HNHacker News
TopNewBestAskShowJobs

chockchocschoir

1,131 karma · joined March 5, 2022

chockchocschoir AKA ChockChocsChoirChoke AKA Esc4iCEscEsc

https://ChockChocsChoirChoke.com

ChockChocsChoirChoke@protonmail.com

https://github.com/Esc4iCEscEsc

https://twitter.com/Esc4iCEscEsc

submissionscomments
chockchocschoir··on Fossil
> It’s open to objections: first, Github does this already, so it’s a solved problem

No, you're misunderstanding the feature (or they don't explain it well). GitHub solves the problem on their platform yes, but not in the protocol (git) itself.

Fossil embeds that data in the repository, all the data is local. Fossil works perfectly with the "local first" doctrine, something Git also does, but not for everything around Git, that Fossil embeds into the repository.

Basically, Fossil is Git + GitHub but self-hosted and offline first. You pull down a Fossil repository is like pulling down the Git repository + all related GitHub data.

> Why would VCS experts be good at designing a compelling forum or ticketing system?

They don't have to be experts about something to make it good enough. For a lot of us with poor internet connectivity, the offline first doctrine is essential in a lot of the work we do, as internet can disappear at any notice. Fossil works much better for this, as I can still read the wiki and tickets when my internet drops, while if I were using GitHub, I'd have to results to writing my own code/use 3rd party software to get the same experience.

chockchocschoir··on Ask HN: How do I secure the domain for my business?
The only thing that would help you in that case is having an account at another registrar, with a similarly named domain (maybe different TLD, or added word in front of the domain name) that is established as a alternative but rightful domain in case of failure. Test the fail-over process and make sure your documentation describe what domains are legitimate fail-over domains for your users.

Also, chose a registrar that won't just terminate your account over nothing (like Google is famous to do). I've had good luck with DNSimple over the years. Sign up for their enterprise plan and make sure to stay up-to-date on their policies. If you see that they start acting "googley", start thinking about moving to another one.

chockchocschoir··on Ask HN: How do I secure the domain for my business?
What are you trying to secure it against? This is always the first step to think about, also known as "threat assessment" or similar.

Are you trying to secure it against someone transferring the domains out of your account? Make sure you have all the account security up to date and correct (2FA on the account + the email account that has the ownership), and that all the "transfer locks" are setup (EPP codes and so on)

Are you trying to secure your DNS setup against various DNS attacks? Read up on DNS and various security patterns you can implement like DNSSEC and so on.

You're trying to prevent issues regarding DNS uptime (in case the main domain stops resolving, or other system problems)? In that case, setup DNS over multiple TLDs (and registrars) and have a process for failing over.

In short, it depends on what you're trying to protect against, and who you are trying to protect it against.

chockchocschoir··on Nvidia Unveils 144-Core Grace CPU Superchip
The doesn't seem very rational, Nintendo doesn't aim for prettiest graphics or best hardware, they aim for best family friendly game experience, without focusing on graphics or hardware. The Switch prove that their strategy works out as well, so they are unlikely to suddenly change tactics.

PlayStation and Xbox do aim for best graphics with the best hardware though, so they are more likely to go with this than anyone else.

chockchocschoir··on Disabling automatic refresh for Snap from store
> How can these be addressed if upgrades are not forced, are there standard processes followed that provide the best compromise for both vendors and end users?

There is an easy way to solve this problem. Default to auto updates, allow people to turn it off, by acknowledging what that means. Most users use whatever is the default anyways. Vendors gets to push their updates, users who don't want those, can reject them. If someone gets hacked because they turned off auto update, the vendor won't be on the hook for it, because the user said they were aware of it when they turned it off.

I think the core problem here is not that people are asking for auto updates to be off by default, they simply want to have the option. And frankly, for professional use cases, you have to be able to turn off auto updates, as otherwise it'll harm the workflow as you can't control when the update happens.

chockchocschoir··on The Edited Latecomer’s Guide to Crypto
Ok, if you don't realize the difference between subscribing to a service (S3) and making deals (Filecoin), then that's up to you. No one can say I didn't try. In the end, it doesn't even matter, people use whatever fits their use case, including you and me. I'll stick with subscribing to services, and you can continue striking deals, or whatever.
chockchocschoir··on Anonymous Publishes Leak of the Central Bank of the Russian Federation
Dude, DDoS is established as a good source for the leaks. I've downloaded the torrent/magnet myself and it's proper, it has all 10 parts in it. Verified as well by downloading from Mega and comparing hashes, it checks out. Anyway, DDoS is already established as a trusted distributor of data leaks, if you don't know this, I'm not sure why you're throwing around terms like Unit 8200 or Fancy Bear, like you know what you're talking about (which btw, I take as a compliment that you think I'm a part of).

