HNHacker News
TopNewBestAskShowJobs

bmitch3020

720 karma · joined September 5, 2017

OSS maintainer of OCI projects, including regclient, olareg, and a few of the specs.
submissionscomments
bmitch3020··on Stopping bad guys from using my open source project (feedback wanted)
Do you want to spend your time creating a project the world finds useful, or do you want to make a political statement that gets ignored? Because any attempt to restrict the license turns into the latter.

If the project is even slightly useful, but with a restrictive license, someone else will create an alternative with a free license. The community will quickly move, and the time spent trying to push a political opinion will be wasted.

In the long term, a free software license is always going to win. Even when it's unsustainable for one maintainer, the software remains free, and if it's useful enough, others will take on the maintainer role.

For sustainability, that's going to be a mix of lobbying your government, and companies realizing they need to hire developers because the open source maintainers aren't able to do everything for free. Just realize that governments are slow with conflicting goals. And companies will minimize their costs, leaving the average open source maintainer at the edge of being sustainable.

bmitch3020··on How good engineers write bad code at big companies
I'd simplify this post down to this: companies optimize the trade-off between time, cost, and quality by sacrificing quality.

It's not that the goal is to write low quality code, it's that big businesses understand the sales cycle and how to maximize profits. If they over spend on employees, that cuts into their profits or causes the product to be too expensive. And if they spend the time to write quality code rather than developing features, they lose sales. Customers don't buy quality, they buy features at a price, and quality issues (like bugs) get thrown over the wall to downstream support staff.

As much as I dislike this, knowing how unstable it makes the overall software ecosystem, companies aren't wrong for making these decisions. The companies that choose differently don't become big businesses, they either stay small, get acquired, or go out of business.

bmitch3020··on My private information is worth $30
I wonder how much more organizations would value PII if we could legally demand all of the PII of the executive officers for that same price.
bmitch3020··on CoMaps emerges as an Organic Maps fork
The underlying maps are from Open Street Map[0], so you can contribute fixes.

[0]: https://www.openstreetmap.org

bmitch3020··on Canadian boycott of US travel shows no sign of slowing
A boycott is a form of protest. There's more than just a protest happening here. Foreigners are legitimately afraid to travel to the US after seeing stories of others being detained and treated inhumanely.
bmitch3020··on Who still uses cash?
While the data is interesting, this graphic is a terrible choice. There's no value to being a pie chart where every slice is the same width. And the colors only seem to be a second indicator of the same percentage.

This could have been a standard bar chart, allowing all the text to be easily read. And the colors could have indicated something like the average income to make it easier to see the outliers.

bmitch3020··on Boring Company fined nearly $500K after it dumped drilling fluids into manholes
A $500k fine for someone worth $1T is equivalent to a $0.50 fine for someone worth $1M.
bmitch3020··on US air traffic controllers start resigning as shutdown bites
http://archive.today/aKDPo
bmitch3020··on We reduced a container image from 800GB to 2GB
This whole article could have been much better written as: learn to build images with a Dockerfile/ Containerfile or similar tooling, and store logs in a volume rather than the image filesystem. Everyone that builds a process around `docker commit` is simply in a race against time before they learn this lesson.
bmitch3020··on Introducing architecture variants
I believe it's just discussions right now. If/when something happens, I'm hoping they'll update the wiki.
bmitch3020··on Introducing architecture variants
https://wiki.debian.org/ArchitectureVariants
bmitch3020··on Public trust demands open-source voting systems
Some of the comments here seem to be associating electronic voting with these electronic voting systems. The systems described by this project all have paper ballots and audit trails, they're electronic assistants in running a paper ballot election.

I've only worked a couple elections in a single US county, so I don't claim to be an expert. But the projects described by the company align with each of the devices we use in elections today. Using their software would be the equivalent of moving from MS Office to LibreOffice for operating the government. It won't solve everything, could have bugs, but there are some significant long term advantages, like not depending on a company that could go out of business for security patches.

The first device voters encounter is people working the electronic poll books. We still have a paper backup available, but prefer the electronic versions. First, they can scan the barcode on the drivers license for a quick check-in (usually). When person shows up at the wrong location, we immediately know without spending a couple minutes looking through the paper list. We can even tell them where their voting location is rather than "you're not on the list, we don't know why". When someone needs to vote from their car, we can take a poll book with us and check them in curbside, no extra back and forth. And anyone can check-in at any poll book, rather than splitting the list up by last name. If there is ever a hack of the poll book, changing the list of voters, that could have also been done with the paper backup, and that's why there's a provisional voting process.

