HNHacker News
TopNewBestAskShowJobs

cataflam

788 karma · joined January 19, 2012

submissionscomments
cataflam··on Preliminary Post Incident Review
Not really, that thread showed only superficial knowledge and analysis, far from hitting the nail on the head, for anyone used to assembly/reverse engineering. Then goes on to make provably wrong assumptions and comments. There is actually a null check (2 even!) just before trying the memory access. The root cause is likely trying to access an address that's coming from some uninitialized or wrongly initialized or non-deterministically initialized array.

What it did well was explaining the basics nicely for a wide audience who knows nothing about a crash dump or invalid memory access, which I guess made the post popular. Good enough for a general public explanation, but doesn't pass the bar for an actual technical one to any useful degree.

I humbly concur with Tavis' take

https://x.com/taviso/status/1814762302337654829

Here are some others for more technically correct details: - https://x.com/patrickwardle/status/1814343502886477857 - https://x.com/tweetingjose/status/1814785062266937588

cataflam··on Reflex – Web apps in pure Python
Looks nice!

I've used Anvil [0] quite often in the past years for what seems to be a similar purpose (not affiliated, just a happy customer). Does someone know how Reflex compares?

[0] https://anvil.works/

cataflam··on Compiling Typed Python
> what is GAFAM? Is that suppose to be the new FAANG acronym?

It's the French version of the acronym

cataflam··on Stripe increases fees for EU and UK-based businesses in April
There are multiple types of SEPA payments, I think you're talking about SEPA Credit Transfer (essentially making the bank transfer yourself).

On the other hand, for SEPA Direct Debit, not only is the interface quite reasonable (you enter your IBAN and confirm a mandate), but consumer protection is very high. You can chargeback no questions asked for 8 weeks, it will be immediately accepted and the merchant can't do anything about it. And as a customer, besides the 8 weeks no questions asked policy, you have 13 months to ask for a refund of an unauthorised transaction, with supporting evidence. In practice, the bank will always accept such a request too.

cataflam··on Stripe increases fees for EU and UK-based businesses in April
Consumer card fees are capped pretty low in EU (and still UK I guess), something like 0.30%.

Commercial card fees are not capped and are more around 1.5% to 2.0%

If anything, now that they have split consumer and commercial cards in their fees, it's the consumer card fees that are shockingly high.

cataflam··on Weaver – A daily word ladder game
They show it the next day
cataflam··on How far can you go by train in 5h?
https://www.thetruesize.com/#?borders=1~!MTU1OTU3NTE.MTE5NDg...

or

https://www.thetruesize.com/#?borders=1~!MTU1OTU3NTE.MTE5NDg...

helps with convincing yourself.

cataflam··on Atlassian: We estimate the rebuilding effort to last for up to 2 more weeks
Not trying to nitpick, just for your information

> Clubhouse (neé Shortcut)

It's the opposite: Shortcut (née Clubhouse), as "née" means "born", so it's the name it had at birth, the old name

The more you know!

cataflam··on Dubai is making its own fake rain to beat 122°F heat
> The enhanced rain is created using drone technology that unleashes electrical charges into clouds (..)

> Applying electrical shocks to clouds is preferred as it doesn’t require the use of chemicals.

So, a bit different than cloud seeding

cataflam··on Why electric cars will take over sooner than you think
I can't edit my own post anymore, but I've looked into it more. Total average production should not be an issue, at least in Europe. However peak power could be and will require some care.

See https://news.ycombinator.com/item?id=27361065

cataflam··on Why electric cars will take over sooner than you think
Interesting links and info from the UK national grid. I've done some more research on the topic, and spoken with people who are closer to the topic.

tl;dr: average capacity is not going to be an issue, however peak power could very well be, and may need to be managed.

I am going to assume this is going to be very country-specific though. I've looked for the same info for France for example, which is more clear cut as it uses very little gas/oil/... in its energy production, so a priori I would have thought there is no argument of pushing the pollution from cars to power generation (but actually there may be because of peak power requirements).

Also note that this goes beyond national grids, the EU electricity market smooths things out at continental level. The UK is not synchronised with the EU grid, but it is connected. France has an excess production in general for example but all that excess is exported to other countries. Supply and demand have to be equalised at all times, and there is a real time market that can tap into quick-to-start power plants for flexibility.

