HNHacker News
TopNewBestAskShowJobs

JackMcMack

550 karma · joined September 4, 2017

submissionscomments
JackMcMack··on How bad is my gas stove?
I can confirm that our induction stove is very fast, much faster at boiling water than the (domestic) gas stoves I've had experience with. A pot of water really does boil in under two minutes, so I wanted to question your math, but it seems correct :-). The problem here is the quantity, why are you (gp) boiling 7 liters of water?

edit: the boost is more powerful (3.7kW for the largest zone), but still. That's time limited (10 minutes or less), and limits the current to the other zone on the same phase.

JackMcMack··on LastPass appears to be holding users' passwords hostage
Root cause of this issue: export is only possible from the desktop browser plugin, but lastpass locks free users to either desktop or mobile. If your account is locked to mobile, you can't export your passwords.

I have another related issue: it is not possible to export your TOTP seeds from lastpass authenticator.

I contacted the lastpass/logmein dpo, which (in my case at least) got forwarded to their generic support-by-email. They were slow to respond, and eventually claimed they could not export my one time passwords because they are encrypted. This is obviously false, they can decrypt the data just fine (I actually switched to a new phone, authenticator data got synced as you would expect). And other apps such as Google Authenticator allow you to export your data.

I filed a gdpr complaint with my national Data Protection Authority, which after a long response time got accepted, and is now forwarded to the Irish DPA.

If you want to assert your rights, contact Lastpass/Logmein at privacy@logmein.com or via their support page [0] (from their privacy page [1]), and demand access to your data. If they refuse, or do not respond within 30 days, file a complaint with your DPA [2], with proof that you requested your data but got denied.

[0] https://support.logmeininc.com/contactus

[1] https://www.logmein.com/nl/legal/privacy/international#right...

[2] https://edpb.europa.eu/about-edpb/about-edpb/members_en

JackMcMack··on Procrastinatory Doom Loops
I'm not usually someone to complain about a comment or opinion, but this conflicts so much with my experience that I feel compelled to respond. I was diagnosed about 1.5 years ago, in my 30's.

I would argue that yes, "that's an ADHD symptom". One symptom does not make a diagnosis, but if you recognize yourself definitely do your research and consult a professional. Especially for the many people you know who show similar behaviour.

It took me a long time to convince myself I might have ADHD, and during and even after the diagnosis I still had my doubts. Looking back, it was incredibly obvious if you recognize the symptoms. I'm still amazed I got this far in life without professional help, no doubt largely due to my supportive environment.

I would _strongly_ argue that it is not accepted that ADHD is overdiagnosed. I've done a quick read through of the studies you linked, imho none of them actually support the claim of overdiagnosis.

[1] "Overdiagnosis is defined here as occurring when a person is clinically diagnosed with a condition, but the net effect of the diagnosis is unfavorable. Misdiagnosis (when a child is incorrectly labeled with an ADHD diagnosis instead of an alternative condition) and false-positive diagnosis (when a subsequent clinical encounter reveals a wrong initial diagnosis) are not the focus of this article."

Unfavorable here is:

- medication can have side effects

- it might be used as an excuse to stop trying/caring

- there's a social stigma

[2] This metastudy is about mental disorders in general, mostly referencing studies before 2000. The only study supporting the overdiagnosed claim is a german 2012 study; https://pubmed.ncbi.nlm.nih.gov/22201328/. They sent case vignettes to 1000 psychologists, psychiatrists, and social workers. For the case vignettes which matched several (but not all) ADHD criteria (DSM-IV), 16,7% gave a diagnosis, and 2x more often for boys vs girls.

This proves that the therapists did not strictly followed the criteria, but does that mean that they were wrong? This is no simple blood test. They're asking someone to give a diagnosis based on a 3rd party report of a patient.

I remember in my case there was a computerized quiz with easy answers and long artificial delays, to test if you can stay focused on boring tasks and measure your response time. If you give me this test on my pc, I will very quickly switch to another window or take out my phone. But in an external environment as part of an expensive test I specifially asked and waited a long time for? Sure, I'll be polite and keep staring at the screen. The screen was an old tft by the way, with a crappy unshielded vga cable picking up interference, causing ghosting issues in the different colour channels. If I lifted the cable hanging under the desk with my leg, I could almost make it go away.

Anyway, all of this was reduced to a number (my average response time), and ultimately to a boolean (can stay focussed). It's not an exact science.

Also, maybe the criteria are wrong? Or at least incomplete? Prior to DSM-V, ADHD and ASD were mutually exclusive. That seems absurd now, but the 5th edition only came out less than 9 years ago (may 2013), so after the above study. The DSM is "only" a consensus of a group of professionals. Over time our understanding of things change, and that consensus might change. And over a longer time, some of those professionals (and maybe a few new ones) come together and try and update the DSM.

