Hacker News Reader

bonyton The weird and wonderful world of DNS LOC records (2014)

https://www.nycgovparks.org/opportunities/support/honor

It took a while, with emails going unanswered for long periods at times.

bonyton The weird and wonderful world of DNS LOC records (2014)

Thanks, I’ve uploaded some photos.

bonyton The weird and wonderful world of DNS LOC records (2014)

A friend of mine passed away last year and I use a domain named after her as a small memorial, sally.pro. I just gave it a LOC record pointing to a bench in the park that we adopted for her.

bonyton tolower() with AVX-512

Using SIMD for making text into … uwu.

bonyton AB 1637 requires all cities and counties to transition to a .gov domain

In at least this case, sf.gov confirms the existence of the agency[1], and has a page linking to sfdec.org[2][3]. So, it most likely really is just government agencies being bad at domains here.

[1]: https://www.sf.gov/news/san-francisco-launches-new-departmen...

[2]: https://www.sf.gov/departments/child-care-health-program-cch...

[3]: https://provider.sfdec.org/ (linked as "Department of Early Childhood Provider Portal" in [2])

bonyton Signal under fire for storing encryption keys in plaintext

How are they supposed to store them? Unless there’s a password required to use the app, is the only other option a fixed key, or maybe something derived from the account name or something? All of this feels like obfuscation though, if we’re targeting malware specifically designed to collect signal data, they can probably just work around this. Maybe a TPM? Or an OS-provided keychain?

bonyton I am using AI to drop hats outside my window onto New Yorkers

I was once on 25th street in Midtown, when I saw someone drop a tiny object with a little parachute from a window at least 8 or 9 stories up. Once it had finished slowly gliding down to the street, someone picked it up and used it to enter the building. It was the key - I guess the buzzer didn't work! It was a delightful sight.

bonyton Show HN: ffmpeg-english "capture from /dev/video0 every 1 second to jpg files"

If you want this to be a little safer, instead of just those guardrails to prevent semicolons and such, you can split the command into an array of arguments, and use subprocess.Popen. It won't execute through a shell, so you don't have to worry about shell injection[1]. Though I'm sure there are unsafe ways to invoke ffmpeg anyway.

[1]: https://docs.python.org/3/library/subprocess.html#security-c...

bonyton Internet of Desks: How I Connected My Standing Desk to the Internet

Is that actually an ethernet port, or is it just an RJ45 for something like I2C, UART or some other protocol? It's also got a little port for a Bluetooth controller, which came with my desk. I bet it's possible to reverse engineer whatever protocol that is using over bluetooth/BLE.

bonyton PumpkinOS, a Re-Implementation of PalmOS

I've heard blame partially put on carriers - they initially resisted even carrying the Treo line without putting limits on what Handspring could do with it.

Apple had the iPod - and, crucially, customers - could bring these customers to the carriers, and so they could dictate more.

https://www.youtube.com/watch?v=b9_Vh9h3Ohw (the part I'm referencing is about 20 minutes in).

bonyton How the XZ Backdoor Works

Wait, you're right, 0x20 is space and 0x09 is ht/tab... they've swapped spaces for tabs...

bonyton Backdoor in upstream xz/liblzma leading to SSH server compromise

I think the distributions that do use systemd are the ones that add the libsystemd code, which in turn brings in the liblzma5 code. So, it may not be entirely relevant how it is run, but it needs to be a version of OpenSSH patched.

bonyton Backdoor in upstream xz/liblzma leading to SSH server compromise

For those panicking, here are some key things to look for, based on the writeup:

- A very recent version of liblzma5 - 5.6.0 or 5.6.1. This was added in the last month or so. If you're not on a rolling release distro, your version is probably older.

- A debian or RPM based distro of Linux on x86_64. In an apparent attempt to make reverse engineering harder, it does not seem to apply when built outside of deb or rpm packaging. It is also specific to Linux.

- Running OpenSSH sshd from systemd. OpenSSH as patched by some distros only pulls in libsystemd for logging functionality, which pulls in the compromised liblzma5.

Debian testing already has a version called '5.6.1+really5.4.5-1' that is really an older version 5.4, repackaged with a newer version to convince apt that it is in fact an upgrade.

It is possible there are other flaws or backdoors in liblzma5, though.

bonyton Family Dollar to close almost 1,000 stores

Honestly, I don't think that assumption is necessary, and I don't think either video suggests it in the slightest.

bonyton Family Dollar to close almost 1,000 stores

A couple of good videos about the business of dollar stores with similar takes:

https://www.youtube.com/watch?v=p4QGOHahiVM (Last Week Tonight with John Oliver)

https://www.youtube.com/watch?v=vQpUV--2Jao (Wendover Productions)

bonyton Amazon blocks long-running FireTV capability, Breaking apps with no warning

Interesting, they’re not disabling adb. It sounds like they’re just disabling the ability for apps on the device to connect to adb on localhost and run (e.g.) shell commands that way.

bonyton Cellular outage in U.S. hits AT&T, T-Mobile and Verizon users

Working here, in a subway station in NYC.

bonyton McDonald's pushed customers to the brink on price. They're starting to push back

For the $3.99 one, it just becomes a bundle when ordered together. Also works with six piece nuggets. I’ve seen it on the menu in the store but it’s not incredibly prominent. And, in the app it’s basically just undocumented and the price drops when they’re both in your cart. It also doesn’t count as a promo in the app, so you can order more than one bundle and even use a promo with it as well.

https://imgur.com/a/2OOF8Fm

bonyton McDonald's pushed customers to the brink on price. They're starting to push back

As others have said, use the app. Got a double cheeseburger and a free medium fries there today, and this was in Manhattan. $3.79 plus tax.

Even if you don’t use the app, if you just buy a double cheeseburger and a small fries it’s $3.99.

