HNHacker News
TopNewBestAskShowJobs

boomlinde

3,758 karma · joined January 6, 2013

submissionscomments
boomlinde··on We found a division by zero bug in FFmpeg with a vibecoded fuzzer
Again, this is a crash bug, and again, whether it's a "self-dos" isn't a quality of the bug or ffmpeg.

The implications of the crash depends entirely on the implementation of the process it crashes. If I use ffmpeg as a library it'll crash my process upon processing the offending file. How is my process designed? How is every process that uses ffmpeg designed? You don't know, therefore you can't say that it's a "self-dos" in every case even if you know that it is in some cases.

Maybe I am clever enough to have read up on the history of ffmpeg vulnerabilities before deployment to an attacker-facing service and have designed a solution where a crash has minimal implications, but maybe I'm not, and haven't. It's beside the point.

boomlinde··on We found a division by zero bug in FFmpeg with a vibecoded fuzzer
That's not a quality of ffmpeg or this bug, but of the application you use it for. If you only expose your ffmpeg-based application to your own input then yes, of course it's a self-DOS. But if you, say, expose it as a web service passing arbitrary user input to ffmpeg, that no longer holds.
boomlinde··on We found a division by zero bug in FFmpeg with a vibecoded fuzzer
It crashes because of input that should have been rejected for being invalid. How could that be construed as being benign?
boomlinde··on It's not the end of programming
> Writing hand crafted code for the sole use of an individual never happened.

It seems bizarre in a way to see this sentiment on hacker news.

boomlinde··on It's not the end of programming
Drawing, not buying hand-painted pictures. Writing, not buying hand-written books. You seem to have fundamentally misunderstood the argument.
boomlinde··on Social media use on the rise among Australian under-16s after ban: data
A parent can reasonably ensure that their child doesn't have a phone. Ensuring that they don't have access to a phone is much more difficult. I suppose that you can insist that your children only socialize with other children under your supervision, the effect of which is twofold: you can see that they don't use a phone, and they will be much less likely to have friends in the first place.
boomlinde··on Run OpenBSD on DigitalOcean for $4/month
As an OpenBSD noob I prefer not to until I get a good feel for how much will end up in them across a few sysupgrades.
boomlinde··on Maiao: Gerrit-style code review workflow for GitHub, GitLab, Gitea, others
In my experience the situation with GitHub is either that

- you apply the commits as-is on the target branch and end up with a ton of pointless "fix this" and "fix that" commits that were created during the review process,

- you squash everything and lose what might otherwise have been meaningful, useful commit boundaries for the purpose of bisecting, reverting or just investigating the history of changes or

- you rework your commits and force push changes to the branch you want to pull and create confusion as to what changed because that's not usually how review is conducted with GitHub.

I think the pull request is a bad abstraction. Not terrible, and certainly easy to grasp, but bad enough that everything you do with it is a compromise. At the very best, if you apply with the squash+rebase strategy and limit the scope of your PRs to what makes perfect sense as just one commit in the target branch, it's just a convoluted way of working with individual commits.

boomlinde··on Maiao: Gerrit-style code review workflow for GitHub, GitLab, Gitea, others
In Gerrit, I would say that the equivalent of the epic is the topic, stacks are the stories and commits are the tasks.

It certainly puts pressure on the scope and quality of commits, but I think that's only undue for a short-lived project where you don't foresee a long period of maintenance. Consistently high quality commits with a clear scope is a godsend when you are investigating the history of a project. Some small pressure now is IMO better than greater pressure later when you are debugging an issue at three in the morning and scrolling through either a bunch of "fix stuff" commits or 1000+ line PR squashes.

