Hacker News Reader

At first I thought it must have been a typo…

cnston How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

Can someone explain how is this not GitHub's fault that they don't allow the end-user to modify the permissions that all these services require? E.g., fine-grained permission control?

For example, why a tool like this code analysis service would need git write permission access in the first place?

The only consolation here is that it'd be difficult to forge git repositories because of the SHA hash conflicts for any existing checkout, although presumably even there, the success rates would still be high enough, especially if they attack front-end repositories where the maintainers may not understand what has happened, and simply move on with the replaced repo without checking what went on.

cnston Critical Cache Poisoning Vulnerability in Dnsmasq

Would OpenWrt even be vulnerable in the first place?

If you're using dnsmasq behind NAT or a stateful firewall, how would an attacker be able to access the service in the first place?

cnston "Remove mentions of XSLT from the html spec"

Wait, all the web browsers had XSLT support all along?

I remember using these things in a CSCI class, and, IIRC, we were using something akin to Tomcat to do transformations on the server, before serving HTML to the browser, circa 2005/2006.

cnston OpenIndiana: Community-Driven Illumos Distribution

Our $100M Series B (oxide.computer) - https://news.ycombinator.com/item?id=44733817 - Jul 2025 (503 comments)

This is really good for them, and I do hope they do succeed, but if it's a matter of an individual developer deciding on their optimal area of systems expertise, this is still putting too many eggs in a single basket.

The reality is that even Oxide.Computer clients would still be running Linux on their machines.

So, as an engineer, you're literally shooting yourself in the foot by NOT moving to Linux, when everyone else has.

I think it's a standard sunk cost fallacy here. Some of us continue using BSD, but others switch to Linux and go work at Google, Meta, Amazon and even Oracle and Netflix, at 2x to 4x+ the income we get as BSD and Solaris devs.

cnston OpenIndiana: Community-Driven Illumos Distribution

Yes, it's true, but it's simply impossible to find a paying job doing BSD or Solaris these days.

I mean, even if you get a job at Oxide Computer, what do you do if you decide to move on because of your manager or whatnot?

Literally all the sectors are Linux now, you'd think BSD would be huge in embedded because of licensing, yet it's still Linux. OpenWrt is Linux, Android is Linux, OpenIPC is Linux, not to mention the entire data-centre stacks being all Linux now.

cnston OpenIndiana: Community-Driven Illumos Distribution

> https://www.youtube.com/watch?v=5P5Mk_IggE0&t=2556s

Great episode! The Dell PERC "parity issue" "you're the only customer having this issue" story is hilarious, reminds me of my own experience getting support over the years as a non-Windows user!

Sadly, today, "non-Windows" is simply being replaced with "non-Linux", so, if you run BSD or Illumos, it's still the same issues.

Oxide Computer is great, I really do hope they succeed, because it does seem like an uphill battle!

cnston Nginx introduces native support for ACME protocol

You could always switch to the Angie fork if you require the DNS challenge type with the wildcard domains:

https://en.angie.software/angie/docs/configuration/modules/h...

cnston Nginx introduces native support for ACME protocol

Here's the docs for the Angie's version of the http_acme module:

https://en.angie.software/angie/docs/configuration/modules/h...

The original announcement of Angie ACME:

Angie, fork of Nginx, supports ACME - https://news.ycombinator.com/item?id=39838228 - March 27, 2024 (1 comment)

Per above, it looks like ACME support was released with Angie 1.5.0 on 2024-03-27.

BTW, if you don't care about ACME, and want the original nginx, then there's also the freenginx fork, too:

Freenginx: Core Nginx developer announces fork - https://news.ycombinator.com/item?id=39373327 - (1131 points) - Feb 14, 2024 (475 comments)

cnston OpenIndiana: Community-Driven Illumos Distribution

Everything is converging on Linux these days, and even the majority of the people who used to promote Solaris, DTrace and ZFS, have seemingly moved on, mostly to Linux, somewhat to FreeBSD, too, per Brendan Gregg:

Solaris to Linux Migration 2017 - https://news.ycombinator.com/item?id=15177118 - Sept 2017 (129 comments)

In the BSD land, things aren't that much better, either.

