HNHacker News
TopNewBestAskShowJobs

anjbe

1,006 karma · joined February 23, 2014

https://anthony.roadrunner.page/

Electrical engineer from Albuquerque, New Mexico. Unix enthusiast. OpenBSD user and developer.

submissionscomments
anjbe··on Why did the OpenSSL punycode vulnerability happen?
bool, true, and false as native keywords are on track to show up in C23. https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2393.pdf
anjbe··on The latest OpenSSL vulns were added fairly recently
> I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore.

Theo Buehler talked about the current status of LibreSSL compatibility at EuroBSDcon last week. To take some quotes:

“> 2000 OpenBSD ports link against libcrypto or libssl” [i.e., LibreSSL]

“< 100 of these need patches (< 5%)”

“6 ports link against OpenSSL”

https://www.youtube.com/watch?v=bF1d_aCSzS0

anjbe··on HN mining or: How I learned that there are some among us with soft quotes
Good post! I must point out, though, the correct symbol for minutes and seconds is actually the prime. As in, 10° 33′ 19″.
anjbe··on HN mining or: How I learned that there are some among us with soft quotes
I do the same, except instead of xmodmap I use “setxkbmap -option compose:ralt” (plus a few other options) as described in the xkeyboard-config(7) manpage. It has some useful features: https://man.openbsd.org/xkeyboard-config.7
anjbe··on HN mining or: How I learned that there are some among us with soft quotes
In the old days of ASCII several characters were heavily overloaded. On teletypes it was not unusual to create accented characters by typing ` or ' (which looked more like ´), then backspacing and typing a vowel, to get (e.g.) è or é. The same could be done with ~ to create ñ, if the tilde were high up like ˜, or with " to simulate an umlaut.

And of course there’s the overload of hyphen and minus, such that Unicode gave up and named U+002D “hyphen‐minus,” and created two separate characters U+2212 “minus” (−) and U+2010 “hyphen” (‐) to use in situations where the typography matters. Most fonts seem to use identical glyphs for hyphen‐minus and minus, but I’ve seen some that try to split the difference, giving hyphen‐minus a glyph with a height and width somewhere in between hyphen and minus.

If you find minus and hyphen‐minus hard to distinguish visually, just remember that a true minus sign looks just like a plus without the vertical part. Compare the alignments:

- example (U+002D hyphen‐minus)

+ example (plus)

− example (U+2212 minus)

anjbe··on Security through obscurity is underrated (2020)
When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces?

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

anjbe··on Security through obscurity is underrated (2020)
If animals in nature had a defense against predators as effective as “PasswordAuthentication no”, they wouldn’t need camouflage.
anjbe··on Security through obscurity is underrated (2020)
> You can maintain a .ssh/config file with all the port that you used (and backup it)

Once you start distributing config files to all your clients you might as well switch to keypair authentication, which so completely reduces risk of intrusion that leaving sshd on 22 simply does not matter.

> that consumes resources (even if minimal)

I suspect practically immeasurable.

anjbe··on Security through obscurity is underrated (2020)
Do people using high ports actually check their logs enough for it to matter?
anjbe··on Security through obscurity is underrated (2020)
The thesis of the article, that security through obscurity is underrated, is “because it has a low implementation cost and it usually works well.”

But I contest both of those things. Common obscurity methods provide low benefit for the amount of work put in, relative to methods with a better foundation.

One of the best examples of this is port knocking, a resurging fad in self‐hosting circles, that is completely beaten both in simplicity and in actual protection by putting your SSH server behind WireGuard.

Even the example in the article seems ridiculous. I always advocate disabling SSH passwords and using FIDO‐backed SSH keys instead, but of course people will complain that they lose the ability to log in from arbitrary machines (well worth it in my opinion, but fine). So rather than using SSH with a weak password on a non‐default port, why not use SSH with a strong password on a default port, which provides more entropy and also some protection against attacks by a local user, without having to remember weird port numbers?

anjbe··on E. Nesbit used grief, politics, imagination to make a new kind of book for kids
The article mentions that two of her books (The House of Arden and The Railway Children) are being republished this fall. That said, her copyrights have expired, so they’re also available now as open‐source, public domain ebooks at Standard Ebooks: https://standardebooks.org/ebooks/e-nesbit

I was a big fan of Nesbit’s Psammead trilogy as a child: Five Children and It, The Phoenix and the Carpet, and The Story of the Amulet.

