HNHacker News
TopNewBestAskShowJobs

TonyTrapp

3,924 karma · joined June 25, 2020

submissionscomments
TonyTrapp··on Have I Been Pwned 2.0
I signed up for domain search when it was still free. It requires verifying an email address that you shouldn't have access to, unless the email service in question is not set up according to RFCs.
TonyTrapp··on Have I Been Pwned 2.0
I used to have a primary email address as well (which occurs in several HIBP breaches). I never gave it up, I still have it to this day for sending personal mail. However, I started using service-specific email addresses (e.g. hackernews@example.org) at some point, gradually transitioning every account I registered somewhere to this new scheme. They all end up in the same inbox, together with the emails from the original address. If one of them ends up in a breach, I block delivery to that service-specific address and add a new one.
TonyTrapp··on Have I Been Pwned 2.0
example@example.org is at 65 breaches. Fun!
TonyTrapp··on Have I Been Pwned 2.0
I think there was an earlier blog post from Troy sometime ago describing that HIBP never stores unencrypted email addresses; i.e. they are all hashed and any lookups go against the hash, not the actual email address.
TonyTrapp··on FreeBASIC is a free/open source BASIC compiler for Windows DOS and Linux
And more specifically, "-lang qb" is more or less how FreeBASIC started out. The more modern dialects came later, and became the default, hence the addition of "-lang qb".
TonyTrapp··on FreeBASIC is a free/open source BASIC compiler for Windows DOS and Linux
I think FBEdit was the closest to that, but like with most other languages, it never reached the same level of integration and quality because forms are simply not first-class citizens in FreeBASIC, unlike VB where the whole development process evoled around forms. You always need native GUI code or use a GUI library like GTK to achieve the same in FreeBASIC.
TonyTrapp··on SMS 2FA is not just insecure, it's also hostile to mountain people
I'm not just thinking of trust in terms of whether the device will tamper with the data, but also stuff like: What happens if you just put the parcel in the locker and in that exact moment the internet connection cuts out? Normally the parcel locker would send some data to DHL servers (as made evident by the fact that the lockers can send a confirmation mail), how do you get that information out now? Of course you could queue it up until the next person arrives, but all of that seems... suboptimal to me.
TonyTrapp··on SMS 2FA is not just insecure, it's also hostile to mountain people
They always had internet access. Of course it is possible that they decided to rip out the internet connection in the new models together with the touch screen, but I heavily doubt that they want to trust the internet connection of a random stranger to do whatever important communication they have to do with their servers. The app only requires internet access because... well, it always needs internet access.
TonyTrapp··on SMS 2FA is not just insecure, it's also hostile to mountain people
> Are you sure that the locker has an Internet connection?

Let's put it like this: The old ones (with a display) definitely do, because they can send email notifications. I would be very much surprised if the new ones didn't. The main reason for requiring the app isn't connectivity to the outside world, it is that they can save money on the terminal screens, which get vandalized frequently in some areas. The internet connection is probably a fraction of the cost of replacing those touch screens every few months.

TonyTrapp··on SMS 2FA is not just insecure, it's also hostile to mountain people
Reminds me of DHL parcel lockers in Germany. The new ones don't have a screen anymore, so you are forced to use their app to use the locker, which somehow requires both a working bluetooth connection to communicate with the locker, AND you need a working internet connection on your phone. What's the point of that?! The parcel locker evidently already has a working internet connection, that should be enough.
TonyTrapp··on Mipmap selection in too much detail
Great article! If you think it has too much detail, you probably selected the wrong mipmap level for it ;)
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
It looks looks mingw actually has several options to base its own CRT on (including MSVCRT, UCRT and various VS runtimes). Still, in the context of OP's original post, we are talking about the mingw DLLs that may or may not redirect most of their duties to Microsoft DLLs, depending on how mingw is configured.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
Note that the project is using mingw, so it's not using any Microsoft DLLs for the CRT anyway. mingw brings its own CRT along.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
This code is not from the Petzold books. It literally includes and uses string.h, stdlib.h and time.h. It is not using WinAPI equivalents of C functions.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
I really didn't want to get into the specifics, because the situation is already complex enough without MSVCRT, but: Yes, it is. If you wanted to do a size-optimzied version of this particular program, it would be a good enough choice.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
Regarding your edit: the CRT is responsible for headers such as time.h and string.h, which you can find being used in todo.h. Their implementations are not provided by the operating system but by the C runtime typically supplied by the compiler (mingw in this particular case). Other headers such as windows.h belong to the WinAPI, and result in functions being imported from OS libraries such as user32.dll. They are obviously not linked statically into the program.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
The important thing in the context of the original question is that mingw uses its own C runtime (MSVCRT is old and incomplete - you would not be able to use it as a drop-in replacement for a modern CRT). You can link the mingw CRT statically or dynamically, and OP suggested that linking it dynamically would reduce the size. But that is only true for the main executable. You would still have to ship the mingw CRT alongside, which in return would increase the distribution size of the program again.