It's not dumbing down to link directly to a trusted source of the data itself. Feel free to use both sources, like I did. But if you want to avoid Twitter and the videos anonymous usually bundles with their announcements, DDoS is a good distraction free source.

chockchocschoir··on 15.3GB from Rosatom State Nuclear Energy Corporation Leaked
Easy, `cat /usr/share/dict/british-english` and take four words, add them together.
chockchocschoir··on The Edited Latecomer’s Guide to Crypto
"Making a deal" here refers to two people interacting in the terms of "Make a offer" -> Waiting time -> "Other party accepts offer" -> Waiting time -> "Upload files" while companies offering file storage is more like "Make subscription service people can sign up to" -> "Someone subscribes" -> "Upload files".
chockchocschoir··on 15.3GB from Rosatom State Nuclear Energy Corporation Leaked
You said this was going to be a cyber war, when it's already been "cyber war" since weeks before the actual invasion happened? Color me surprised...
chockchocschoir··on Anonymous Publishes Leak of the Central Bank of the Russian Federation
Hackvism never went away, only the news coverage of it did. Here you have the leak itself without Twitter being involved: https://ddosecrets.com/wiki/Central_Bank_of_Russia
chockchocschoir··on Anonymous Publishes Leak of the Central Bank of the Russian Federation
Yes, I'm going through all the files as I write this, will do a quick write up and publish that ASAP.
chockchocschoir··on Anonymous Publishes Leak of the Central Bank of the Russian Federation
The actual data instead of some weird announcement: https://ddosecrets.com/wiki/Central_Bank_of_Russia

Made a submission about it (the data) here (before I found this submission): https://news.ycombinator.com/item?id=30810275

chockchocschoir··on 15.3GB from Rosatom State Nuclear Energy Corporation Leaked
> We found no items matching by:samstave rosatom

???

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Also, hardly surprising that Russian state entities are getting hacked and having their data leaked, since the day of the start of the invasion, everyone and their mother is trying to hack Russian government organizations.

chockchocschoir··on The Edited Latecomer’s Guide to Crypto
> What do you think cloud storage is? Its not literally storing things in a "cloud"; a cloud is just someone elses computer.

Yeah, of course, everyone knows this, no one thinks it's some magic storage. That's not what I'm talking about.

The difference is in the interface on how you get your files to some place. With S3 you simply upload the file, and Amazon stores it for you. With Filecoin, it's simply a protocol that allows you to browse everyone who is compatible with the Filecoin protocol, then you make a deal, then you use that deal to upload files. It's like there are many operators like Amazon providing a S3 interface, but first you need to find one you like, then strike a deal.

The workflow is vastly different.

chockchocschoir··on The Edited Latecomer’s Guide to Crypto
> I do think Filecoin is closer to cloud storage than 'free hard drive space'.

But I never said it was "free hard drive space", I explicitly mentioned "deals with people who offer space".

No matter where the data is ultimately stored (in a data center or not), the method for you getting your files to X is not the same in Filecoin as in S3. With S3 you simply upload your file to S3 and you're done. With Filecoin you need to first make a deal with a miner, then you use that deal to store files within the deal you've made, which is vastly different.

chockchocschoir··on The Edited Latecomer’s Guide to Crypto
> First of all, 63 PB is nothing in terms of cloud storage

Not sure why you would compare it to cloud storage, because it's not. Storing files in Filecoin is more like making deals with people who offer space on their hard drives (which as far as I know, doesn't exists besides Filecoin). It also doesn't make sense to compare it to something like S3 as again, it is not cloud storage.

chockchocschoir··on API-0.core.keybaseapi.com has expired certificate
And also the more obvious difference: Telegram requires a telephone number, Keybase did not.
chockchocschoir··on Show HN: I made a site that lets you discover micro-startups for sale
Considering how many of the "startups" listed there shows "ARR: $0", I'm wondering if maybe "focus on profit" is a bit misguided.
chockchocschoir··on EU negotiators agree new rules to rein in tech giants
Entirely my point. It shifted from the flow of "Come up with standards > Software implements that" to "Software implements something > Standardize > Adjust software", the second flow works much better for innovation. Something we can do with chat apps too.
chockchocschoir··on EU negotiators agree new rules to rein in tech giants
> Pidgin is still there, still works and supports modern chat platforms too, via plugins

Nice!