Netgate, the makers of pfSense, are now using Ubuntu for Netgate TNSR product.

iXsystems, the descendants of BSDi, have moved FreeNAS / TrueNAS from FreeBSD to Linux. They're basically d/b/a TrueNAS now, and it's all Linux now.

You used to need Solaris or illimos or FreeBSD for production-ready ZFS support, but now OpenZFS is provided exclusively for Linux and FreeBSD; note that Linux already comes first in the title; it would seem like it's only a matter of time before FreeBSD support may follow Solaris and illumos.

Joyent, the commercial shepherds of OpenSolaris descendants like SmartOS, were acquired by Samsung, but the entire Solaris part of the equation, including Triton DataCenter orchestration, were subsequently offloaded to mnx.io, a tiny cloud hosting provider based out of a small town in Michigan. (Frankly, without Triton, I don't even understand what remains of Joyent at Samsung? Just the physical servers with the third-party software? It's basically just a name for Samsung's data centre ops and their presumably-Linux-based Private Cloud?)

Apple used to use NetBSD for AirPort WiFi routers, but the whole router line has been discontinued. (I thought Apple actually already dropped NetBSD but couldn't find a source right now.)

Last not least, DJB used to run OpenBSD, then FreeBSD, but then switched to Ubuntu after possibly being annoyed that too many steps were required to make FreeBSD work as a desktop: http://cr.yp.to/unix/feedme.html (my fav is that in FreeBSD the audio doesn't work unless you recompile the kernel). I think he initially may have abandoned OpenBSD because it was crashing too often for undetermined causes: http://cr.yp.to/serverinfo.html.

FreeBSD is still used by Netflix OpenConnect Appliance, which is a huge win, but feels like too many eggs in a single basket:

Serving Netflix Video at 400Gb/s on FreeBSD [pdf] - https://news.ycombinator.com/item?id=28584738 - Sept 2021 (293 comments)

But that's about it. Linux has won.

cnston We caught companies making it harder to delete your personal data online

It collects WiFi Radio Analytics (2.4GHz / 5GHz-Low / 5GHz-High frequency utilisation), Activity History (data usage by device, as well as "scan" and ad blocks by device).

For ad blocking and network control, it also has "Block & Allow Sites" with the blacklisted and whitelisted domain names, which you may have to use to block ads and also unblock some domains that stop working as a result of bogus entries in the ad block.

All of this information is stored in the cloud, but I found no way to export it in any way. I've actually contacted eero, asking for the export, and they've basically admitted that it's not supported.

cnston This website is for humans

Between the lines — what has necessitated AI summaries are the endless SEO search-engine optimisations and the endless ad rolls and endless page element reloads to refresh the ads and endless scrolling and endless JavaScript frameworks with endless special effects that noone wants to waste their time on.

How can the publishers and the website owners fault the visitors for not wanting to waste their time on all of that?

Even before the influx of AI, there's already entire websites with artificial "review" content that do nothing more than simply rehash the existing content without adding anything of value.

cnston We caught companies making it harder to delete your personal data online

Some companies somehow blatantly get away with not allowing any export at all.

For example, Amazon eero, the overpriced WiFi router that doesn't even work (without phoning back home and having an app installed on your phone). They had an outage like a year ago, and during said outage, all your existing ad blocking stopped working, too, even if you never rebooted during the outage, and even though said blocking is supposed to be performed locally. I think you can't even get the ad blocking unless you or your ISP pays for the special subscription, either. (I imagine the thing could have removed all local ad blocking settings and lists during the time it couldn't confirm you're still a paying customer because their cloud was down?)

Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I haven't seen a Blink or Ring exports, either. The main Amazon dot com does have the export, which has some extensive data you may not think they do collect, but it doesn't cover eero, Blink or Ring.

cnston F-Droid build servers can't build modern Android apps due to outdated CPUs

> As a user, i'm glad when devs use old tools so that my battery has a chance of lasting the whole day and my apps don't take 10 seconds just to open.