I hope that clears my point up.

TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
Some people value being able to support older OSes without shipping the entire UCRT as an optional component. Granted, this will become less and less relevant in the future...
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
The CRT is not part of the operating system, unless you count the UCRT on Windows 10 onwards (yes there is also a MSVCRT copy in the Windows folder that Microsoft strongly discourages you from using, so let's ignore that for now). So unless you link against the system-provided UCRT, you will have to either ship a dynamic or a static copy of the C runtime, and linking it statically will be smaller because that will only contain the few string and time functions used by the program, instead of the whole CRT.
TonyTrapp··on I built a native Windows Todo app in pure C (278 KB, no frameworks)
That seems backwards. If you need to ship the DLLs with the program anyway (they are not part of the operating system, after all), they will contain their full functionality, each one potentially with its own C runtime, etc. If you statically compile everything into a single EXE, there will be only a single C runtime, all unused functions can be trivially removed, etc.

DLLs only reduce size if their code is meant to be shared between different programs.

TonyTrapp··on I Want to Love Linux. It Doesn't Love Me Back
For you, it's writing scripts so that things work the way you want. For the author, it's writing scripts to be able to use the computer at all. And how would that work if you have to write the scripts in a state the computer doesn't work for you? That's the difference between being fun for you and being agonizing for someone who has to rely on it un order to use their computer.
TonyTrapp··on Connomore64: Cycle exact emulation of the C64 using parallel microcontrollers
> Completely on your side, just wondering how far back do we go?

The main difference is probably that many people had a C64 in their bedroom, so there's a lot of childhood nostalgia involved. Fewer people probably had a mainframe computer with punch cards in their bedroom. ;) Such emulation would probably be more interesting from a pure preservation perspective, and be less about nostalgia.

TonyTrapp··on Grand Theft Auto VI gets pushed back to May 26, 2026
GTA 3 triology = GTA3, Vice City, San Andreas
TonyTrapp··on Suno v4.5
None of the Acid House samples have anything to do with Acid House either. The Jungle samples sound more like Liquid Drum & Bass.
TonyTrapp··on The 12-bit rainbow palette
A HTML color hex code does not use all available bits in a byte but has a strict format. It's of the form #abc, where # is fixed and abc are hex digits (0-9 A-F), one for R, G, and B. Thus, each channel has 4 bits of precision.

PS: ASCII is a 7-bit encoding. "8 bits minimum" sounds like you are thinking in UTF-8.

TonyTrapp··on Dear "Security Researchers"
Just to be clear, this isn't a note from the Debian maintainers, but from the company that runs a mirror for various projects.
TonyTrapp··on Dear "Security Researchers"
See also this classic: "Source Code Disclosure of every possible project" on the Mozilla bugtracker: https://bugzilla.mozilla.org/show_bug.cgi?id=949446
TonyTrapp··on The 12-bit rainbow palette
Did you read the article?

> The palette uses a 12-bit colour depth, so each colour requires only four characters when specified as a hexadecimal colour code in a CSS or SVG file

TonyTrapp··on Apple and Meta fined millions for breaching EU law
eBay is very different across countries. In Germany, eBay listings are free again for private sellers after they noticed the exodus to other platforms. I know this is not the case in other countries, so talking about eBay as a general platform is very difficult.
TonyTrapp··on America's reputation drops across the world
Note that you can click on the Consent-O-Matic toolbar entry and submit the site for review (which I did).
← PreviousPage 3 of 27Next →