HNHacker News
TopNewBestAskShowJobs

RossM

1,355 karma · joined August 29, 2008

[ my public key: https://keybase.io/rmasters; my proof: https://keybase.io/rmasters/sigs/KmCzs7LC7r6fFECJb7t5rsG41ErUSgvwu_fMr9A451Q ]
submissionscomments
RossM··on Organised gangs behind rise in QR 'quishing' scams
It's got to be pure marketing - the British media certainly loves a buzzword, but I suspect that's more to do with their clickbait strategy. ("What is blishing? Have I fallen for it?"). Perhaps it helps some people compartmentalise, but I couldn't find any research that looks into any increased cognitive load.

Our workplace cybersecurity training introduces at least 1 new word each year. This year's was "vishing" which apparently is just social engineering/credential extraction that takes place over the phone. Of course, it's presented to non-technical users as a well-adopted term that is very important to know (for the checkbox quiz in 3 slides time).

RossM··on We need to liberate the Postcode Address File
I can't find any good information post-privatisation, but at least before 2013 the postcodes themselves were copyrighted by Royal Mail (likely Crown Copyright as with government data). There were attempts to enforce this in 2009[0]. I suspect the copyright is now owned by Royal Mail Group Ltd.

That aside, a practical issue is that Royal Mail still retains the rights to _allocate_ new postcodes for any new properties. Yet another failure of this particular privatisation.

[0]: https://www.techdirt.com/2009/10/06/uk-royal-mail-uses-copyr...

RossM··on Siemens' battery trains set to save £3.5B and consign diesel trains to history
For context, Thameslink operates a route through central London, and transitions from overhead power in the north to third-rail in the south. This happens when stopped at stations and is fairly quick - the pantograph/shoes are raised/lowered around the same time as the doors open - the dwell times seem the same as usual.

As for charging, Jago Hazzard has a video on a fast-charge trial[1] for a battery-only route. As it's using a modified tube train, I'd assume it's lighter and thus requires smaller batteries, but recharging from third-rail takes roughly 4 minutes.

[1]: https://www.youtube.com/watch?v=dV441HnVI34

RossM··on Ask HN: Host a website from a living room in 2022?
I did this for a bit. The main issue was that air intake on my older model was through the keyboard, so clamshell mode was inadvisable - not sure if that’s true of the newer models and M1 should run cooler.

If you’re wiping it and installing Linux it’s like any other server, but if you’re running macOS you’re open to a wider spectrum of vulnerabilities that wouldn’t normally apply (desktop software). Your apps could also have vulnerabilities that expose access to personal credentials, etc (e.g. filesystems, apple id) depending on your setup.

You can insulate yourself a bit with tunnels/proxies to expose specific services (e.g. cloudflare, ngrok).

I had a lot more peace of mind buying an old, cheap computer, raspberry pis, and eventually NUCs.

RossM··on Apple acquires UK open banking startup Credit Kudos
At least in the UK, all financing arrangements for phones, laptops are with Barclays and PayPal Credit https://www.apple.com/uk/shop/browse/financing
RossM··on Apple announces Self Service Repair
Correlates with my experience of late 2013 MBP batteries (it might be the same model actually). My original Apple battery lasted until 2019. Both of the iFixit replacements have lasted a year until not holding original charge, and just last night I noticed a cell starting to swell.

I doubt I'll ever find factory original cells again for the 2013 but if Apple sells them I'd consider buying a MBP again.

RossM··on NHS Covid-19 app update blocked for breaking Apple and Google's rules
> Nobody is forced to install the app at all (at least in the UK's case).

Unfortunately, that's not quite right. Citing the latest rules:

> The rules on what you need to do when a group enters your venue have changed. You must ask every customer or visitor to scan the NHS QR code using their NHS COVID-19 app, or provide their name and contact details, not just a lead member of the group. [0]

[0] https://www.gov.uk/guidance/maintaining-records-of-staff-cus...

Delving into the rules, it appears this applies to all sit-in venues, while takeaway customers are exempt. A paper-based system should be available, if you trust the business to handle your data responsibly (or forge fake data if not).

