HNHacker News
TopNewBestAskShowJobs

MichaelGG

17,386 karma · joined February 20, 2010

mgg@giagnocavo.net
submissionscomments
MichaelGG··on Two Decades of War Have Eroded the Morale of America’s Troops
Can you elaborate on the oppressed genders, plural, that were recognised and included due to WW1 and 2? Female I imagine is one. Which others? And even then it was only the Soviets having women fight.
MichaelGG··on How to keep your ISP’s nose out of your browser history with encrypted DNS
TLS 1.3 mandates it, doesn't it? It's safe to say it's near enough to 100% (of clients sending) to not be worth mentioning outliers like yourself.
MichaelGG··on The dots do matter: how to scam a Gmail user
I, too, would expect that the most common pieces of software with massive amounts of engineering time invested get it right (but almost certainly with a performance hit). But I'd be unsurprised to find that one doesn't handle the http parsing spec correctly somewhere.

The issue is that such a spec is entirely unneeded and overly complicated. No benefit, only downsides. And for something as simple as basic parsing rules! Not even getting into anything that should be difficult.

MichaelGG··on The dots do matter: how to scam a Gmail user
This is a common issue with text based formats and ietf/RFCs. HTTP allows comments in some headers. And allows line breaks:

  H: hi
    Mom
Is the same as

  H: hi Mom
Bets on how many http clients and servers get this right? Without losing speed?

My guess is when you're not responsible for ensuring compatibility or having to deal with writing robust, fast, code, the temptation to be cute with your format overtakes things.

MichaelGG··on India’s Central Bank Bans Regulated Entities From Dealing In Virtual Currencies
A friendly AGI would replace so, so much more than just banking or institutions it makes no sense to even bring it up.

And this does not make them obsolete. The government will easily win. Bitcoin wouldn't have near the amount of adoption, even for drug markets if it was made illegal.

I don't get how anyone thinks governments are so weak or powerless. How some fancy math obsoletes or in any way inhibits a coordinated group with weapons and societal backing to use force.

Edit: And I like bitcoin and have been playing with it for years, when CPU mining worked. Enough so that I could retire if I find my all my old hard drives. I think it's cool and I don't buy into the existence of money laundering other than a fake crime used by lazy prosecutors and greedy governments. But still saying that government is obsolete... come on.

Forget crypto, governments are moving towards banning cash which is far more threatening to our liberties.

MichaelGG··on NTSB ‘unhappy’ with Tesla release of investigative information in fatal crash
Follow your thought through: what prevents them rewriting an alternative blockchain history?

Why can't they apply that to digital signatures with timestamps? This is a solved problem for years. You could use the NSTB as a timestamping authority.

MichaelGG··on The End of Windows
Lenovo still sells 768p screens in their high end X-series laptops including the very recent X280.
MichaelGG··on NTSB ‘unhappy’ with Tesla release of investigative information in fatal crash
Blockchain provides zero benefit in this case. People on HN are tired of people ignorantly (sorry) saying blockchain. You should state, for starters, why simple digital signatures are not enough.
MichaelGG··on ThinkPad X1 Carbon 2018 review: The only laptop in a professional’s paradise
They tried that a few generations ago with the X240 etc. It was a complete disaster. The buttons are critical. Many people, myself included, find every aspect of the Mac poor ergonomics, including the touchpad. The trackpoint buttons work great along the top. Especially to easily hit middle button. I'd have to see someone in action to understand why they need even more space.
MichaelGG··on VPN leaks users’ IPs via WebRTC
I'm not sure what that means. It was obvious this would be used for fingerprinting and leaks. The explained reasons for proceeding was that permission prompts for data channels would hurt usage, despite not having clear cases where we need P2P without letting users know.

And none of this excuses overriding the user's expressed network connectivity.

When this was brought up, they immediately jumped to the excuses that fingerprinting can't be helped. And many jumped to saying hey you should use Tor Browser anyway. Total capitulation.

Maybe someone cared, but it's not the official stance from webrtc groups or browsers.

MichaelGG··on Google Has a Striking History of Bias Against Black Girls
Ok so why is she searching for "black girls"? I don't search for "Canadian guy". Outside of wanting a generic/stereotype photo, what're the reasons?

Same for "professor style" and expecting to get something other than that stereotypical brown sweater with elbow patches look.

MichaelGG··on Google Has a Striking History of Bias Against Black Girls
No, Google does not try to mirror content. It tries to provide the best results for users. Results the user wants to click on and are relevant. Searching for "professor style", nobody wants it to return a minority professor style. Even she doesn't, at scale. If she and others did, they'd be Googling "professor style", not clicking, then Googling "professor style for black women" and results would improve/personalize.

Ditto for "black girls": either your looking for porn or for stock photos. What other intentions do you have with such a query? (Besides making a point?)

