt...

https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...

Buge··on Facebook deceived users about the way it used phone numbers, FTC to allege
Reminds me of the time my aunt got an SMS saying reply 1 to post happy birthday to my dad's wall, she replied 1 and it posted 1 to his wall.

https://www.reddit.com/r/facebook/comments/2qbg9j/reply_1_to...

Buge··on Why Americans Don’t Like Jazz (2003)
Off topic, but I found it interesting that there was a parody of "My Way" by Frank Sinatra about Ebay. Weird Al made a parody of "I Want It That Way" by the Backstreet Boys titled "Ebay".
Buge··on Neuralink Live Stream [video]
My idea of ranting crazy person's website doesn't have facebook share buttons and a popup asking me to subscribe to a newsletter. For reference, here are my ideas of a crazy person's website:

http://timecube.2enp.com/

https://web.archive.org/web/20171002152147/http://templeos.o...

https://web.archive.org/web/20180404034756/http://nasimabc.c...

Buge··on YouTube video has its own URL in it
Vaguely related: I noticed that the old reddit UI would display self posts as "self.subredditname" and link posts to foo.com as "foo.com". I realized there was a potential confusion if your tld is the subreddit name, and the 2nd and only other label is "self". So I registered self.finance and posted a link to it to /r/finance .

https://www.reddit.com/r/finance/comments/3ancv0/selffinance...

Buge··on VAIO announces tiny laptop with tons of ports
What laptop is that? Because this laptop has a lot of very weird ports (I'm leaving out USB-C):

2 micro USB-B ports, one with quick charging 3.0, one with USB OTG so the laptop can be used as an external mouse and keyboard for a different computer even when not booted.

2 ethernet ports, one with power over ethernet supporting 3 different standards for POE.

5.5x2.5mm power connector, fullsize SD reader, micro SD reader, 4 USB-A 3.0 ports (one always on), mini DisplayPort, full HDMI, 4 3.5mm audio jacks (in, out, mic, headset), VGA, DB-9 connector supporting many modes, HD Mini SAS, USIM card tray, PBD-12 pin connector, tripod mount, mount for attaching to a wall via screws or via magnets or mounting to your arm.

And on the power supply there are 8 ports.

Buge··on Report on the technical vulnerabilities found in Huawei 5G [pdf]
>As for disabling asserts in the code you ship: That is such a quaint 1980'ies thing to do, and people should have stopped doing it long time ago.

Sqlite makes all its asserts noop in release mode[1].

Chrome disables DCHECK() in release mode[2], and it's used many times[3].

RE2 has debug only checking[4].

In Rust debug mode, signed integer overflow panics, in release mode it wraps[5].

Firefox disables MOZ_ASSERT() in release mode[6], and it's used many times[7].

I doubt Huawei is more modern and less 1980s than all these other projects.

>My money is on Huaweis function doing the check with an assert which was compiled out for deliverable code.

Are you saying it was compiled out because asserts were disabled, or because the compiler could reason about the arguments at every callsite? It seems unlikely to me that the compiler could reason about the arguments at every callsite.

[1] https://www.sqlite.org/assert.html

[2] https://chromium.googlesource.com/chromium/src/+/master/styl...

[3] https://cs.chromium.org/search/?q=DCHECK%5C(+case:yes&sq=pac...

[4] https://github.com/google/re2/blob/master/util/logging.h

[5] http://huonw.github.io/blog/2016/04/myths-and-legends-about-...

[6] https://dxr.mozilla.org/mozilla-central/source/mfbt/Assertio...

[7] https://dxr.mozilla.org/mozilla-central/search?q=MOZ_ASSERT(...

Buge··on Eastgate Centre, Harare
>Pearce's practice is in Harare, and he specialises in buildings which are low cost, low maintenance, and have low environmental impact. His projects try to make best use of locally available resources, and include Harare International School Arts Centre, Harare Hindoo Temple and Chinhoyi Provincial Hospital, Zimbabwe.

This sounds more like the architect's resume than a Wikipedia article.

Buge··on Report on the technical vulnerabilities found in Huawei 5G [pdf]
For both A and B, why do they need to check all locations? Wouldn't finding a single location be enough to prove that it's happening?

Also in A and B you seem to be saying it's difficult for them to see whether all the locations lack the check. But it sounds to me like their static analysis makes that fairly easy, and that that's what they found.