This morning at a cafe I was asked to scan the QR code "or we can't serve you" for a takeaway order. Clearly some misunderstanding, and I didn't press about a paper-based list as I hadn't read the details myself. Hopefully it's an isolated incident, but it wouldn't surprise me if there was some simplified comms (/FUD) about "just get customers to scan the code".

RossM··on Reddit: Online Presence Indicators
This feels like it's just designed to encourage rapid replies, like their chatrooms. I've always admired HN's time-delay on posting replies the deeper you get into a thread - it deliberately reduces engagement but seems effective at stopping things getting too heated.
RossM··on Improving DNS Privacy with Oblivious DoH
Using Cloudflare with DoH is documented here: https://docs.pi-hole.net/guides/dns-over-https/

You essentially run a little proxy server on your pihole setup, and configure pihole to use it as your upstream dns resolver.

E.g., a proxy server running at 127.0.0.1:5053 which uses the Cloudflare ipv4/ipv6 DNS over HTTPS endpoints. This can also use other DoH endpoints as desired:

    /usr/local/bin/cloudflared proxy-dns \
      --port 5053 \
      --upstream https://1.1.1.1/dns-query \
      --upstream https://1.0.0.1/dns-query \
      --upstream https://2606:4700:4700::1111/dns-query \
      --upstream https://2606:4700:4700::1001/dns-query
RossM··on Ask HN: What's your #1 productivity hack?
Not OP, but I never got on with forced stops either. I had some success treating it like a mini-deadline to achieve flow-state - work on something for 25 minutes, and if I don't feel like I want to keep going, take a break and try again.
RossM··on Zoom taps Oracle for cloud deal, passing over Amazon, Microsoft
I migrated the company's services from AWS to OCI at the startup I was at. The trade-off is simple, if Oracle can say $product runs on OCI, they'll put you in front of the biggest industry players who are using their POS, database - and since our sales pipeline pivoted around web integrations this was crucial. They also give a bunch of credits (as do the other providers).

We argued against it in the dev team, but it wasn't the worst cloud migration I've done. The console reminds me of early days AWS as it's essentially just VPC+EC2+S3, but it was refreshing to spin up a server without a pages of config being presented to you. We took the opportunity to containerise our older sites and ran everything in their managed k8s cluster. I very rarely had to use the console for anything, which tbh is a bit of a grab-bag of managed services beyond the core cloud offering. Terraform support is there if you need to do anything serious.

RossM··on Gitlab was down
At the bottom of the page they list availability of third party services used - Fastly has a warning symbol, and I imagine they put that CDN in front of everything.
RossM··on 600k concurrent websocket connections on AWS using Node.js (2015)
Interesting details; it would be nice to see how those ulimit/networking numbers were arrived at.

The title should have [2015].

RossM··on Show HN: I wanted to measure CO2 in my office, so I build a C++ WebServer/App
Adafruit sell a 1-60,000 ppm equivalent-CO2 sensor for £15. https://www.adafruit.com/product/3709
RossM··on Domain Registrar Can Be Held Liable for Pirate Site, German Court Rules
Daftness aside, I think the courts/rights-orgs have just correctly identified registrars as the weak link - see the ease of which a number of right-wing sites had their domains dropped. My experience with registrars doesn’t feel like they’re aiming to provide a quality service (with ancient web UIs for example) - they’re there for the volume recurring revenues. Hopefully domains will have their letsencrypt moment soon.
RossM··on Apple iOS 12.1.2 Has a Serious Problem
Turns out 12.1.2 is the non-optional “your phone is updating tonight” I received Wednesday. (Appeared to be mandatory anyway).
RossM··on Google Tried to Patent My Work After a Job Interview
Same experience here, perhaps there's a different agreement for social visits and commercial meetings.
RossM··on Ask HN: Which domain registrar and hosting provider do you prefer?
How are you finding it? I've been looking for an alternative registrar - currently with 123-Reg in the UK, and would like to find a reputable, tech-savvy, UK alternative (but at least CF has a UK office).
RossM··on Show HN: I made a script to generate self-signed SSL certs for local development
Thank you for sharing this; I infrequently have to write standalone shell scripts but every time I do I spend a while looking around for best practices and often just end up with some contradicting opinions.
RossM··on Product Updates Based on Your Feedback
> But what is the user facing benefit?