anjbe··on The deception of “buying” digital movies
Star Wars is a particularly salient example because the original cuts that made the films such cultural icons are completely unavailable from anyone other than third‐party sellers, due to the wishes of the (former) rights holder. After the Special Editions were released, the theatrical editions made it onto DVD one time, and never did again. J.J. Abrams has indicated that there are difficulties behind the scenes (perhaps some clause in the Disney purchase) that prevent the originals from being made available for sale. So people who want to avoid the CGI and bad redubs of the Special Editions are stuck scrounging eBay, or more likely, grabbing an “unofficial” scan of the theatrical editions.
anjbe··on The deception of “buying” digital movies
The article mentions GOG’s movie selection (which is indeed extremely limited: https://www.gog.com/en/movies). It’s worth pointing out that Vimeo also provides some DRM‐free digital downloads through its “On Demand” imprint (https://vimeo.com/ondemand/oxyana). Like GOG, though, it mostly contains works of a particular niche (in this case, documentaries and short films).

I’ve been hard‐pressed to find any other way to purchase DRM‐free movies.

anjbe··on An old Encyclopaedia Britannica is a work to cherish
Complete scans of Harvard Classics, a notable predecessor to Britannica’s Great Books collection, are available on the Archive: https://archive.org/details/harvardclassics?tab=about

Standard Ebooks also has a growing collection of formatted epubs of the Great Books—necessarily incomplete, as much of the full set is still copyrighted. https://standardebooks.org/collections/encyclopaedia-britann...

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
Another commenter posted a source that mentions in passing that ISO 8601 was the result of a 1978 UN declaration that Monday should be the first day of the week. Now I wonder where that came from!
anjbe··on Someday aliens will land and all will be fine until we explain our calendar
You’re not wrong that “the Sabbath day” has sometimes been used by Christians to refer to Sunday, but the context of this thread is that a comment claimed that calling Sunday the first day of the week is inconsistent with the Bible, and that’s plainly not true.
anjbe··on Someday aliens will land and all will be fine until we explain our calendar
Thanks for the link. It had another interesting fact:

> In 1978, the UN recommended that Monday be made the first day of the week in most countries. It was established in 1988, according to ISO 8601, an international standard for exchange and communication of date and time-related data.

I’m really curious about why the UN made that decision. Is this the primary reason so many countries now consider Monday the first day?

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
I’m actually really interested in this. Clearly in Jesus’s time the Hebrew week went Sunday–Saturday. That definition remained at least for long enough to make into Ecclesiastical Latin and further into, e.g., Portuguese (segunda-feira, etc.). So why does ISO 8601 go Monday–Sunday? Was it codifying existing practice in Europe? When did that practice begin? Was America colonized before Europe switched to Monday–Sunday, or is America’s Sunday–Saturday a fundamentalist reversion to something more Biblically accurate?
anjbe··on Someday aliens will land and all will be fine until we explain our calendar
> > What is agreed upon by near universal scholarly consensus is instead that Jesus was baptized and crucified.

> You're going to need an awful lot of citations there.

> Firstly, define the scholars you're referring to.

Not being OP, I’ll list at least John Dominic Crossan and James Dunn, who has said that the baptism and crucifixion of Jesus “command almost universal assent.”

Of course, I got those names from five minutes speed reading Wikipedia. But that’s two more scholars’ opinions of the scholarly consensus than you’ve provided.

> Also, what sources are they working from?

Surely this is the very definition of moving the goalposts. OP stated the scholarly consensus is that Jesus’s baptism and crucifixion are true (this, incidentally, was my existing impression of the scholarly consensus). Now you’re no longer just arguing that OP was wrong about that, but have moved on to claiming that any scholars and historians who believe in Jesus’s baptism are wrong because they have no reliable sources.

I have to admit, I’m not inclined to throw out my understanding of the scholarly consensus or which sources are reliable to argue the historicity of Jesus based on an unsourced Hacker News comment.

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
What’s unlikely about that? The Jewish seventh‐day Sabbath is literally the founding principle of the seven‐day week.
anjbe··on Someday aliens will land and all will be fine until we explain our calendar
I’ve seen this theory proposed, but is it actually widely accepted by historians? Wikipedia says that a connection “has been suggested”[0], which doesn’t seem like very strong wording.

[0] https://en.wikipedia.org/wiki/Shabbat

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
> Moreover, most of European countries where workweek starts on Monday already consider it the 1st day of the week, why can't US do the same and be done with it?

What benefit would we get from doing so? Metric I can understand the benefits of, though I also see why Americans are resistant implementing such a disruptive change in daily life. But shifting our definition of the week by one day provides no benefit that I can see, nor does keeping it the way it is cause any harm. The primary argument I’ve seen in these threads is “because the word ‘weekend’ doesn’t make sense,” but that’s not very convincing to me since I and every other American I know find the phrasing perfectly natural—and if we want to make the English vocabulary perfectly ‘logical’ and ‘consistent,’ there are far more disturbing malapropisms in common use to tackle first.