[3] This article raises the question, but does not actually claim ADHD is overdiagnosed. Sure, some people might seek stimulants, and might successfully fake their way to a diagnosis. But that's a problem not exclusive to ADHD. Diagnosing ADHD is not straightforward, and should be done by experienced professionals.

I suspect there is a large pushback in the USA on stimulant use as a result of the opioid crisis. But for the people who actually need the medication the process of actually getting it is already difficult enough, and should be made easier, not harder.

I'm open to having my mind changed, but so far I have not seen any evidence that ADHD is overdiagnosed, let alone that overdiagnosing is increasing.

JackMcMack··on Computers as I used to love them
I sync a folder containing multiple git repos, never had a corruption happen.

@jwr can you link the issue you reported?

The only major issue I had was performance on TrueNAS/FreeBSD, Syncthing tends to keep a lot of files open. Increasing maxfiles/maxvnodes fixed it. [0]

On a sidenote, what's the point of these limits if your entire system becomes unusable if you reach them?

[0] https://jira.ixsystems.com/browse/NAS-104534

JackMcMack··on Computers as I used to love them
Versioning is supported:

* keep x previous revisions, or

* keep old revisions for x time, or

* diy with hook script

https://docs.syncthing.net/users/versioning.html

JackMcMack··on Self-made EL segment displays
The linked youtube video [0] is in Russian, but very watchable with translated captions.

[0] https://www.youtube.com/watch?v=XiAWYUZLJ1s

JackMcMack··on Analog Devices Expands over 1000 Linux Device Drivers to Support Development
Thanks for taking the time to respond, I really appreciate it.

By the looks of it, the analytics cookies (eg SC_ANALYTICS_GLOBAL_COOKIE) are not set when not clicking "Accept and proceed". So my issue is only with the wording. In practice it is already opt in, so the text can and should be changed to opt in. The wording opt out does say the default is to accept, and you have to explicitly protest to not accept. (It looks like the wording was already changed?)

Imho, you shouldn't look at it as cookies vs no-cookies. The GDPR is not really about cookies, but about protecting your personal data. You're allowed to set cookies! But if you're processing personal data (such as non-anonymous analytics), you do have to ask permission.

What bothers me the most is the consent modal: I have to click the small blue text "cookie details" (vs the large green "Accept and proceed"), and then click the gray "Decline cookies" to not have my personal data processed and shared.

Why not give visitors 2 options equally?

- "Please use (and share) my personal data to improve this (and other) sites", and

- "No thanks, I'm just browsing"

If you offer those 2 options (and don't try to hide the "no thanks" behind an extra click and a hidden link), I would seriously reconsider consenting. As a sidenote: I would be even more likely to consent if it's not the first thing you force on me. Visiting a press release with a fresh session cookie? Or landing directly on a datasheet from a google search? Why even bother with non-anonymous analytics and ask me for consent? But if I'm clicking through and visiting other pages? Sure, ask to track me. My personal default is to decline, but if you can show mutual benefits I'm way more likely to consent.

As for the comments on the EU website I linked to: I agree. The wording is not clear as to what I'm accepting. As far as I understand:

- "visitor preferences" and "operational cookies" are required

- analytics cookies can be declined (even though they are already anonymous)

- third party cookies are handled separately, when viewing third party content

Following my own advice, I will contact the European Union DPO, and ask them to clarify the consent popup.

This should really be an import addendum to my previous post!: the first step is to contact the site's DPO, and only escalate to your nation's data protection agency when this approach fails.

Thank you again rgetz for taking the time to respond, and for raising this issue internally. It looks like wording of the privacy policy was already changed. I hope the consent popup can also be improved. Your response and the quick update of the privacy policy has greatly improved my opinion of Analog Devices.

JackMcMack··on Analog Devices Expands over 1000 Linux Device Drivers to Support Development
They have a privacy policy for the EU [0].

This seems just plain wrong:

> We process your personal data ... to understand website usage and present you with content and advertising based on your browsing activities and interests, provided you have not opted out of such data processing.

GDPR is clear that the default is opt-in, not opt-out. And yes, the consent popup does not seem compliant to me.

I highly recommend you file a complaint with your DPA [1].

[0] https://www.analog.com/en/about-adi/landing-pages/001/privac...

[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

JackMcMack··on Automatically detecting and replying to recruiter spam
You could argue that the recruiter has a legitimate interest in gauging your interest in their offer. This assumes of course that the recruiter is the one actually doing the tracking, and not sharing that data with anyone else.

I highly recommend you exercise your rights and ask the company for your data. Is the privacy policy "complete" enough? Contact the DPO, ask them to explain what data they're gathering, why, and request a full dump.

JackMcMack··on Static Duck Typing in Python with Protocols
PyCharm has some longstanding issues with type checking aliased and union types. My fix coming in 2021.3.1 [0]

[0] https://github.com/JetBrains/intellij-community/pull/1655

JackMcMack··on Revolt of the Delivery Workers
I'm aware of no off the shelf solution, but this does sound like a problem that can be solved with electronics.

The motor controller could do electric braking if the rider's phone isn't in the vicinity of the bike. This would mean you can't push the pedals, but the wheels will still turn without resistance. If you forget to unlock it, you won't break the spokes, and there's no sudden halt, so you can still manually and safely break.

You could still run off with the bike on foot of course. But maybe if the pedals are blocked by the motor, you can use the standard lock without breaking the spokes?

JackMcMack··on Belgian ISP under 250 Gbps DDoS for days on end
I agree, maybe my wording about the situation could have been better. I fully support them in their handling of the attacks. Paying the ransom would in no way guarantee the attacks would stop, now or in the future.

My phone's 4G hotspot works (via another provider), but it does have limits of course. I don't mind paying a bit for extra data, but there is a limit to the amount of extra time and effort I can spend on this problem. I can't keep apologising indefinitely to my clients about bad audio/video calls if none of my coworkers have the same problems with their ISP.

Sibling comment did have a good idea: to tunnel my traffic through an OVH instance. A great opportunity to try out Wireguard.

JackMcMack··on Belgian ISP under 250 Gbps DDoS for days on end
I'm an Edpnet subscriber currently suffering the effects of the DDOS. It's annoying to say the least. Last year's DDOS attack was relatively simple, pointed at the DNS servers. Simply using other dns servers was good enough to get back online. Edpnet also joined NaWas [0] at that time, a non-profit for ISPs to be able to redirect all trafic through big pipes when needed to deal with large attacks. Because the current attacks are rapidly shifting targets, it's a game of cat and mouse to properly filter the ddos.

In practice, this means that some sites such as google and youtube keep working, but other services might not be available. It is extremely annoying when all of a sudden AWS api calls time out, or a Teams or Slack call suddenly drops to very low bandwith, and then drops entirely. I've had to resort to my phone's hotspot multiple times in the last few days. Yes, I pay for SLA, but what's the point in that? I've got priority in case of a cable break, and failover to 4G connection, but that's no use if the upstream is congested.

The sad part is that the attack works because it it a small isp, 45000 customers. [1] It is the main reason I'm a customer, they offer good service for great prices. Kudos for not paying the ransom. If the attacks continue for much longer, I will probably switch to the bigger, more expensive, less customer friendly isp. I'm happy to support a local company instead of a big multinational coorporation. But if my clients can't depend on me when working from home, I've got no choice but to pick the ISP with the bigger and more expensive pipes.

[0] https://www.nbip.nl/en/nawas/

[1] https://datanews.knack.be/ict/nieuws/edpnet-al-dagen-getroff...

JackMcMack··on Record €225m fine for WhatsApp Ireland over data protection breaches
a. The German (Federal) SA raised an objection on 21 January 2021;

b. The Hungarian SA raised an objection on 21 January 2021;

c. The Dutch SA raised an objection on 21 January 2021;

d. The Polish SA raised an objection on 22 January 2021;

e. The French SA raised an objection on 22 January 2021;

f. The Italian SA raised an objection on 22 January 2021;

g. The Baden-Wurttemberg SA raised an objection on 22 January 2021; and

h. The Portuguese SA raised an objection on 22 January 2021

JackMcMack··on Kaspersky Password Manager: All your passwords are belong to us
Has anyone had any success in getting your TOTP shared secrets out of Lastpass Authenticator?
JackMcMack··on Facit Homes, Wikihouse, and the Plywood Frame
You're charging 30% of the manufacturing cost? That seems excessive.

Edit: and the free "Make It Yourself" downloads are unavailable.

What exactly is "Open" about Opendesk?

JackMcMack··on OpenFlexure Microscope, an open-source optical microscope
I'm certainly no expert, my knowledge is limited to what I picked up after a few nights of reading about the microscope.

Does the beamsplitter have to be non-polarizing? My understanding is that standard beamsplitters do the splitting by polarizing the incoming light.

Now that I think of it, you're probably using a standard display as your image source? That does indeed produce polarized light. In that case I would try a (common in photography) circular polarizing filter. Rotate the filter to match the display polarization, after that the light will be circularly polarized. I think you could use that in combination with a "standard" polarizing beamsplitter. Depending on the desired dimensions, there are a few available on aliexpress.

JackMcMack··on OpenFlexure Microscope, an open-source optical microscope
I found this 2019 PyCon UK talk a good overview of the microscope.

https://pyvideo.org/pycon-uk-2019/robotic-microscopy-for-eve...

JackMcMack··on OpenFlexure Microscope, an open-source optical microscope
I've looked into building a "high resolution optics" version. Most parts [1] are easily sourceable, but the tube lens [2] has proven to be difficult.

It seems half inch diameter, 50mm focal length achromatic doublets are not that common; Thorlabs does seem to be the only source, and are (at least at the moment) not in stock.

[1] https://build.openflexure.org/openflexure-microscope/v6.1.5/...

[2] https://build.openflexure.org/openflexure-microscope/v6.1.5/...

JackMcMack··on Belgian Police Say They Decrypted Half a Billion ‘Sky’ Messages
As far as I understand, they were logging the encrypted messages for a long time, but only had live access for a few weeks. My guess is they used this to intercept a large shipment (17+ ton of cocaine captured), and watch the communications after that to rapidly identify the players involved.

Sky phones were set up with dedicated sims, everything else but their app blocked. There's no telephone number, email adress or other id to identify users. The app also featured self-deleting messages and post-seizure remote wiping. Besides the phone, they required an expensive subscription.

If these phones keep showing up on suspects, only available via no questions asked dealers, and you can't get anything from the phones themselves, it's easier to get a court order to go after the service itself. If you can then log all encrypted messages on or near the servers, and see they're mostly going to Belgium/Netherlands, then you can try to read all messages. Either via decryption, or compromising update servers, or ...

Because there's no way to identify users besides reading the messages, they asked legitimate users to come forward so their data can be excluded from the investigation.

JackMcMack··on Spectre in JavaScript
Firefox reduced the timer precision, this demo does not work. https://developer.mozilla.org/en-US/docs/Web/API/Performance...

On Chrome I have "too many false negatives" on 1st gen Ryzen.

JackMcMack··on Launch HN: SST (YC W21) – A live development environment for AWS Lambda
you can do 99% with pipreqs . && pip install -t . -r requirements.txt
JackMcMack··on Ask HN: Best Talks of 2020?
Can I see an example of your newsletter without having to subscribe first?
JackMcMack··on Gmail having issues
I'm trying (mailcow was easy to set up), but it seems all self-hosted solutions do not support snoozing mails. To me this is a must have feature.
JackMcMack··on TSMC and Google push chipmaking boundaries with 3D 'stacking'
It will not be enough.

There are essentially 3 leading fabs left: TSMC, Samsung, Intel.

Samsung has yield issues, Intel has yield issues, TSMC somehow has no issues. GlobalFoundries has already dropped out of the race. TSMC is selling every wafer they make, and continues to invest heavily to solidify it's lead.

ALL of these fabs depend on ASML machines. IIRC last year they delivered just over half of the machines that were ordered.

JackMcMack··on Casio F-91W: The strangely ubiquitous watch (2011)
I've built one of these. Good fun, but of course battery life does not match the 7+ years of the original. I think mine lasted close to a year?

If I remember correctly the magnetometer was end of life, but not critial to it's operation.

I'm not the original author, but I am considering ordering a few new boards and maybe the components. If you're really interested, give a shout on github: https://github.com/carrotIndustries/pluto/issues/1

JackMcMack··on AMD to Acquire Xilinx
My investment in AMD is so small that it seems silly to pay for analyst reports. I don't care about short term, and I have enough faith in my own research to keep believing in a brighter long term.

Are there any public resources dissecting an earnings call? Doesn't have to be recent or AMD.

JackMcMack··on How you could have come up with Paxos yourself
My question was more about hard splits: what to do when you have 2 DC's and they lose connectivity between them?

The larger pool can still have majority, but the smaller pool can not. Does the smaller pool change membership (because it can't see the larger pool) and continues on it's own? What if the smaller pool has a cold start and has no idea about the larger pool?

My point is that there needs to be some consensus on pool size to decide what constitutes a majority vote.

Implementations can make reasonable assumptions and rules for this, but afaict it's not covered by the protocol itself.

JackMcMack··on AMD to Acquire Xilinx
Earnings calls never seem to have any hard questions. There was a projections miss a few quarters ago (very rare for amd), and even then the questions feel more like PR.

Semi-Custom is indeed PS5 and Xbox. This increase was expected of course. It's lower margins than other segments though.

Epyc adoption is indeed slower than I would've liked. But so far it has matched or beat short and long term projections from AMD.

Enterprise is weird. AMD has better price and performance? Let's buy Intel. Meltdown lowers performance? Let's compensate by buying more Intel. Intel is supply constrained? Let's complain, and still buy Intel.

My guess is Intel is still pressuring OEMs to favor Intel. Cloud providers are increasing adoption though, and there have been a few nice HPC wins.

And lets not forget that AMD is selling every chip they can, TSMC production is fully booked.

JackMcMack··on How you could have come up with Paxos yourself
Something I've wondered about Paxos: does the voting not rely on knowing how many voters there are, to see if there is a majority? That makes it harder to survive a network partition, right?
← PreviousPage 2 of 3Next →