After that, over 99% of voters get a paper ballot. They mark their oval with a pen, and take it over to the scanner. This is where the security happens. There's a paper audit of the vote, and the vote is anonymous, your name is not on the ballot.

Less than 1% of the voters ask to use a ballot marking device. They are there for ADA requirements, allowing people that have difficulty marking a ballot by hand to vote. They have headphones to read the choices if needed for the blind. When finished, their choices are printed on their paper ballot, human readable and verifiable, and taken to the same scanner used by other voters. Most people don't even realize ballot marking devices exist, I didn't before I started working the election, and I've yet to see anyone request to use it.

The next step is where people get suspicious. The paper ballots are run through a scanner at the precinct, by the voter. These are monitored by an election worker to ensure the voter scans their ballot, but we stand so we can't see the ballot choices for voter privacy/secret ballots. These machines output a tally in multiple forms at the end of the election, including multiple paper copies and USB drives. The various copies get split up and separately delivered, each by a team of workers, for both redundancy and to ensure no one person is ever alone with the results.

A very important process happening throughout the day is counting the votes. The number of voters that register in the poll books is compared with the number of ballots given out (when ballots are unwrapped, they are counted, and what remains at the end of the day is counted again), and also the number that went through the scanner. Things get complicated (I assume reports are made after an extensive search is done) if we are ever off by one ballot in those counts.

The common fear that someone could stuff the ballot box, even by an insider, doesn't match my experience. In addition to the counts above, multiple workers, from multiple parties, are assigned to each precinct. We don't leave the ballots at any stage unattended at any time.

At the end of the day, the tallied ballots are sealed in a box. All equipment is locked back up. And lots of items (tallies, USB disks, sealed ballot boxes, provisional ballots, etc) are returned by a team of people that night to the county government building. From there, initial counts are released and then the election needs to get certified. That's where my personal experience ends.

The certification process includes deciding which provisional ballots to accept, and then counting them. But it also includes audits of the equipment. And those audits are supposed to take some boxes of ballots from select precincts and run them through a different a scanner to verify the tally is the same. The precinct scanners are also audited before we receive them, which is visible because a permanent count is tracked on the machine that's never zero for us, even when it's a new machine that's never been used in a previous year's election. In addition to all those electronic counts on different equipment, some percentage of ballots is likely hand counted. This certification process all happens over the course of days, if not weeks, but the initial count is usually out in a few hours when a first team of workers brings back one of the two USB disks (along with other items).

There are ways to hack an election, but these electronic machines are at the bottom of my list. Someone would have to alter the counts from the scanners without adding or removing votes, in a way that doesn't get caught in an electronic or hand audit in the future on independent equipment, and doesn't get detected in an audit of the machine before it is placed in service. And the whole process is constantly watched by workers from more than one party affiliation.

Instead, if you wanted to hack the election, you'd first become a billionaire, and buy all the media companies to ensure the population only sees one opinion. Then you'd gerrymander the election districts so most elections aren't really contested. And in locations where it might be close, you fill it with ads and social media misinformation so that voters don't know what to believe and they follow the loudest voices that repeated the most. Not only is that a lot more likely to work, but there's no chance of any consequences if you get caught since it's not illegal.

bmitch3020··on GlassWorm, Self-Propagating Worm Using Invisible Code Hits OpenVSX and VSCode
Previously submitted at https://news.ycombinator.com/item?id=45647853
bmitch3020··on Jimmy kimmel should have strong odds at the Supreme Court
Assuming Kimmel wins a lawsuit, if that lawsuit is against government officials, couldn't Trump immediately pardon those officials, overriding the courts?
bmitch3020··on The share of Americans having regular sex keeps dropping
This can be summed up as a time and money problem.

Time has disappeared as people attempt to do everything themselves (work, cooking, cleaning, managing finances, etc) that may have been shared or outsourced in the past. But time has also disappeared into intentionally addictive apps on our phones. Every commercial game and social media site is designed to maximize your eyes.

Money seems to be ignored by the article, but every generation is worse off than their parents, as wages stagnate, housing skyrockets, student loan and medical debt keep going up, leaving less and less disposable income. With finances so tight, people cut back on group gatherings that have an associated expense (bars, concerts, etc). And raising children becomes unaffordable.