> Of course, some platforms ban you for using alternate clients.

Less nice... Doesn't seem like that list outlines which platforms will/could ban you either, which makes the entire list a no-go for me, and I'm sure others.

chockchocschoir··on EU negotiators agree new rules to rein in tech giants
> Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out. Take email (SMTP, IMAP, etc) as an example, where no major progress has been made in 25+ years, despite the platform being hopelessly insecure.

A more successful example of open standards would be the various standards that browsers use. Would you say that browser innovation has slowed down? The model adopted there is less "Wait for everyone to adopt this new standard we wrote" and more "If you have a feature you found many people are using, suggest it as a standard and we'll get all browsers to implement it".

This model could be replicated to messaging solutions as well, without slowing down any innovation as companies can add new features, as long as they get standardized over time.

chockchocschoir··on Building a no-code toxicity classifier by talking to GitHub Copilot

    fn classify-toxicity(text: string) {
      do_work(text)
      while true {}
      // this should never happen
    }
chockchocschoir··on Building a no-code toxicity classifier by talking to GitHub Copilot
It doesn't actually say that at all, because you can use Copilot in different ways. One way is the way you mention, by writing code and letting Copilot finish those off. Another way is the way GP describes it (and, the technique that the article uses) where you write comments and let Copilot fill out the code.

Just because one uses one of the ways doesn't mean they are not aware of the other way too.

chockchocschoir··on Performance Evaluation of IPFS in Private Networks
I'm not sure anyone would be surprised that IPFS's performance would be worse than FTP or any other protocol when it comes to transfers between two (or three) hosts.

The benefits of distributes systems becomes bigger the larger the network. Replicate the same results with 100 nodes and we'll see.

I still think torrents would be even more efficient though, than both FTP and IPFS.

chockchocschoir··on Show HN: Kestra - Open-Source Airflow Alternative
I just noticed the title says "Open-Source Airflow Alternative" but Airflow is already Open-Source, so shouldn't you describe it as just "Airflow Alternative"? Otherwise you make it sound like Airflow isn't Open-Source but this is.
chockchocschoir··on Ask HN: What makes people add links to HN?
You seem to have only added links to your own written content, that's a no-no. Read the guidelines: https://news.ycombinator.com/newsguidelines.html

Specifically:

> What to Submit: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity.

Is what you're submitting something "good hackers would find interesting"?

I submit links in the hope of sharing some novel/interesting information with others, and to spawn discussions around a subject I find interesting.

> but beyond that does it really translate into commerce and connections for people ?

Sometimes, for some people, it does. But still, rule #1 is that it should be interesting, then the commerce and connections (from HN and other sources) will follow automatically.

chockchocschoir··on So, you want to be a darknet drug lord
When you're trying to cover your tracks, it's best to assume the worst at all times, even if it's unlikely.

Besides, it's not like the NSA doesn't have the capability to scoop all packets from people they've seen visited torproject.org.

chockchocschoir··on Which programming languages do hackers use? Survey at German Chaos Computer Club
They are using the term "hacking" to describe offensive penetration testing regarding security, not "hacking" as in the action of "creatively overcoming a problem" or just generally programming. One would think the paper would start by defining what "hacker" and "hacking" is referring to in the paper, but they don't seem to do that.
chockchocschoir··on Complaints mount after GitHub launches new algorithmic feed
The other sentence in your comment was:

> I think the issue is not with it being social in general, but rather with it becoming a similar flavour of social to the likes of Facebook, Twitter, etc.

I'm sorry I didn't understand you were using "flavour" to indicate AI, I just thought you were referencing social features in general, it wasn't that clear to me, sorry for that.

← PreviousPage 2 of 8Next →