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
There’s a good exchange in the classic video game Star Control 2 (now open source, available in most package managers as “uqm”), when the player encounters a species of plant‐like alien:

>> I am Captain Zelnick from Earth. We come in peace.

> I am Captain Ala‐la’la. We come in peace.

>> Our starship is called Vindicator.

> Our starship is called the Tender Shoot.

>> We are the New Alliance of Free Stars from Earth.

> We are the Supox Utricularia from Earth.

>> You’re from Earth??? Hey! Are you just copying whatever I say?

> Oh yes, we apologize for the confusion, our homeworld is also called ‘Earth’, or more properly ‘Vlik’, which means ‘Perfectly Good and Nutritious Dirt’. ‘Earth’ is pretty close, is it not?

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
Then why does the US, a very young culture compared to Europe, universally consider Sunday the first day of the week? Calling Sunday the seventh day must be a very recent development.
anjbe··on Someday aliens will land and all will be fine until we explain our calendar
While the majority of Christians meet on Sunday and consider it the “new” Sabbath or the fulfillment of the Sabbath, in commemoration of Jesus’s resurrection, how does that relate to restructuring the week so Sunday is the last day? The Bible is clear that Jesus was resurrected on the first day of the week, the day after the Sabbath.

Matthew 28:1 (NIV): “After the Sabbath, at dawn on the first day of the week, Mary Magdalene and the other Mary went to look at the tomb.”

Mark 16:1–2 (NIV): “When the Sabbath was over, Mary Magdalene, Mary the mother of James, and Salome bought spices so that they might go to anoint Jesus’ body. 2 Very early on the first day of the week, just after sunrise, they were on their way to the tomb…”

Luke 24:1 (NIV): “On the first day of the week, very early in the morning, the women took the spices they had prepared and went to the tomb.”

John 20:1 (NIV): “Early on the first day of the week, while it was still dark, Mary Magdalene went to the tomb…”

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
Seventh‐day Adventists are definitely the most prolific Christian keepers of a Saturday sabbath, but they are not totally alone. The next most prominent groups I can think of are Seventh Day Baptists and Messianic Jews. SDAs are in the tens of millions worldwide, Messianics in perhaps the hundreds of thousands, and SDBs under one hundred thousand.

Although they’re fairly distinct traditions, in my experience each places great importance on religious liberty and separation of church and state, because historically all three groups have faced governmental persecution from blue laws. SDAs go so far as to believe Revelation’s mark of the Beast refers to a blue law to come in the future.

Messianics also have been known to face religious persecution in Israel. To the extent Christianity is viewed with mistrust by Judaism due to Christendom’s history of persecuting Jews, Messianic Judaism is further seen as an attempt by Christians to co‐opt or corrupt Jewish practices.

(Another fun fact: Seventh‐day Adventists hyphenate their name, but Seventh Day Baptists don’t.)

anjbe··on Someday aliens will land and all will be fine until we explain our calendar
The Quakers numbered their weekdays and also their months, to avoid referencing foreign gods in their calendar. https://www.swarthmore.edu/friends-historical-library/quaker...
anjbe··on Google wants to take on Dolby with new open media formats
An incredibly limited subset for sure. WebM with VP8/VP9/AV1 is a far cry from how Matroska is typically used, with supported codecs like h.264/h.265 and chapters, subtitles, multiple audio tracks, and linked external files.
anjbe··on Gen Z never learned to read cursive
I was taught D’Nealian in elementary school. I took to it fine, but within a few years decided it looked dumb, and dropped the tails and loops that looked out of place compared to the letter forms I saw in print. I learned cursive easily in third grade, and have used it in most handwriting ever since. Looking back, I have wondered whether D’Nealian had a positive effect there or not.

It’s pretty weird reading all these other comments about how useless cursive is. Certainly I think it’s more important to type well than to write in cursive. But while the vast majority of my life’s text output has been via computer, I still use handwriting in plenty of places—postcards, birthday cards, thank‐you notes, and so on. Am I just anachronistic

anjbe··on Ask HN: What are some of the best documentaries you've seen?
9/11, directed by the Naudet brothers. https://en.wikipedia.org/wiki/9/11_(2002_film)

Notable for containing the only footage I know of that shows the first plane hitting the tower, because they were already in the middle of filming a documentary about New York firefighters. Here’s a clip of that part: https://www.youtube.com/watch?v=miA8Td4oNcY

Page 1 of 10Next →