Personally, I blame billionaires, including their influence on tax policies, suppression of wages, and the creation of monopolies that push up prices. The elimination of sex is just one of many side effects of a much bigger issue affecting the working population around the world.

bmitch3020··on Ghrc.io appears to be malicious
Blog author (and OCI maintainer) here. The request to get a bearer token sends the password or PAT using the basic auth header, base64 encoded, but otherwise clear-text. That's the request the www-authenticate header is triggering. Once the token is received, the registry uses that to verify access, and that eventually expires. But the attacker isn't getting the token, they are requesting the credentials that would be used to acquire a bearer auth token.
bmitch3020··on Americans are having less sex and researchers are blaming Netflix
I don't think you can blame one thing.

I blame smart phones, but blame is a strong word. We no communicate with texting, social networking, and many other means than in-person conversations. Teenagers are electing to get a drivers license later in life because they don't need a car to be connected to their friends. Less in-person interaction results in less opportunity for intimate interaction.

I blame the womens movement, and that's a good thing. More women are placing their careers first, and getting around to having a family later and later in their lives.

I also blame the economy. The recession ended technically, meaning we stopped getting worse. But our economy isn't seeing the wage growth that would indicate a prosperous environment that encourages recreational activities, and procreation.

bmitch3020··on Escaping Docker container using waitid() – CVE-2017-5123
> In particular if you are setting per-container usernamespaces, like you ought to be, then this exploit doesn’t do anything.

User namespacing in docker is enabled at the daemon level, not per container, so all containers share the same offset. This would ensure that a root user in the container would escape to a different uid on the host, but doesn't prevent someone from moving sideways through the containers on the same host.

Note that enabling this will break the developer workflow of mounting files from the host into the container. I believe files will show up with the wrong ownership inside the container.

bmitch3020··on Evidence-Based Guidelines for Writing Questions on Stack Overflow
I've seen my share of downvoted and closed questions from others, and often it comes down to users expecting the site to adapt to their needs rather than realizing they are a guest on someone else's site. SO doesn't exist to be your personal support site where others are obligated to help you on your terms.

When you're a guest, you follow their rules. And their rules are fairly simple:

- Stay on topic

- Don't duplicate existing questions (look before you ask)

- Ask a specific question ("how do I fix it?" is not a specific question)

- Be polite (no one is getting paid to answer your question)

- Don't be a spammer (and avoid looking like a spammer)

With coding questions, it really helps to:

- Reduce the problem to a specific detail and be concise, if I haven't finished reading the question and have an idea of the answer in 30 seconds, I move on.

- Provide enough detail that someone else could reproduce your issue. So many people assume I have remote access to their laptop, not to mention what they are thinking inside their head.

- Write it in English, with punctuation, and capitalization. If there's a 10 line block of text without a single capital letter or period, I move on. Same goes for anyone with their capslock key stuck in the on position. I try my best to understand non-native English speakers, because I sure can't talk in their language, but sadly when there's a language barrier, I move on fairly quickly.

bmitch3020··on How I went from programming to consulting (2012)
The simplest answer I like is:

Employee: Does what the boss says, and works when the boss wants them to work.

Contractor: Does what the client asks them to do, but has the flexibility to do it on their own schedule and according to their own way. In the US, the IRS may want to reclassify you as an employee if you dictate too much of how the work is done.

Consultant: They review what the client is doing and recommends what they should be doing, often performing that work too. The key difference to me is the client accepts they may not be the most knowledgeable in what change they want to make.

To give examples for programmers:

Employee: works on a app in the office from 9-5 adding the features requested.

Contractor: adds requested features to the app.

Consultant: reviews the app and proposes some features to add.

bmitch3020··on LightVM – A new virtualization solution based on Xen
VM's tend to lose the overlay layered filesystem which can dramatically reduce disk usage. Having the filesystem reset to a clean state for every new container is a huge feature of containers. And VM's tend to need predefined dedicated resources for things like memory. A process in a container would only allocate memory when it needs and can free up for other processes to use. It's not all about the startup speed.

That said, VM's have their place, and docker has the option to switch out backends. It's entirely possible to replace runc with some other tool that starts VM's instead of containers. (That's already happening today with Windows containers.)

← PreviousPage 4 of 4