Hacker News Reader

ademarreon The vintage beauty of Soviet control rooms (2018)

This reminds me of "Why So Many Control Rooms Were Seafoam Green":

[0] https://bethmathews.substack.com/p/why-so-many-control-rooms...

[1] https://news.ycombinator.com/item?id=47518960

ademarreon A Proclamation Regarding the Restoration of the Dash

I am all for using proper typographic symbols, but it is unclear what place the precomposed ellipsis U+2026—what I assume you mean by “true ellipsis”—has in that canon, especially with the compressed form it takes in most fonts.

ademarreon Cloudflare outage on November 18, 2025 post mortem

Only if they are able to block the siteverify check performed by our backend server. That's not the kind of attack we are trying to mitigate with Turnstile.

ademarreon Cloudflare outage on November 18, 2025 post mortem

I integrated Turnstile with a fail-open strategy that proved itself today. Basically, if the Turnstile JS fails to load in the browser (or in a few specific frontend error conditions), we allow the user to submit the web form with a dummy challenge token. On the backend, we process the dummy token like normal, and if there is an error or timeout checking Turnstile's siteverify endpoint, we fail open.

Of course, some users were still blocked, because the Turnstile JS failed to load in their browser but the subsequent siteverify check succeeded on the backend. But overall the fail-open implementation lessened impact to our customers nonetheless.

Fail-open with Turnstile works for us because we have other bot mitigations that are sufficient to fall back on in the event of a Cloudflare outage.

ademarreon Gandi March 9, 2025 incident postmortem

Gandi was sold to a private equity firm in a leveraged buyout in 2019 [0,1]. Nothing good has happened with Gandi since.

[0] https://www.crunchbase.com/acquisition/montefiore-investment...

[1] https://news.gandi.net/en/2019/02/futureofgandi-the-adventur...

ademarreon IPv6 Is Hard

ISPs aren't helping either. Ziply Fiber only provides IPv6 with their 10 Gig and up plans, starting at $300/month.

ademarreon Frank Lloyd Wright's mile high skyscraper proposal (2021)

Neutraface has some similarities, including the low crossbar height. Fittingly, it appears to be used in materials published by the Frank Lloyd Wright Foundation.

ademarreon Frank Lloyd Wright's mile high skyscraper proposal (2021)

The lettering on the proposal is very interesting. I assume it was hand drawn. I can't find any typeface quite like it. Google Lens suggested it is similar to Copperplate Gothic, which it is and at once is not even close.

ademarreon Malware abuses Google OAuth endpoint to 'revive' cookies, hijack accounts

This would be a better link; the blog post on which the Bleeping Computer article is primarily based. They refer to it but never link to it:

https://www.cloudsek.com/blog/compromising-google-accounts-m...

ademarreon Analyzing New Unique Identifier Formats (UUIDv6, UUIDv7, and UUIDv8) (2022)

> it would be highly likely that multiple systems around the world would generate the same number.

"Highly likely"? No. You are ignoring probability. See UUIDv4, which does not use time or NIC/MAC but does use 122 random bits.

ademarreon Undetectable Watermarks for Language Models

Shazam-like fingerprinting for text. The complete LLM outputs wouldn't need to be stored, just the fingerprints along with some mechanism for trusted timestamping (could be Blockchain).

ademarreon Domain registrar Gandi gets bought out, removes free mailboxes

> I let it expire for a few days, now they are charging me $100/year!

It sounds like your domain name entered the redemption period. The high fee to restore a domain in the redemption period is mandated by the registry, not the registrar. So Gandi is not price gouging; they are required to collect that fee for restoring the domain.

ademarreon Why Domain Driven Design?

Speaking of billing, are there any good resources or examples for an engineer who gets thrown into this domain?

ademarreon Tangled issues with permanent HTTP redirects

Those are good words to use. That's how people should think of these redirects and use them, as long as you are careful to use explicit cache directives.

ademarreon Tangled issues with permanent HTTP redirects

There seems to be some FUD going on here. The solution to the OP problem is simply to use 301 redirects with Cache-Control headers to limit caching to some reasonably short duration.

It is true that browsers will cache 301 redirects eternally, but only if the server does not supply cache directives to indicate otherwise. For this reason, it is always advisable to include some cache directives in 301 redirect responses, like `Cache-Control: max-age=86400`. I'm surprised that this isn't more universally acknowledged as an important practice.

As far as search engines, there will not be a problem if a URL that used to return a 301 now returns a 200. The web changes, and search engines know that very well.