Google changing results for Holocaust "denial" is likewise wrong. Someone searching for such things probably wants to find all such sites and not just a PC version of history repeating what they've already heard. Otherwise they wouldn't need to be searching in the first place. Same for someone searching "Is the moon real" or "is the earth flat".

In a great market, Google might start "cleaning" up their results to the point of annoying people, who would then switch. Unfortunately no one comes close to Google search, let alone overall lock-in. So we're stuck with whatever Google decides reflects their brand, including fixing up well-publicized queries for people that want to be offended and complain about stuff.

Edit: I search for "best basketball player" and all I see are black guys -- way over-represented. Why doesn't Google bump up Larry Bird to 4th place so there's some more diversity and fight the stereotype? Even worse, Yao Ming is nowhere to be found, what's that say?

MichaelGG··on VPN leaks users’ IPs via WebRTC
I'm only going off some in-person dealing with folks behind WebRTC and they know that permissions suck and would hurt adoption and hence fight to make sure they don't happen.

They dismiss all privacy concerns with "you can't have privacy in a browser" and "fingerprinting will work anyways so we can't make it worse". It's head-in-sand approach to privacy and it's bad.

Even then, Firefox is simply wrong to tell people it'll use your proxy, then throw that out.

MichaelGG··on VPN leaks users’ IPs via WebRTC
Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP?

They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of those are inherited from HTTP. Tell me how many HTTP stacks handle comments and line folding properly...

It opens up security holes, too. One proxy interprets \r\r\n as 1 line break, another as 2 line breaks and start of body. Oops, now you can end up sending fun headers to your target because they try to be flexible in accepting input.

IIRC there is essentially no way to implement SIP standardly because of so many broken implementations. You have to make some decisions on certain parsing that will break one but any other way will break another.

Text-based protocols invite abuse by designers and implementors alike. IETF compounds these by living in a fantasy world.

MichaelGG··on Google Has a Striking History of Bias Against Black Girls
What did she expect for "professor style"? If I were hand-delivering results and knew it was from a black, asian, or white person in the US, why would I return different results? Someone entering a general query like that probably wants what the common interpretation is. Which is not going to be a black professor. Searching "professor style for black women" returns the results she presumably thinks should be the default for her.

As much as I hate Google, they seem to be delivering exactly what they should. Their job isn't to try to change people's minds, it is to find what they are looking for. What's next? Search for "geek guy" and it's all white. Should we be upset? Someone searching for "geek guy" is probably looking for exactly what Google returns in this case and all the others she highlights.

As far as "black girls"... What kind of results are people expecting? Who is actually searching for black girls? Probably people looking for porn... Why should Google return suboptimal results because you got offended?

Same for "three black teens". It's not Google's fault that so much news is reporting on crime committed containing that phrase. Did she actually check crime statistics? Maybe "three black teens" get mugshots and commit crimes together at a vastly higher rate than "three white teens". Outside of porn, who is searching for this phrase? If you want "clean" and friendly results, try searching "stock photo three black teens".

If anything, this article shows that Google's personalization should detect people that want to search things (that they wouldn't really search for in earnest) in order to be offended then display poor quality results to avoid this "issue".

In truth though, I would imagine that if she and other black women often searched "professor style" then didn't click any results and immediately searched for "professor style for black women" then Google would pick up on their results being suboptimal and change. My guess is that no one actually makes these searches outside of making a political point, so personalization cannot fix it.

MichaelGG··on VPN leaks users’ IPs via WebRTC
This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission.

But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels.

Firefox is absolutely in the wrong to ignore your proxy settings, especially without getting consent first to start a call. It's a complete mess. Regardless of what the "spec" says, Firefox is responsible for implementing broken software that harms users.

Then again, so is STUN/ICE and basically every single thing that has to do with SIP/VoIP. It's like they go out of their way to be obtuse and come up with shitty standards then take glee in how bad it gets. As an example, look up SIP Torture Tests. There's an RFC just to illustrate the moronic edge-cases in SIP parsing that at one point implies your software needs to be conscious to infer the intention of malformed messages.

t. been working in telecom for far too long

MichaelGG··on [dead]
He's an ex ambassador to such regions and his explanation is completely coherent. What do you mean it makes no sense?
MichaelGG··on Ask HN: Why is PayPal's password length limit still a thing?
So on a modern machine that might mean a user can submit a 1GB password?
MichaelGG··on Ask HN: Why is PayPal's password length limit still a thing?
I've no insight to PayPal. But MS Live aka Passport aka Microsoft Account has a 16 char, limited character set limitation. I spoke with people that worked on the system. Basically, sometime a long time ago, someone made some code that checked this. And over the years, many other parts of the pipeline ended up coding it and depending upon the same restriction. They're aware of it, but it's not a worthwhile time investment versus other work. People don't get hacked because of the limit, they get hacked via phishing, reuse, etc. Spending time testing, debugging, fixing old code across disparate systems with possibly different owners is a big cost. There's higher priority work to be done, even within security.
MichaelGG··on Ask HN: What laptop do you use?
The 440 and 540 have the ridiculous no-button trackpad. So bad even Lenovo reversed position for the next gen. You can buy a 450 or 550 trackpad to replace it for under 100$. Will make a huge difference.
MichaelGG··on Ask HN: What laptop do you use?
Is the heat as bad as reviews say? The X250 seems to be the last X2x0 with a reasonable heat signature. In can't stand having the keyboard be even warm.
MichaelGG··on Ask HN: What laptop do you use?
Everyone I get to try a real ThinkPad loves them and can't imagine how they operated before. The new ones even come in white so you can look cool.

