HNHacker News
TopNewBestAskShowJobs

cnst

3,678 karma · joined December 18, 2013

submissionscomments
cnst··on Tesla remotely deactivates rapper's vehicle for singing about the Cybertruck?
Tesla's screen is just a computer that can play YouTube and any other videos.

Just upload a video to YouTube, open up on Tesla, enable full-screen, done. Not even any hacking or any tech knowledge required.

Literally anyone can generate and print a letter. Finding the name of the legal counsel is just a LinkedIn search away.

100% fake.

Especially USPS and email thing.

cnst··on Battery charge limiter for Apple Silicon MacBook devices
macOS is unreliable period; mine gets charged to 100% immediately after a power outage of any kind, e.g., re-arranging the monitor/laptop, or an actual power outage.

Obviously, it'd be nice if it knew of power outages upfront, but charging to 100% after one, is kinda pointless.

Then it stays at 100% for several days, until discharging to 80% several days later.

It's supposed to be smart, but instead it causes the user to alter their own behaviour, e.g., not disconnect the USB-C when rearranging the desk, even if disconnecting would be far more convenient when doing a cleanup or re-arranging furniture.

I miss the time when Apple used to give you choices…

cnst··on Battery charge limiter for Apple Silicon MacBook devices
We've literally had configurable charge levels on ThinkPads since the time they were still owned by IBM over 20 years ago, yet Apple still can't figure out to provide such an option 20 years later?

Their whole ML thing is super annoying. Basically, it means you can never disconnect your Mac from your USB-C monitor, lest it immediately charge to 100% upon a reconnect, and discharge back to 80% only a few days after keeping it at 100%.

cnst··on Anti-competitive practices masquerading as security is a dangerous pattern
Aline describes her experience in 2023 of getting permabanned from LinkedIn for several days, until finding a human contract through one of the investors in her startup.

Possible reason for the ban is her content makes mention of LinkedIn in a way that wasn't expressly approved by LinkedIn, and it all happened only after she took their offer to pay $500 to promote the post.

TIL FB isn't the only network to be asking for government-issued IDs all of a sudden.

cnst··on Happy BuyNothing Day
I try to combat the shopping addiction by ensuring for every purchase, (1), that the price is really good, (2), that the quality is actually really good, too.

For example, $149 for a great monitor is a great deal. But it has to be IPS, USB-C, DP 1.4, QHD or higher, 400nits etc. Normally, these retail for $599, so, I don't buy. Many monitors retail for $99, but they're FHD 250nits VGA crap.

Slickdeals.net is a nice website where you can find some of these deals. Keep in mind that even for really good deals, some people over there would still be unhappy and would still expect higher specs or lower price, so, you have to use your own judgement whether something is good or not. Recently missed a 32in 4K UHD monitor at 159.99 because it was a VA, and people complained too much that VA sucks, but the rest of the specs were just too good, and it sold out quickly; OTOH, I can now wait for a better deal!

cnst··on Why is GitHub UI getting slower?
Re going to author's profile, I usually just give up, and go to the URL to fix the address.

You'd think clicking on author's name in commit log view would bring you to their profile — social coding, after all — yet it simply filters the log by author.

Just checked, apparently, they do have a tooltip popup in "Commits" log view to go directly to the author, but who has the time to wait 1s until the tooltip's appearance? Clicking on the name simply filters commits by the author, clicking again, just reloads the same page you're already on — but, hey, at least they didn't break the URL addresses yet!

cnst··on MCP overlooks hard-won lessons from distributed systems
But the models can already hallucinate in any case, so, how's that JSON's fault?
cnst··on What the Windsurf sale means for the AI coding ecosystem
This has actually always been the case (Dan Luu's article from 2015 comes to mind), but, previously, it required doing a bit of actual math, and doing a bit of reading:

https://news.ycombinator.com/item?id=10758278 (2015 danluu.com/startup-tradeoffs)

This Windsurf employee #2 revelation of the 99% loss in value for employee stock, is simply a confirmation of an existing practice, just more visible and easier to reason about.

cnst··on MCP overlooks hard-won lessons from distributed systems
Why would a hype protocol use outdated concepts instead of the hype JSON?

Wouldn't medical records actually be better in JSON, because the field could expressly have "kg" or "lb" suffix within the value of the field itself, or even in the name of the field, like "weight-in-kg" or "weight-in-lb"? This is actually the beauty of JSON compared other formats where these things may end up being just a unitless integer.

The biggest problem with medical data would probably remain the human factor, where regardless of the format used by the machines and by MCP, the underlying data may already be incorrect or not coded properly, so, if anything, AI would likely have a better chance of interpreting the data correctly than the API provider blindly mislabelling unitless data.

cnst··on MCP overlooks hard-won lessons from distributed systems
What did you expect of a Medium article? The stereotype is simply being reinforced here.
cnst··on MCP overlooks hard-won lessons from distributed systems
I think this article is missing the point that MCP is simply using the mainstream building blocks that have already regressed from what we've had previously, namely, JSON in place of proper RCP.

The ISO8601 v Unix epoch example seems very weak to me. I'd certainly expect any model to be capable of distinguishing between these things, so, it doesn't seem like a big deal that either one would be allowed in a JSON.

Honestly, my view that nothing of value ever gets published on medium, is strongly reinforced here.

cnst··on Emailing a one-time code is worse than passwords
> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login.

Why is NOONE talking about this? This is exactly why 2FA is less secure than password authentication, because with a password authentication, the attacker actually has to be able to capture the password in some way, whereas with 2FA, effectively anyone anywhere with the skills akin to the most junior private investigator, has the capability and tools to take over anyone's account "protected" by 2FA.

Yet we're still being told that 2FA is mandatory because security is important, and that somehow 2FA is still more secure.

cnst··on MCP overlooks hard-won lessons from distributed systems
I'd like to add that the culmination of USB-C failure was Apple's removal of USB-A ports from the latest M4 Mac mini, where an identical port on the exact same device, now has vastly different capabilities, opaque to the final user of the system months past the initial hype on the release date.

Previously, you could reasonably expect a USB-C on a desktop/laptop of an Apple Silicon device, to be USB4 40Gbps Thunderbolt, capable of anything and everything you may want to use it for.

Now, some of them are USB3 10Gbps. Which ones? Gotta look at the specs or tiny icons, I guess?

Apple could have chosen to have the self-documenting USB-A ports to signify the 10Gbps limitation of some of these ports (conveniently, USB-A is limited to exactly 10Gbps, making it perfect for the use-case of having a few extra "low-speed" ports at very little manufacturing cost), but instead, they've decided to further dilute the USB-C brand. Pure innovation!

With the end user likely still having to use a USB-C to USB-A adapters anyways, because the majority of thumb drives, keyboards and mice, still require a USB-A port — even the USB-C ones that use USB-C on the kb/mice itself. (But, of course, that's all irrelevant because you can always spend 2x+ as much for a USB-C version of any of these devices, and the fact that the USB-C variants are less common or inferior to USB-A, is of course irrelevant when hype and fanaticism are more important than utility and usability.)

cnst··on What the Windsurf sale means for the AI coding ecosystem
If a #2 employee of such a unicorn startup with so much funding got dealt such a blow in this deal, what does this tell us about our prospects as employees of any startup?

Isn't this an admission that you cannot get rich by getting a job at a hot private early-stage startup? Even if you're the employee #2?

That you'd be far more likely to get rich by getting a job at Google / