HNHacker News
TopNewBestAskShowJobs

Lt_Riza_Hawkeye

385 karma · joined May 16, 2018

submissionscomments
Lt_Riza_Hawkeye··on ClickHouse Keeper: A ZooKeeper alternative written in C++
Meta additionally has some internal software called Zelos, which is the zookeeper api but implemented on delos[0], though you didn't hear it from me

[0] https://www.usenix.org/system/files/osdi20-balakrishnan.pdf

Lt_Riza_Hawkeye··on PostScript’s sudden death in Sonoma
I think they were correcting the spelling from depreciated to deprecated
Lt_Riza_Hawkeye··on Parsing integers quickly with AVX-512
It bounds checks just fine, as long as you pass it a null-terminated string. It just returns 0 on error, so there's no way to know if the string was for example, larger than would fit in an int, or even just totally invalid, or if the user actually entered 0.
Lt_Riza_Hawkeye··on Chrome: Heap buffer overflow in WebP
Right, but for most users, Chrome's differentiator is that it's fast. I can't imagine them flipping the flag on by default - and if 99.99% of users aren't going to use it, it's probably not worth it to bloat the binary size either. Maybe someone will make a chromium patch with it that people can keep rebasing, though
Lt_Riza_Hawkeye··on Results of technical investigations for Storm-0558 key acquisition
sshd runs as root, so the core dumps would be readable as root-only, no? If you have root access already you could dump it even while it's still running with ptrace anyways
Lt_Riza_Hawkeye··on Towards HTTPS by Default
> How do they know this?

I believe the setting "Make searches and browsing better" (subtitle "Send URLs of pages you visit to google") under chrome://settings/syncSetup is on by default if you don't manually uncheck the send usage data checkbox when installing

Lt_Riza_Hawkeye··on Downfall Attacks
Simply removing the parameter didn't fix it? Or you just reinstalled grub to be sure it would work
Lt_Riza_Hawkeye··on Introduction to ActivityPub (2021)
Yes, plus if they support client-server then kill it later, they risk the same kind of backlash that happened to Twitter and Reddit when they killed third party clients. But if they only support server-server when they kill it, they can just send an email to all the geeks telling them "import your account into threads by X date!" and most "normal" users will never notice
Lt_Riza_Hawkeye··on Please don't say just hello in chat
Hey, are you there? I need a 2fa code for the netflix account
Lt_Riza_Hawkeye··on Minix development has been abandoned?
Not hard to believe for me: https://itsfoss.com/fact-intel-minix-case/
Lt_Riza_Hawkeye··on I tested services to extract colors from image
gpick is also a great piece of software on linux - unfortunately they got threatened by pantone or something and had to remove the good color names like "midnight moss", "mineral green", and "bombay". Everything now pulls up as "light green", "faded green", or "bluegrey". However, the rest of the functionality is the best you could ask for.

http://0x0.st/Hqoj.png

Lt_Riza_Hawkeye··on Intel Explores Transition to 64-Bit-Only X86S Architecture
Not to mention sabotaging AMD performance for all programs compiled with the Intel C Compiler
Lt_Riza_Hawkeye··on What happens when half of the IPFS network is down?
From my reading, they mis-configured it in their use of the library - using the default value instead would have avoided the problem.
Lt_Riza_Hawkeye··on C Strings and my slow descent to madness
Yeah, and I wouldn't say it's definitely unsafe. You can memchr a '\0' out of it (or not) to determine if a null terminator got in there or not.
Lt_Riza_Hawkeye··on Parsing the .DS_Store File Format (2018)
I believe if you've dragged some files around in that folder, it stores where those were. Or if you've set the folder to sort by name or date modified, etc.
Lt_Riza_Hawkeye··on Discovering one bug after another in the UTF-8 decoding logic in OpenBSD
okay... and something needs to be able to decode the text sent to it over the serial port. All the bugs pointed out in the article also happen if you use the serial port console
Lt_Riza_Hawkeye··on Down the Cloudflare / Stripe / OWASP Rabbit Hole
Overall I agree with you - the only caveat I have to offer is Cloudflare's support of eSNI. My opinion on CF used to be quite black and white, but there is at least someone in there (for who knows how long) contributing to the actual security of the web. Not mutually exclusive with doing harm in other ways.
Lt_Riza_Hawkeye··on Infinite-Storage-Glitch – Use YouTube as cloud storage for any files
Maybe it doesn't have a post of its own, but I found these esoteric storage methods greatly entertaining as well: https://www.youtube.com/watch?v=JcJSW7Rprio
Lt_Riza_Hawkeye··on Now offering 2TB SSDs for Steam Deck in the Framework Marketplace
It does
Lt_Riza_Hawkeye··on On “I don't trust microcode” (2021)
I begrudgingly trust microcode. The point isn't whether or not I do trust microcode, the point is I shouldn't have to - there's no reason for it to be so secretive
Lt_Riza_Hawkeye··on A 23-byte “hello, world” program assembled with DEBUG.EXE in MS-DOS
And before that, they were toggled directly into the machine using physical switches!
Lt_Riza_Hawkeye··on What's different about next-gen transistors
In-memory computing is just barely in active research. Unlike quantistors, memristors are being built (and have already been built) in many research laboratories.