Personally I like the X250 (12”). The newer models get a bit hot. The X1 is often enjoyed. I'm also good with the T4x0s which are slim but have even better keyboards.

Unfortunately you're forced into choosing between the models which force tradeoffs as far as screen resolution, heat, keyboard off-centre (15" models have a numpad which unbalances things). Lenovo refuses to allow you to get a no compromises model.

Linux suppose is good, though I'd suggest Windows as host OS then run everything in a VM. Less hassle with drivers that way.

Other competitors are worse than Lenovo. I find MacBooks unergonomic with horrible heat issues. Asus makes cute stuff but feels sorta cheap. No one seems to ship great keyboards.

MichaelGG··on YouTube will add information from Wikipedia to videos about conspiracies
Even worse, Israeli false flag bombings in Egypt. They attempted to frame the Muslim Brotherhood. This was just a couple years after Israel got statehood. They denied it until 2000. "Lavon Affair" if you want to look it up.

USS Liberty, Israel continues to deny they did it intentionally and that there was any pressure to cover up.

MichaelGG··on Representing the Impractical and Impossible with JDK 10 “var”
It's essentially what SSA is.
MichaelGG··on It has gotten much easier to wage record-breaking DDoSes
There are a lot of technical reasons. At the wholesale level there is no way to know if a source is valid. Even AT&T routes to dozens of providers for some calls and has no idea what is going where. Even local calls from someone in your own city might end up on someone else's VoIP network to get connected.

It is true though if the FCC started handing down fines that VoIP providers would require insurance/bonding all the way up. That would not fix it all but would be a large jump forward.

We also need end-users to force the issue. File suits and complaints. Every time we'd receive a complaint the resolution was "we blocked that number" and "we have no further info". If there was someone pushing a lawsuit through then suddenly everyone up the supplier chain would hand over their customer info right to the real end-user.

Instead, the FCC runs silly programs like their Anti-Robo-Dialer thing.

MichaelGG··on Representing the Impractical and Impossible with JDK 10 “var”
>It makes sense in "let x in {}" type expressions

Without jumps, all code can be rewritten to be a series of "let x = ... in <expression>"

The fact Java has statements instead of everything being expressions is a design flaw and should be rectified not glorified.

MichaelGG··on An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported
What's the point of reporting? We had an issue with a sysadmin. Ended up firing him but didn't revoke all his credentials in time. He logged in and deleted all our Azure servers and rm -rf'd our GCP boxes. MS wouldn't help us at all, but Google's console log showed the login from the guy's town. What're we supposed to do? He was in England and we the US.

Had a similar issue with a hacker that found a way around our billing systems. Ran up $90k of charges. He was in Montreal and we even had his ID. What're we gonna do, waste time trying to go after someone that'll claim it was our bug and he didn't know anything was wrong?

MichaelGG··on 2017 Homicide Rates in Latin America and the Carribean
It is a good thing in countries that are fairly low crime. In places where the criminals operate with impunity, we need a bit more reactive violence. If the police are useless, criminals should at least be worried about being summarily executed during their attacks on other citizens. Instead, it's backwards. Law abiding citizens have no recourse.

Civil liberties aren't worth much when you can't freely travel and live in the first place. Sure, a few innocents will lose out with an abridged justice system. But that's already happening at a high rate.

And sure, they could also just turn the country around. Get foreign countries to run ministries, get a whole new police force, increase resources to the justice system 10-fold. But tell me what's more probable, that, or just taking a hard stance, have swift summary justice and giving citizens strong defence rights?

MichaelGG··on Boris Johnson proposes a 22-mile bridge across the Channel
>xenophobic

Yeah there's no way any friendly, rational person can look at Mexico and possibly come to the conclusion of "no thanks, I'd prefer not to have that here".

Mexico has no problem with extreme prejudice towards the rest of Latin America. Policies that people would decry x1000 if the US did them to poor Mexicans. But somehow the US applying some basic restriction to Mexico is "xenophobic" among other horrible phobias.

MichaelGG··on 2017 Homicide Rates in Latin America and the Carribean
What's the racial make-up of this violence in Sweden Vs the US? Sweden should have zero spots that rival US cities for violence.
← PreviousPage 3 of 34Next →