Syncing bookmarks, recently opened tabs, passwords, autofill(?). These are genuine benefits when you're working with laptops, desktops, phones and tablets. Whether they're worth the cost of data mining is another matter of course.

RossM··on Spiders Have Exploded Over Greek Town, Coating Everything in a 1000 Foot Web
A "population explosion".
RossM··on Ask HN: Where's the downvote button?
I always liked Reddit's intended approach: downvote comments that don't add to the conversation.

Sadly, votes are too easily mapped to agree/disagree or truth/falsehood - see the "1,800 karma" comment below as a key example, where it furthers the conversation but is downvoted "because they are incorrect".

RossM··on AWS icon quiz
My favourite AWS naming was when E became EC2, as in ECS.
RossM··on Freezing Python’s Dependency Hell
This is important (though I'm oddly yet to run into this issue with pip; I've only had conflicts with npm and composer before). Freezing dependency sources in Docker images and using (pip install --require-hashes -r requirements.txt) for development seems to cover everything.
RossM··on Lessons learned scraping 100B product pages
Their ML approach is most likely based on their https://github.com/scrapy/scrapely project, which uses instance-based learning (as I understand it, lightweight ML) to scrape other pages from a few examples.
RossM··on PHP 7.3.0 alpha 1 Released
If you remember that so, so much old PHP was reliant on global scope included from other files, it explains a lot of the DI obsession. If you were lucky, it was just a single bootstrap.php, but often not.
RossM··on Using Countdown Clock Data to Understand the New York City Subway
I feel it's worth reminding that there's a difference between autonomous trains, driverless trains and unattended trains. The L train is considered Grade of Automation 2 - it starts and stops itself, though it has someone in the driver's seat who controls the doors and gives control to the ATO system. Driverless (GoA3) trains move that role to a train attendant who controls the doors from within the train. Unattended (GoA4) trains function without needing an on-board operator at all.

The driver probably is just sitting with a hand near the emergency stop button most of the time, but they're still required to pay attention. I imagine it's harder work now that they don't have to necessarily concentrate to operate the train.

I live in London, where a lot of tube lines are already (or soon to be) GoA2, with the introduction of a part-GoA2 mainline service this year (Thameslink). I don't think we'll see a GoA 4 tube for many years; aside from the obvious union rows, you've got safety concerns (primarily platform-edge-doors, which can't be retrofitted to cramped stations), and there's mixed public opinion on the idea of being stuck on a broken down train in a tunnel without on-train staff. Then again, people don't seem to acknowledge that the airport terminal transfers are unattended GoA4.

RossM··on Ask HN: What laptop do you use?
How's the touchpad nowadays? I'm probably spoiled by Macbooks, but that's my one bug bear with the older model. It just feels very cheap and unresponsive.
RossM··on Mozilla working on in-page popup blocker for Firefox
Re: ML - I think it might be possible to do some sort of generic popup-detection: a container that's initially invisible, containing a clickable that the mouse accelerates towards shortly after becoming visible. With opt-in, they could use those detections that aren't reported to identify good use-cases (though sending passive data like that might not be very Mozilla).

The tricky bit will be getting rid of the darkened full-screen overlay as well as the modal, but I guess you could track element visibility changes/removals around the same instant as the mouse click.

RossM··on Show HN: Headless Chrome Crawler
I've done this recently actually. Take a look at the yukinying/chrome-headless-browser[0] image. You'll need to run with the SYS_ADMIN capability and up the shm_size to 1024M (you can workaround the SYS_ADMIN cap with a seccomp file but I didn't have much luck with that). Other than that oddness it works pretty well (and with Puppeteer 1.0, with far fewer crashes).

[0]: https://github.com/yukinying/chrome-headless-browser-docker

Page 1 of 19Next →