If you are interested in learning, the idea of memristors (and other computational memory technology) is not to replace traditional memory, but rather to augment small portions of it with increased/additional computational functionality.

For example, you could add a (relatively speaking) extremely small number of memristors to an existing memory module, load two matrices into that area of memory, and reading from the adjacent region of memory would immediately yield the result of multiplying those two matrices. If you could simply instruct the RAM module where the existing data lies, this would be an immense boost in efficiency to AI/deep learning prediction algorithms. Here is a video explanation of how this could be use to perform matrix vector multiplication in O(1): https://youtu.be/30K5i8bdiyg?t=1492 .

That video mentions later that something similar can be used in solving linear and partial differential equations. Applications for deep learning training is discussed at 40:20 .

You'll notice everything discussed in the keynote has experimental results. At 41:27, he mentions that you can actually send images to their memristor chip over their website . Though the link is unfortunately dead, it definitely worked, and was in fact performing neural network computations using memristors over the network.

Lt_Riza_Hawkeye··on Qwik: No hydration, auto lazy-loading, edge-optimized, and fun
I wish there was a mode that gave me everything except lazy load.

I like the idea, though I do fear the level of complexity (while necessary for the problems it's trying to solve) will further push away non-web developers from the web space.

But my concern is that if I'm on spotty wifi, and I click a button or scroll the page, the actual behaviors of that button or the components scrolling into view may not function for a solid 5-10 seconds while my phone attempts to establish a connection. I love that the framework's demos make it really easy to see what's going on - for example, under the "Simple useWatch()" demo, you can see that the JS file that actually updates the page when the "+" button is clicked, does not get loaded from the server until the first time you click the button. Similarly with the "Below the fold Clock" button, that clock will be rendered correctly for some specific time (default to 10:20:30 in the example code) when you initially scroll down, but won't actually update to the current time until a network connection has been established, javascript downloaded, parsed, and executed - none of which kicks off until you scroll the clock into view, meaning you may be staring at a non-functional clock for 1-5 seconds until it snaps into reality.

It seems to me that there would be no downside to having these JS files preloaded in the background after the initial page load finishes. Curious why they went with the completely lazy loading strategy.

As an aside, it seems these JS files are loaded from a service worker. I have no idea why that would be remotely necessary, but it prevents me from playing around with this idea using the chrome devtools, as the service worker doesn't seem to be subjected to the network tab's "ignore cache" or internet throttling simulation (for example, returning the .js file in 2ms despite throttling being set to simulate a network latency of 300ms).

Lt_Riza_Hawkeye··on Meta Quest Pro
Also, FB doesn't sell user data either, so I'm not sure what OP was talking about
Lt_Riza_Hawkeye··on Attacking Titan M with Only One Byte
I would imagine it wasn't a hard decision - they likely needed to build something in an environment where they are already paying 40-80k C++ developers, and I would guess something like 1-10k Rust developers, who are scattered around various teams and may not want to hop on a new team right now. Also it was released to the consumer market in 2018, so probably built in 2016-17. Rust and other memory-safe systems programming alternatives didn't have nearly the same uptake back then - so maybe 1-2k would be a safer bet. Not to mention, Rust didn't get tier-1 ARM support until 2021 - and even then, that's only when running on linux, which the Titan M chip is most likely not running.
Lt_Riza_Hawkeye··on Programming languages endorsed for server-side use at Meta
Because the entire website is written in hack?
Lt_Riza_Hawkeye··on Ultra-flat timepiece, the RM UP-01 Ferrari, is 1.75 millimetres thick watch
Also, am I reading this right, you can only adjust it by hours? Do you just gently tap your special screwdriver and hope to try and adjust it in minutes at a time? And you have to wind it every single day, so have fun doing it all again if you have a busy week
Lt_Riza_Hawkeye··on A Quick Look at QUIC Censorship
> if SNI is not needed, than the ip address is neccesarily unique

I think your are confused about what SNI does. SNI is not part of the request, and it does not indicate to the server which website is being requested (this is the HTTP Host header, still in use as a pseudo-header in HTTP/2 and HTTP/3).

SNI is part of the response from the server back to the client. The idea is that if an attacker somehow poisoned your DNS to point the domain of one legitimate site (for example, paypal.com) to another (let's say pastebin.org) - your browser would notice the mismatch and refuse to load the page or send any potentially sensitive data to the server.

Furthermore - there is no need for it to be sent in the clear. Cloudflare in particular has thrown their weight behind a proposal/protocol extension called ESNI (Encrypted SNI), in an effort that truly turned around my opinion of the company.

Lt_Riza_Hawkeye··on Off-the-Record Messaging
You'll really only get authenticity if you've exchanged certificates in some offline manner first, and eschew the whole CA infrastructure
Lt_Riza_Hawkeye··on Python, unlike C, has the mod operator always return a positive number
My understanding from college was that C doesn't have a modulo operator, if you look at the spec (according to my professor (according to my memory)) it's called the "remainder operator". Modulo and remainder are not the same operation, so both python and C are correct
← PreviousPage 2 of 4Next →