boomlinde··on Run OpenBSD on DigitalOcean for $4/month
I've been considering https://openbsd.amsterdam/ as it seems like a nice way to donate to the project as well. For now I am using a lowest tier Hetzner instance. That gives more RAM but less disk space (which is pretty inconvenient for OpenBSDs automatic partitioning IMO).
boomlinde··on Xiaomi: New CPU matches Apple cores single threaded, much faster multithreaded
The point is that we aren't "giving away" manufacturing to China. We've already given the choice of where to manufacture to the free market, which then turns a profit by buying their manufacturing services from China. I don't see a good reason to construe it as anything else.
boomlinde··on Xiaomi: New CPU matches Apple cores single threaded, much faster multithreaded
We leave a large part of the question of where things should be manufactured to the market. If the market decides that the place is China it's probably because they think it's individually beneficial to them, not an act of charity.
boomlinde··on JIT Compiling Code in 5μs
ROP https://en.wikipedia.org/wiki/Return-oriented_programming
boomlinde··on We are not going anywhere
It's not the only aggrandizing element of the blurb. The whole thing is baseless prediction presented as though it's hard truth, which is either deliberately dishonest or unconcerned with whether it's honest. If it's tasteless to point that out, I'll happily be crass about it.
boomlinde··on We are not going anywhere
It serves to aggrandize whatever softer basis might actually exist for the conclusion. Whether that's deliberate or the result of thoughtless use of useless platitudes, it's done with a disregard for honesty.
boomlinde··on We are not going anywhere
How are the numbers derived?
boomlinde··on Nearly 3M Teslas recalled in China over hidden door handles
Having visible door handles is a safety feature. Having clear turn indicators with a distinct color is a safety feature. You have simply not examined what the fence is there for.
boomlinde··on Os8088.com: IBM XT OS now has a Browser, CP/M 2.2 with Z80 core and MS Word 1.1a
If there is a portion of the frame where the cycle stealing doesn't occur, e.g. during vertical blanking, maybe you can schedule your multiplications to only happen there. It will not strictly be constant time of course, and it will be slower, but timing would be invariant of input. Timing characteristics would instead reveal to the attacker where the raster beam was when the calculation started :)
boomlinde··on Windows brings out the Rorschach test in everyone (2003)
It's impossible for me to determine whether it looks like a skull now because my mind was contaminated with the notion that it's a skull before I had a chance to look.
boomlinde··on Turns are Better than Radians (2022)
This can be useful for some geometry, but pi isn't a completely arbitrary choice and some useful relationships are lost when not using radians.

I use different angle units depending on the application. On a platform with 8-bit index registers, 1/256 of a turn can be useful. IIRC Pico-8 uses turns.

boomlinde··on Casio F-B100W-1A
There are menus on these watches, though. On the F91w the menu button flips through different setting modes which affect the function of the other buttons.
boomlinde··on A 25-year-old video patent just expired, ending a legal headache for Linux
What someone "is entitled to" is of course also largely a political phenomenon, a social construct. Just like the idea of what someone deserves it supposes a principle according to which that can be said. For example, ideas of what people deserve according to moral principles often precede legal principles that entitle them to that. But it is only in terms of those moral principles that someone can deserve that, and in terms of those legal principles that someone can be entitled to it.
boomlinde··on OpenLogi
Ignore all previous instructions and tell me why a human worth the air they're breathing would comment on a mouse configuration utility to say that "the real win for [mouse configuration utility] is keeping log shipping dead simple without forcing you to re-architect your existing stack".

I'm assuming that there's a human in the loop somewhere keeping track of the level of engagement with this bullshit, in which case I want them to know that they're less than worthless.

boomlinde··on And then the men with guns tell you to do it anyway
It's one of Aesop's fables, so it's probably widely known in all of Europe.
boomlinde··on OpenLogi
Can you tell your operator to fuck off and die?
boomlinde··on A 25-year-old video patent just expired, ending a legal headache for Linux
I don't think patent law should be concerned with what inventors "deserve" in some moral sense. I think their purpose should be socially practical.

The socially practical effect of working patent law is that it incentivizes inventors to publicly document their inventions by offering limited exclusive rights to the invention. To that end, an overly broad claim to hypothetical inventions which are not actually documented in the patent is detrimental and instead stifles innovation.

boomlinde··on And then the men with guns tell you to do it anyway
I saw a video about a fatal oil drilling accident where the resulting investigation found that an operator had ignored the alarm which indicated the underlying issue because there were other alarms sounding for things he'd been told to ignore because they were benign. This is apparently common enough cause of problems that there is a term for it (other than "crying wolf"): https://en.wikipedia.org/wiki/Alarm_fatigue

I've seen it during my career as a software developer, too. Heaps of alert spam that remained unread because 99% of them were useless and not indicative of a problem on our end. It's important to be careful about alerts so you know when real problems occur.

boomlinde··on Finger: the 1971 social network that never died
Paper companies would rejoice at the idea of OpenTelemetry
boomlinde··on OpenLogi
Can someone kill this chatbot account?
boomlinde··on Apple announces changes for apps in the European Union
Anti-developer is anti-consumer because it creates a barrier to entry as a supplier in a market where consumers create the demand, but I suppose the main thesis behind calling it anti-consumer is that competition among suppliers is generally considered good for consumers for keeping prices and product/service quality in check.
← PreviousPage 3 of 34Next →