Yup, same here! The story is as old as time, and the examples are plentiful. First Slashdot, then Reddit, then now GitHub, all became far-far-far slower and less usable, once they've been "improved" by the folk engaging in the resume-driven development:

Why is GitHub UI getting slower? - https://news.ycombinator.com/item?id=44799861 - Aug 2025 (115 comments)

I am, too, as a user, quite pleased that F-Droid is keeping it cool and reliable for the actual users.

cnston H-1B Visa Changes Approved by White House

But the golden ticket requires 5mil. Even in the US, even the most talented engineers, probably wouldn't have that much until after 5 to 10+ years of work, and outside of the US, earning that much money as an engineer is probably next to impossible before well over 40+. (And, even then, if all you have is just the 5mil, would you really part with that much money just for a visa?)

cnston Anti-competitive practices masquerading as security is a dangerous pattern

Would you be okay if LinkedIn and GitHub banned your account without any explanation? Or are you of the opinion that it's not a possibility because you follow all of their ToS to the letter at all times? Do you admit that you'll never provide any objective feedback about these companies since that may (or even should?) violate their ToS in your opinion?

It's interesting that you immediately assume that she's actually disparaging LinkedIn in any way, without any such proof being available. Providing any critical opinions whatsoever, about the company as a whole, is now disparaging the individual employees of the company? Why are you disparaging the author of the essay? What if she's your colleague, too?

You might want to check your biases if your first instinct is to immediately assume anyone who's been wronged in any way by any bigtech platform is immediately an entitled person by having an issue with such an action, and is doing nothing more than disparaging the colleagues of yours.

How can you be sure that the person who's been deplatformed is not a colleague of yours, too?

Why is it okay to disparage private individuals in private capacities (and to deny them their livelihood in these cases of LinkedIn and GitHub bans), but not okay to provide less than ideal feedback about monopolistic multibillion-dollar companies?

cnston Anti-competitive practices masquerading as security is a dangerous pattern

It's not the issue of share ownership, it's the issue of size and lack of process ownership, about everyone passing the buck and noone being personally responsible for these failures.

It's about the employees having an inverse incentive, to take actions just for the sake of it.

It's actually exactly about this attitude that somehow noone has the right to be on the platform, which, in turn, makes it easy to justify these forms of deplatforming and censorship, and the resulting self-censorship, too.

cnston OpenSSH Post-Quantum Cryptography

The notice at stake is about key agreements (aka KEX aka Key Exchange), not about the keys themselves.

If you look at http://mdoc.su/o/ssh_config.5#KexAlgorithms and http://bxr.su/o/usr.bin/ssh/kex-names.c#kexalgs, `ecdsa-sha2-nistp256` is not a valid option for the setting (although `ecdh-sha2-nistp256` is).

cnston Richard Stallman: GitHub was so bad for free software (2019)

Is (lists.gnu.org) down?

Here's a copy:

https://archive.is/VGGbe

cnston GitHub is no longer independent at Microsoft after CEO resignation

The problem is that someone still has to polish their resume when working for GitHub (aka resume-driven development), so, they're actually making GitHub worse now:

Why is GitHub UI getting slower? - https://news.ycombinator.com/item?id=44799861 - Aug 2025 (113 comments)

cnston GitHub is no longer independent at Microsoft after CEO resignation

This is kinda pretty ridiculous.

Isn't GitHub's entire visibility and pervasiveness is entirely due to the OSS?

So, now they're basically saying to OSS, "so long, and thanks for all the fish"?

cnston MCP overlooks hard-won lessons from distributed systems

No, you're thinking about USB-A to USB-A, which is definitely prohibited by the spec. (Whereas USB-C to USB-C cables are most certainly not disallowed.)

What's disallowed is for a non-host to have USB-A, hence, USB-A to USB-A is impossible, because one side of the cable has to be connected to a "device" that's not acting in host mode.

Only the host is allowed to have USB-A.

This is exactly why USB-A is superior to USB-C for host-only ports on embedded devices like routers (as well as auxiliary USB ports on your desktop or monitor).