Add: There also seems to be a lot of confusion about the meaning of permanent. Permanent should not be taken to mean eternal. If I move to a new house, I consider that a permanent move, because I no longer live at the old address. But it would be unreasonable to assume that I will never move again. I might even move back to the original house! Such moves are like permanent redirects; I might have my mail forwarded, but it is not an indelible, eternal change. Temporary redirects (302, 303, 307) are more like leaving a sticky note on the door while you're out running an errand; you have not permanently relocated.

ademarreon Don't Pickle Your Data

No. That is not how it works.

https://docs.python.org/3/library/pickle.html

https://blog.nelhage.com/2011/03/exploiting-pickle/ (referenced from https://cwe.mitre.org/data/definitions/502.html#REF-467)

ademarreon Don't Pickle Your Data

That quote supports my statement. Notice that the serialized object is the thing that was constructed by the attacker, not some user data that you serialized yourself.

ademarreon Don't Pickle Your Data

> If you pickle data from an untrusted source . . . and then later unpickle it

That is not exactly right. The risk is when you unpickle data that was pickled by someone else or that was tampered with after you pickled it.

ademarreon SEC issues more than $17M award to a whistleblower

From the post:

> "As set forth in the Dodd-Frank Act, the SEC protects the confidentiality of whistleblowers and does not disclose any information that could reveal a whistleblower’s identity."

ademarreon ISPs can’t find any judges who will block California net neutrality law

As IMcD23 commented, the real link is here: https://arstechnica.com/tech-policy/2022/04/isps-cant-find-a...

It would be nice if the mods/dang would update the link.

ademarreon Those HTML attributes you never use

Google search used to use rel=prev/next to identify paginated sequences for indexing, but not anymore. https://twitter.com/JohnMu/status/1108717486424363009

As of 2019, Bing was looking at those links for URL discovery. https://twitter.com/CoperniX/status/1108790528773021696

ademarreon Is it stealing to read by the light of your neighbour’s lamp?

One of my neighbors has a bright light on a garage behind their house. It shines directly onto my backyard and I see it as light pollution. It is a nuisance for sky watching with my telescope.

ademarreon ISO should make all standards Publicly Available

Paying for standards is acceptable in a context where you are given a requirement to conform to some industry standard. But that is rarely how it works in software and networking. Instead of being told what specific standards are needed, often it is a process of exploration and discovery to learn what standards may be relevant to certain aspects of a system you are developing.

For example, I might read parts of a dozen different cross-referenced IETF RFCs just to decide what flavor of URL syntax I should accept in my API. At other times I might not even know whether a relevant standard already exists, so I skim a bunch of standards just to confirm it is necessary to invent a new thing. This would be very expensive in ISO Land, and the reality would be that the standards are never used.

Non-free standards for software and networking impede innovation. I can't imagine what the internet would look like today if the IETF and W3C charged for access to standards.

ademarreon RFC 3339 vs. ISO 8601

> software-related standards. We are an industry in which there are lots of independent contractors and self-employed people and small businesses, it is easy to be self-taught

Consider also the pace of innovation in software and networking—the internet at large. I think it's both a consequence and a cause of the change in culture you described.

ademarreon RFC 3339 vs. ISO 8601

There are very many things I never would have discovered and learned if IETF RFCs were not free. The most useful knowledge I've acquired about building things on the internet came from there.

Industries that are more reliant on ISO or other non-free standards are surely worse off because of it.

ademarreon Mechanical sympathy for QR codes: making NSW check-in better

I think he could have saved even more space in his final pass by uppercasing the business names:

HTTPS://S.NSW.GOV.AU/C/121321/Test+NSW+Government+QR+code (binary mode)

HTTPS://S.NSW.GOV.AU/C/121321/TEST+NSW+GOVERNMENT+QR+CODE (alphanumeric mode)

He ruled out full alphanumeric mode early on, prior to ditching Base64, but it's sensible to reconsider it by the time you reduce the URL this far. He goes on to allude to simplifying or even dropping the business names to save more space at the cost of lost functionality, but just uppercasing them seems benign to me.

It's a nice write-up all the same.

ademarreon Hacking YouTube with a MP4

Earlier this year people were setting false video metadata to bypass TikTok's duration limit and upload very long videos.

ademarreon Gmail password first character is case insensitive on mobile device

https://tools.ietf.org/html/rfc8265

ademarreon The naughty username checking system used by Twitch

> biometric government IDs

Yeah. An important, long-lived ID that will stick with an individual for their entire life, and that they may want to commit to memory. That seems like a good time to take a hypersensitive approach and adopt some kind of filter.

ademarreon The naughty username checking system used by Twitch

That's amusing, but I think it also highlights the effectiveness of the strategy. WNKR is excusable and defensible. WANK would not be.

Edit: But I'll concede that when your outputs are only four characters long and end users will actively interact with them (write them down, type them again later, etc.), additional safeguards might be appropriate. Or simply omit all alphas and use only numerics.