I've found a very interesting 2019 report from RTE (who manages the grid). [0] Note that the highest EV transition scenario it envisages is 15 million EV by 2035, so ~35-40% of all cars, which is probably realistic, but it's far from covering requirements to change 100% of ICE cars to EVs.

1. It should hold just fine even in the high estimates of 15 million EV by 2035, which means an extra 50 TWh per year, ie 10% of the total production.

2. They also expect to grow the green power generation (nuclear, hydro, solar, wind...) by 20% during the same period, from ~500 TWh to ~600 TWh.

3. The main risk is peak power consumption, if it's not managed. If people all start charging when they come home in the evening, which matches the existing peak power usage between 7-9 pm, especially during winter, it could cause supply issues. In the worst scenarios, it could be up to 8 GW extra during what are already the highest peaks. This can be worked around by steering usage to other hours of the day, possibly even help with peaks if actively managed with vehicle-to-grid power flow, the batteries could actually flow electricity back to the grid during those peak times (there are concerns of battery life though). But this management of when people charge their cars MUST be done in the worst scenarios for at least 50% of the charging, otherwise it could threaten electric supply safety.

In short, average capacity should not be a problem in France (significant increase, but manageable and other consumption is going down). However peak capacity usage will require some adaptation, but can be handled.

[0] https://web.archive.org/web/20190515131031/https://www.rte-f...

cataflam··on Why electric cars will take over sooner than you think
From your first link, isn't a lot of that difference between 30 GW peak and 20 GW at night due to solar? It seems to provide about 9 GW during the day, that removes most of your estimated 70 GWh of extra overnight capacity (unless I'm reading it wrong).
cataflam··on Why electric cars will take over sooner than you think
> The total energy usage shouldn't be much of an issue as we'll move electricity use from refineries to charging batteries – I believe these are at least in the same ballpark.

I wouldn't be so sure. Back of the napkin estimate: for every 2M electric cars, you need 1 more nuclear power plant.

  - approx. 18 kWh per 100 km for a Tesla
  - let's say 15000 km per year (close to the average in France for example)
  - total consumption over a year for 1M cars is roughly 2.5 TWh
  - total production of a nuclear power plant varies, but is roughly 5-7 TWh per year on average
That's a lot of extra power if you want to replace all the cars. For example in France, that'd be the equivalent of 20 extra nuclear power plants, or the equivalent in nuclear + solar + wind + coal/gas/...
cataflam··on Face masks effectively limit the probability of SARS-CoV-2 transmission
> Meanwhile, they ignore the dozens of studies showing masks are ineffective, or even counterproductive

Let's try to figure out how well your summary is actually supported by your citations, especially as TFA is about medical masks and N95 masks and doesn't mention cloth masks.

TL;DR: It's not (and ignores the multiple studies showing surgical and N95 masks are effective to prevent SARS-CoV infections).

What your citations say is "cloth masks seem ineffective (but not surgical/N95), masks in general seem to protect less from influenza than coronaviruses, and wearing a mask may have some effect on exercise (although magnitude of the effect and consequences are unclear)". I wouldn't have had a problem with that statement. Whether that's the whole story or cherry-picking of studies is another question.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4420971/

(2015) Shows that cloth masks are less effective than medical masks... and incidentally that medical masks are effective. One study in, already contradicts your statement.

https://pubmed.ncbi.nlm.nih.gov/29395560/

(2017) Not about mask efficacy in disease prevention, but effects on exercise. No difference in distance, heart rate, O2 saturation, but 20% higher shortness of breath.

https://pubmed.ncbi.nlm.nih.gov/32590322/

(2020) Not about mask efficacy in disease prevention, but effects on exercise again. Also, not an experimental study but a comment/hypothesis.

https://pubmed.ncbi.nlm.nih.gov/15340662/

(2004) Not about mask efficacy in disease prevention, again. Study on patients with end-stage renal disease.

https://pubmed.ncbi.nlm.nih.gov/26579222/

(2015) Not about mask efficacy in disease prevention, again. Study on pregnant women.

https://pubmed.ncbi.nlm.nih.gov/31159777/

(2019) First interesting one. Show that viruses may deposit on the outer surface of medical masks. May prove useful in educating people to handle with care (although it seems that contamination by touching contaminated surfaces accounts for a negligible amount).