Generally, many modern travel routers have one USB-C and one USB-A port. Without any documentation or pictograms, you can be relatively sure that USB-A would be used for data, and USB-C is for power (hopefully, through USB-PD). Since USB-A couldn't possibly be used to power up the router, since USB-A is a host-only port.

USB-C is great for USB-OTG and the bidirectional modes, when the same port could be used for both the host and the peripheral device functions, like on the smartphones. https://en.wikipedia.org/wiki/USB_On-The-Go

If the port can ONLY be used in host-mode, and does NOT support Alt Mode, Thunderbolt, or bidirectional USB-PD, then USB-A is a far more fitting connector, to signify all of the above.

cnston Anti-competitive practices masquerading as security is a dangerous pattern

It's fine to think this will never happen to you because you're not important enough, or not controversial enough, or have the most mainstream ideas that would guarantee that you won't be a target…

Until it does happen…

The situation here is also a bit different from moderating "a public website".

Noone's saying that everyone should have the right to have their presence and reach amplified.

But these bans on LinkedIn and GitHub apply to the entire account and the entire identity of the user, meaning, you could now be precluded from doing the most basic things compared to all of your peers.

LinkedIn ban precludes you from connecting to employers at in-person events unlike every other attendee. GitHub precludes you from working at any startup that uses GitHub in their workflow.

Plus, as the example shows, causing any sort of disruption isn't even a prerequisite to getting banned by these services.

cnston Anti-competitive practices masquerading as security is a dangerous pattern

Note that the former employee of her company was still left permabanned even after producing the ID, per the post.

So I can totally understand why she wouldn't play those games!

To be frank, it would seem that producing an ID in such a situation, is pointless from the user's POV. It seems like it's simply abused by the vendor to institute and enforce a permanent ban.

cnston OpenSSH Post-Quantum Cryptography

They're not the same, they're completely different:

> Additionally, all the post-quantum algorithms implemented by OpenSSH are "hybrids" that combine a post-quantum algorithm with a classical algorithm. For example mlkem768x25519-sha256 combines ML-KEM, a post-quantum key agreement scheme, with ECDH/x25519, a classical key agreement algorithm that was formerly OpenSSH's preferred default. This ensures that the combined, hybrid algorithm is no worse than the previous best classical algorithm, even if the post-quantum algorithm turns out to be completely broken by future cryptanalysis.

The 256 one is actually newer than the 512 one, too:

> OpenSSH versions 9.0 and greater support sntrup761x25519-sha512 and versions 9.9 and greater support mlkem768x25519-sha256.

cnston Battery charge limiter for Apple Silicon MacBook devices

The actual best-practice for batteries is 50% when unused, and the 20% to 80% range when used.

They already don't provide 50% at all, even though my laptop has been kept connected to mains for 1 year straight. All I get is a range of 76% to 80% or so, with a battery life that keeps diminishing for no reason.

But, in reality, they don't even provide the 20% to 80% range, either, because it still charges to 100% on each disconnect, however brief it may be.

I've had multiple batteries completely fail within just a few years after being topped up to 100% all the time.

I also have a ThinkPad with a 15-year-old battery that's still working just fine (1 hour runtime is not that bad for such an old battery), because it's been kept at the 50% most of the time when I don't need to use it on the go. If it was kept at 100%, I'm pretty sure it wouldn't last 2 minutes now.

cnston U.S. Government to Take Cut of Nvidia and AMD A.I. Chip Sales to China

https://archive.is/9gLP1

cnston Tesla remotely deactivates rapper's vehicle for singing about the Cybertruck?

I think they bought and rebranded to threads.com only recently, the service started as threads.net, and there's a bunch of links to dot net.

cnston Tesla remotely deactivates rapper's vehicle for singing about the Cybertruck?

Yup. The supercars also famously ban some owners from purchasing them again, e.g., Ferrari:

https://www.hotcars.com/banned-for-life-celebrities-ferrari/

cnston Tesla remotely deactivates rapper's vehicle for singing about the Cybertruck?

"Certified Mail and Email", yeah, right, because it totally makes to wait 10 days before suddenly disabling a car for no reason!

This guy didn't even bother to hire a tow truck to make the story at least somewhat more believable!