They're pushing their prices but there’s still cheap meals to be had.

bonyton Write code for the web

I’ve heard stories of people putting fake QR codes linking to fake payment portals for parking. I don’t think an app solves this problem though.

https://www.schneier.com/blog/archives/2022/01/fake-qr-codes...

bonyton Capturing the ripples of spacetime: LISA gets go-ahead

"Eddies," said Ford, "in the space-time continuum."

"Ah," nodded Arthur, "is he. Is he."

bonyton Winlator: Android app that lets you to run Windows apps with Wine

I’d wonder how this would beat a used surface go or something similar - they’re pretty light and affordable. And, while they’re not powerhouses, I wouldn’t expect much from a budget android tablet emulating x86 and running wine.

bonyton 'No cash accepted' signs are bad news for unbanked Americans

Many have proposed having government-provided small-scale banking as an option, administered through the post office. It's a government office, with branches in every town, that already handles things like money orders.

bonyton How random is xkcd? (2015)

I was able to recreate this, eventually. I deleted my earlier comment where I failed to reproduce it - my method of extracting a bitstream from the list of numbers was flawed.

First, I greedily requested 10,000 random numbers from xkcd with a script. These numbers are here so nobody need re-commit my deed: https://gist.github.com/tonyb486/0da38e7575071f241551d14101a...

Then, I filtered out all numbers 2048 and above so that I just had 11 bits of entropy from each number from [0,2048). I converted that to a stream of binary in ASCII, 11 bits per random number.

I fed that list of 78100 bits into STS, as 100 streams of 780 bits. It segfaulted, but it had already written out some results:

   ------------------------------------------------------------------------------
   RESULTS FOR THE UNIFORMITY OF P-VALUES AND THE PROPORTION OF PASSING SEQUENCES
   ------------------------------------------------------------------------------
      generator is <xkcd.ascii>
   ------------------------------------------------------------------------------
   C1  C2  C3  C4  C5  C6  C7  C8  C9 C10  P-VALUE  PROPORTION  STATISTICAL TEST
   ------------------------------------------------------------------------------
   13  15   7   9   7   6   9  11  17   6  0.137282     97/100     Frequency
   13   5  10  12  11   7   4  10  12  16  0.191687     98/100     BlockFrequency
   13  11  14   9   2   9  10   7  13  12  0.249284     97/100     CumulativeSums
   11  10  12  11   1  10   9  15   8  13  0.181557     98/100     CumulativeSums
   6    6   8  18   9   8  11  14   7  13  0.122325     99/100     Runs
   16   7   6  12  13   9   7  14   9   7  0.275709     97/100     LongestRun
   10  13  12   0  23   0  18   0  24   0  0.000000 *   99/100     FFT

Delightful.

bonyton Nearly 40% of U.S. homes are mortgage-free, census shows

This specifies owner-occupied.

bonyton AI and Mass Spying

That's true! I suspect it will be difficult to convince people that an AI can, as you suggest, make contextual considerations based on a shared understanding of what it's like to live a human life.

bonyton AI and Mass Spying

"The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread."

bonyton AI and Mass Spying

This is fair. I just wonder if we're about getting to the point where we should be talking about how they would be adjusted.

bonyton AI and Mass Spying

I think that’s a good reason to question whether this would be due process.

Why do we have due process? One key reason is that it gives people the opportunity to be heard. One could argue that being heard by an AI is no different from being heard by a human, just more efficient.

But why do people want the opportunity to be heard? It’s partly the obvious, to have a chance to defend oneself against unjust exercises of power, and of course against simple error. But it’s also so that one can feel heard and not powerless. If the exercise of justice requires either brutal force or broad consent, giving people the feeling of being heard and able to defend themselves encourages broad consent.

Being heard by an AI then has a brutal defect, it doesn’t make people feel heard. A big part of this may come from the idea that an AI cannot be held accountable if it is wrong or if it is acting unfairly.

Justice, then, becomes a force of nature. I think we like to pretend justice is a force of nature anyway, but it’s really not. It’s man-made.

bonyton AI and Mass Spying

I think another aspect of this is mass criminal law enforcement enabled by AI.

Many of our criminal laws are written with the implicit assumption that it takes resources to investigate and prosecute a crime, and that this will limit the effective scope of the law. Prosecutorial discretion.

Putting aside for the moment the (very serious) injustice that comes with the inequitable use of prosecutorial discretion, let's imagine a world without this discretion. Perhaps it's contrived, but one could imagine AI making it at least possible. Even by the book as it's currently written, is it a better world?

Suddenly, an AI monitoring public activity can trigger an AI investigator to draft a warrant to be signed by an AI judge to approve the warrant and draft an opinion. One could argue that due process is had, and a record is available to the public showing that there was in fact probable cause for further investigation or even arrest.

Maybe a ticket just pops out of the wall like in Demolition Man, but listing in writing clearly articulated probable cause and well-presented evidence.

Investigating and prosecuting silly examples suddenly becomes possible. A CCTV camera catches someone finding a $20 bill on the street, and finds that they didn't report it on their tax return. The myriad of ways one can violate the CFAA. A passing mention of music piracy on a subway train can become an investigation and prosecution. Dilated pupils and a staggering gait could support a drug investigation. Heck, jaywalking tickets given out as though by speed camera. Who cares if the juice wasn't worth the squeeze when it's a cheap AI doing the squeezing.

Is this a better world, or have we just all subjected ourselves to a life hyper-analyzed by a motivated prosecutor.

Turning back in the general direction of reality, I'm aware that arguing "if we enforced all of our laws, it would be chaos" is more an indictment of our criminal justice system than it is of AI. I think that AI gives us a lens to imagine a world where we actually do that, however. And maybe thinking about it will help us build a better system.