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5779801/

(2012) Ah, better. Review of a small number of other studies, focused on influenza and close contact with an infected patient. Does not conclude masks are ineffective, but more that good data and studies are hard to come by, that the studies they reviewed were between inconclusive and positive, and they may be protective when combined with other hygiene practices. Also notes that the studies on SARS coronavirus transmission found masks protective, but the results may or may not apply for influenza. It also notes compliance and correct usage are likely factors in reduced effectiveness.

So, while this is the closest so far to your assertion, it doesn't quite support it either. Annex 5 in particular shows that the SARS coronavirus studies reviewed seem to show a protective effect.

Much larger and wider reviews, that include this one, reach different conclusions for the topic at hand. See for example https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8084286/ and https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7718106/

https://pubmed.ncbi.nlm.nih.gov/19216002/

(2008) Lol. Study on 32 health-care workers, and the incidence of common cold. There was 1 cold in each group. Sample way too small to reach any conclusion, as they themselves conclude.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4420971/

Same article as the first one in the list.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2493952/pdf/ann...

(1981) Interesting, although a small trial study. But it only cares about a very specific thing: the efficiency of masks in surgery to avoid contaminating an open wound, unrelated to the airborne spread of respiratory diseases. More studies and reviews have followed, with mitigated results, see for example https://pubmed.ncbi.nlm.nih.gov/33039336/

Interesting but irrelevant for the topic at hand.

https://www.nap.edu/catalog/25776/rapid-expert-consultation-...

(2020) Expert consultation, limited to the effectiveness of homemade fabric masks. It says verbatim: "It does not apply to either N95 respirators or medical masks." (and it doesn't even conclude that homemade cloth masks are ineffective, only that more research is required).

https://www.nap.edu/read/25776/chapter/1#6

That's the same as the article just above. Could be the 2nd honest error of course, or could be a sign you've copy/pasted part or all of the list with little editing/proofreading.

https://wwwnc.cdc.gov/eid/article/26/5/19-0994_article

(2020) Review of multiple measures against influenza contamination, that seems to show no effectiveness. The authors point out themselves the limitations of the study however, small sample size and compliance issues. It's an interesting data point, but it targets influenza and I wouldn't say it disproves masks effectiveness.

When looking at the bigger picture, and more and larger review, doesn't yield the same conclusions. See for example https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7718106/ that includes this study among those reviewed. Interestingly, it seems to show much more conclusive results for coronavirus infection prevention than influenza, and cautions against cloth masks.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6599448/

(2019) Physical study of filtering efficiency of cloth masks vs surgical masks, especially after washing

https://www.acpjournals.org/doi/10.7326/M20-1342

(2020) One of many physical studies on patients coughing in a petri dish with various mask types. Only 4 patients, and one of the only such physical studies I've seen that didn't show a significant effect.

https://link.springer.com/article/10.1007/s00392-020-01704-y

(2020) Another one that talks about exercise and not infection.

---

Looking in general at country-level data, using masks earlier seems to be significantly associated with lower mortality. See for example https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7695060/ for a wide study and https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7392429/ for a small comment

cataflam··on How to get root on Ubuntu 20.04 by pretending nobody’s /home
Locking screens properly and securely is not entirely trivial.

There is some writing from the author of xscreensaver which makes for fun reading. Displaying the desktop for a few seconds could be the least of your worries. There have been multiple security issues in the past in various screen lockers that let you completely bypass the password screen (probably all fixed today, but who knows what else could be lurking).

I won't link it directly because I think (?) his site displays something else when your Referer header is hacker news. This should provide you with an entry point, and there are multiple other linux screensaver issues over the past years linked from that post.

https://www.google.com/search?q=jwz xscreensaver "The awful thing about getting it right the first time is that nobody realizes how hard it was."

