HNHacker News
TopNewBestAskShowJobs

alright2565

1,667 karma · joined January 9, 2021

submissionscomments
alright2565··on I found a vulnerability. they found a lawyer
If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm.

For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field:

    import hashlib; print(f"MD5:      {hashlib.md5(b'password').hexdigest()}")
    print(f"SHA-256:  {hashlib.sha256(b'password').hexdigest()}")


    MD5:      5f4dcc3b5aa765d61d8327deb882cf99
    SHA-256:  5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
But if you use a proper password hash, then your hashing library will automatically take care of versioning your hash, and you can just treat it as an opaque blob:

    import argon2; print(f"Argon2:   {argon2.PasswordHasher().hash('password')}")
    import bcrypt; print(f"bcrypt:   {bcrypt.hashpw(b'password', bcrypt.gensalt()).decode()}")
    from passlib.hash import scrypt; print(f"scrypt:   {scrypt.hash('password')}")


    Argon2:   $argon2id$v=19$m=65536,t=3,p=4$LZ/H9PWV2UV3YTgF3Ixrig$aXEtfkmdCMXX46a0ZiE0XjKABfJSgCHA4HmtlJzautU
    bcrypt:   $2b$12$xqsibRw1wikgk9qhce0CGO9G7k7j2nfpxCmmasmUoGX4Rt0B5umuG
    scrypt:   $scrypt$ln=16,r=8,p=1$/V8rpRTCmDOGcA5hjPFeCw$6N1e9QmxuwqbPJb4NjpGib5FxxILGoXmUX90lCXKXD4
This isn't a new thing, and as far as I'm aware, it's derived from the old apache htpasswd format (although no one else uses the leading colon)

    $ htpasswd -bnBC 10 "" password
    :$2y$10$Bh67PQAd4rqAkbFraTKZ/egfHdN392tyQ3I1U6VnjZhLoQLD3YzRe
alright2565··on An AI agent published a hit piece on me – more things have happened
First one that comes to mind is https://morethanmoore.substack.com/
alright2565··on US businesses and consumers pay 90% of tariff costs, New York Fed says
I would love to see joint tarrifs, together with US allies, to fight against things like sweatshop labor, state-supported industry, etc. That would really send a signal that those things are unacceptable, and lead to change.

That's not what we have here, and that's not what the Trump tarrifs are perceived as internationally.

alright2565··on Discord/Twitch/Snapchat age verification bypass
ID is much easier to forge, it's just a flat 2-d shape. None of the physical security features come through in images.
alright2565··on [dead]
Their website is all AI generated and as far as I can tell, the only thing of substance on it is this cube: https://www.scraplabs3d.com/_next/image?url=%2FPXL_20260114_...
alright2565··on RS-SDK: Drive RuneScape with Claude Code
> rs-sdk runs against an enhanced web-based client (botclient) which connects to the LostCity 2004scape server emulator.
alright2565··on Lessons learned shipping 500 units of my first hardware product
> claims

That's all there is to it. Take a look at https://www.youtube.com/watch?v=5CJqAJ2LXw8&t=852.

alright2565··on Find 'Abbey Road when type 'Beatles abbey rd': Fuzzy/Semantic search in Postgres
Do you want it to run on your CPU, or someone else's GPU?

Is the local model's quality sufficient for your use case, or do you need something higher quality?

alright2565··on Fedora Asahi Remix is now working on Apple M3
Anti-trans hate.
alright2565··on Vibe coding kills open source
I misremembered :(

4.5 Sonnet, but because I've been stuck on 3.7 Sonnet for so long due to corporate policy I wrote the wrong thing.

And yeah corporate policy. Opus is not available. I prefer Codex for my personal coding but I have not needed to look in the Git history here yet.

alright2565··on Vibe coding kills open source
I personally don't have any trouble with that. Using Sonnet 3.7 in Claude Code, I just ask it to spelunk the git history for a certain segment of the code if I think it will be meaningful for its task.
alright2565··on SFPark: Interactive map of SF parking regulations
Sure, at the same rate as cars, $20/hr per 12.5m^2. Since I take up about .25m^2, my bill for today ought to be about $0.10, so let me know how I should pay it.

Or we can acknowledge the reason we have money: to distribute scare resources. Parking in urban areas is scarce and expensive, while space to walk and sit simply isn't.

alright2565··on White House alters arrest photo of ICE protester, says "the memes will continue"
The supreme court will declare them immune to the suit, if they haven't already done so.
alright2565··on Drones that recharge directly on transmission lines
It can be a closed circuit when using AC instead of DC.