You are saying that VOS_memcpy_s's source code could be safe but have its safety checks hidden by the compiler if the compiler has strong optimizations enabled while simultaneously having asserts enabled and also every single call to VOS_memcpy_s has an assert before it. That seems like a pretty rare configuration, because AFAIK, asserts are usually disabled when strong optimizations are enabled. And it seems unlikely to me that Huawei would put an assert before every single call to VOS_memcpy_s, for multiple reasons, (1) because Huawei is sloppy, (2) because there's no reason to put an assert before VOS_memcpy_s if it has safety guarantees. So I conclude there's very little likelihood there are any checks in VOS_memcpy_s's source code.

Buge··on Mirth – a type-safe concatenative purely functional programming language
Insults like this are very annoying to read. If you think the moderation is too strict and is hurting HN's environment, then say that. There's no need to be so mean about it.
Buge··on Details of the Cloudflare outage on July 2, 2019
The original one would match "==", your suggestion would not. To get a clean regex they should switch to

    .*=.*
I don't think they should spend any time contemplating whether a regex will backtrack, because it's hard. Instead they should (and are planning to) simply switch to a better regex library that never backtracks.
Buge··on Details of the Cloudflare outage on July 2, 2019
It's meant to match any number of any characters, then match an equal sign, then match any number of any characters. But it's very badly written. It should instead simply be written

    .*=.*
BTW, your comment got mangled by HN's markdown formatting.
Buge··on iMessage: Malformed Message Bricks iPhone
> blaming bad drivers for accidents instead of fixing the system.

I had to read that several times before I realized you weren't talking about computer device drivers and computer systems.

Buge··on The Scene: Pirates Ripping Content from Amazon and Netflix
Yes, but then why do they need to reverse engineer anything? Can't they use a capture card?
Buge··on The Scene: Pirates Ripping Content from Amazon and Netflix
Netflix serves a tremendous amount of video, a large percent of total internet bandwidth. They spend a lot of time optimizing their video compression, which can be seen from their tech blog, and papers they publish on video compression techniques. There's no reason for an encrypted file to be more than 100 bytes larger than the unencrypted file. I highly doubt Netflix is introducing a 30% overhead for no reason.
Buge··on The Scene: Pirates Ripping Content from Amazon and Netflix
>After starting with a large raw file, the finalized version ready for release is around 30% smaller, around 7GB for a 1080p file.

Huh? Are they recompressing it? How else would it shrink? If they're recompressing it, why don't they just use a capture card and avoid the hassle of reverse engineering stuff?

Buge··on YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube
>e.g. only blocking actual criminal content, which is all youtube have done before this, right?

Youtube has always blocked porn. Youtube has had a other restrictions as well, for example at first all videos had to be under 10 minutes. In response to criticism of disturbing videos of children, youtube deleted 150k videos of children in disturbing situations[1]. Read the guidelines from 2009[2], there's various things banned there that aren't illegal.

[1] https://www.buzzfeednews.com/article/blakemontgomery/youtube...

[2] https://web.archive.org/web/20091114041327/http://www.youtub...

Buge··on Apple iCloud Experiencing Issues
How big of an outage do you want? Here's one from 7 days ago: https://news.ycombinator.com/item?id=20298719
Buge··on Apple iCloud Experiencing Issues
Both of these Google outages made it to the HN frontpage:

https://news.ycombinator.com/item?id=20077421

https://news.ycombinator.com/item?id=20338263

Both of these AWS outages made it to the HN frontpage (and neither are listed in that AWS timeline):

https://news.ycombinator.com/item?id=20298719

https://news.ycombinator.com/item?id=19749781

Buge··on YouTube’s Algorithm Incentivizes the Wrong Behavior
If that's the problem, then gibrown's solution

>Just start banning certain creators from showing up in recommendations if their content crosses the line.

also won't help, because it's not the creators that have content crossing the line, it's the commenters.

Buge··on YouTube’s Algorithm Incentivizes the Wrong Behavior
> PewDiePie, a skinny, fast-talking Swede

Is he really fast-talking? He seems kind of slow talking to me, when I watch his videos I use 2x speed.

Buge··on ‘I believed I didn't have the right kind of brain for science’
I think there are 2 things that make math different than writing in this case.

1. I expect the main reason for needing remedial writing would be English as a second language people. That is, smart people who got a good education, but that education wasn't primarily English. That doesn't really apply to math.

2. I expect standardized tests can more easily test math than writing due to the nature of solving math problems vs writing. Thus Harvard would be able to filter out people who are bad at math more easily than people who are bad at writing. Then again, maybe Harvard doesn't want to filter out people who are bad at math.

← PreviousPage 7 of 34Next →