You can also search for "XScreenSaver: On Toolkit Dialogs", but I think it's linked in that blog post.

cataflam··on A U.S. Election Twitter Network Graph Tool
first post, but with some letters moved around, a popular form of discourse in general and as internet memes in particular

a google search does return some examples if you force it to

https://www.google.com/search?hl=en&q="frost+pist"

cataflam··on Zoom Rolling Out End-to-End Encryption Offering
Probably, the blog post itself is signed by Max Krohn, Keybase.io co-founder.
cataflam··on Zoom Rolling Out End-to-End Encryption Offering
Does Telegram have E2EE for group discussions yet or is it still only for 1:1 ?

Honest question, I haven't checked recently.

cataflam··on Zoom Rolling Out End-to-End Encryption Offering
I clearly read it as enhanced compared to the previous versions, which used to be AES-ECB until earlier this year.

Note how it mentions "How is this different from Zoom’s enhanced GCM encryption?", which means enhanced also applies to the normal Zoom meetings which are encrypted but not E2E, and supports this interpretation.

cataflam··on Google Services Experiencing Disruptions
I'm sure you know, you can right click or long press the back button (on desktop at least) to access the whole history for that. Still annoying.

https://i.imgur.com/CTxvExS.png

cataflam··on Bastion Fort
For some great examples, in pictures: https://duckduckgo.com/?q=vauban+citadelle&iar=images&iax=im...
cataflam··on Security by obscurity is underrated
> There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity".

Exactly! Especially when you can create a high cost asymmetry, low-cost for you to add, high cost for the attacker to bypass.

Agree that the SSH examples aren't the best. I would have picked DRM.

cataflam··on Security by obscurity is underrated
Agree with the article.

People have been misinterpreting "security by obscurity is bad" to mean any obscurity and obfuscation is bad. Instead it was originally meant as "if your only security is obscurity, it's bad".

Many serious real-world scenarios do use obscurity as an additional layer. If only because sometimes, you know that a dedicated attacker will be able to breach, what you are looking for is to delay them as much as possible, and make a successful attack take enough time that it's not relevant anymore when it's broken.

cataflam··on We thought it was just a respiratory virus
That's not what it says. It says if you tested everyone, out of those who tested positive, 50-80% would be asymptomatic, not 50-80% of the whole population.
cataflam··on France, Italy, Belgium stop hydroxychloroquine use for Covid-19 on safety fears
> PS: The title is misleading. The ban is on the use on severe diseases, not all of them, according to the text in the news.

And the RCTs are still going and will finish, unless there is a major negative effect noticed in them, which is not the case so far.

cataflam··on SF Bay Area Shelter-in-Place Orders Extended as Some Rules Ease
If it can give you a comparison point, France wants to be able to do 700k tests per week in less than 2 weeks time to have test and trace capability and start lifting the lockdown. That comes out to approximately 150 tests a day per 100k. The following reason was given.

The models predict 1000-3000 new cases a day around the time lockdown would be lifted. Each new case will imply 20-25 other persons in contact in the preceding days. 3000 x 25 = 75k tests per day, ie ~115 per day per 100k. Going to 150 allow an extra margin to also set up testing campaigns in sensitive places, eg nursing homes.

cataflam··on Sweden to shut bars and restaurants that ignore coronavirus restrictions
Yes, and about 4-5x the death per population of their Nordic neighbours, which may be a more relevant comparison while the epidemic is growing.
cataflam··on You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
Correct. If you fetch mail, you're vulnerable (at least that's my understanding).

You can use third-party apps, or Safari if it's a webmail.

cataflam··on You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
Since it is a bit buried in the comments, and not explicitly mentioned in the article, here is a working mitigation.

From the founder/CEO of ZecOps twitter directly: https://twitter.com/ihackbanme/status/1252990118945681409

Q: If a user turns off mail sync for their accounts into the mail app, is that a mitigation?

A: Yes. If a user is not syncing emails it would mitigate the issue.

cataflam··on You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
From the founder/CEO of ZecOps twitter directly: https://twitter.com/ihackbanme/status/1252990118945681409

Q: If a user turns off mail sync for their accounts into the mail app, is that a mitigation? A: Yes. If a user is not syncing emails it would mitigate the issue.

← PreviousPage 2 of 5Next →