Remember that the primary and secondary side of transformers never touch.

alright2565··on ChatGPT Health is a marketplace, guess who is the product?
The individual mandate part of the ACA was the part designed to reduce premiums. You need healthy participants in any health insurance scheme to subsidize unhealthy people.

That was eliminated by a Republican bill, the Tax Cuts and Jobs Act of 2017.

alright2565··on How to code Claude Code in 200 lines of code
But does that extra complexity actually improve performance?

https://www.tbench.ai/leaderboard/terminal-bench/2.0 says yes, but not as much as you'd think. "Terminus" is basically just a tmux session and LLM in a loop.

alright2565··on Google broke my heart
As far as I can tell, requiring valid ID would lose a provider safe harbor protection as it is not one of the required elements:

(3) Elements of notification.-

(A) To be effective under this subsection, a notification of claimed infringement must be a written communication provided to the designated agent of a service provider that includes substantially the following:

(i) A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

(ii) Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site.

(iii) Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate the material.

(iv) Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted.

(v) A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.

(vi) A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

alright2565··on The rsync algorithm (1996) [pdf]
If it was a 100GB image on the other hand—good luck! It'd be faster to copy it from scratch every time than to use rsync.
alright2565··on Tesla’s 4680 battery supply chain collapses as partner writes down deal by 99%
Note that you should never buy raw cells from Amazon. They are always fake or under-spec. At the very least, this seller claims "Multiple Protections" when this is a fully unprotected cell.

Distributors usually won't sell to regular consumers, but there are specialized retailers who base their reputation on selling quality goods, usually to the RC, flashlight, and vape market.

alright2565··on Never Use Pixelation to Hide Sensitive Text (2014)
The Flameshot screenshot tool uses an interesting variant of pixelation that does protect the text from unredaction: https://github.com/flameshot-org/flameshot/commit/533a1b7d55...

> Since pixelation does not protect the contents of the pixelated area (see e.g. https://github.com/bishopfox/unredacter), _pseudo-pixelation_ is used:

> Only colors from the fringe of the selected area are used to generate a pixelation-like effect. The interior of the selected area is not used as an input at all and hence can not be recovered.

The edges of the pixelated area are used the generate a color palette, and then each pixel is generated by randomly sampling from that pallete's gradient.

alright2565··on [dead]
I don't know. It's tragic but unfortunately not surprising there is still fighting.

My recollection is that during the early, and perhaps overly hopeful, days, left-leaning media avoided saying Trump's name when reporting on it.

alright2565··on [dead]
The two recent examples I can think of are the Gaza ceasefire, as well as the general concept (and not actual implementation) of re-industrializing the USA in the context of China's dominance.
alright2565··on Perpetual futures, explained
The problem with Tether is that they are tight-lipped about their backing assets. No one knows if the peg is real, it's just "trust me bro"
alright2565··on The last-ever penny will be minted today in Philadelphia
In Japan it is known as The Lost Decades: https://en.wikipedia.org/wiki/Lost_Decades

There is no "sane state" that is eventually reached, it is always painful. For Japan, it took the financial innovation of negative interest rates to finally address it.

alright2565··on The last-ever penny will be minted today in Philadelphia
Deflation is an economic disaster. The Great Depression, for example, was related to deflation.
alright2565··on My fan worked fine, so I gave it WiFi
https://github.com/flaviut/Honeywell-HPAx00-ESPHome
alright2565··on UPS plane crashes near Louisville airport
There's no need to zone for airport noise in Atlanta because the highway passing through the city center and hotrodded cars already are much louder and more disruptive in practice. I wish I was joking.

Also, the map you're looking at there is relatively low resolution. I would suggest looking at it in https://maps.dot.gov/BTS/NationalTransportationNoiseMap/; make sure to switch the "Modes:" to "All Modes"

alright2565··on Guideline has been acquired by Gusto
With how low fees have gotten, I think the more likely and more damaging situation is that where people's employers have negotiated much worse pricing for their captive audience. I wouldn't give 0.08% vs 0.037% a second thought any day. That's only difference of $400/yr on $1M!
alright2565··on KDE Connect: Enabling communication between all your devices
This doesn't seem needed to me, I've never seen an android app have a way to close it. Or any kind of battery life impact from KDE Connect for that matter.
alright2565··on Are we living in a golden age of stupidity?
This sounds nice, but what I've run into is that the model fails to write changes if the code has changed under it. A better tool, where it takes a snapshot at the start of each non-interactive segment, and then resolves merge conflicts with my manual changes automatically, would make this much easier.
← PreviousPage 2 of 10Next →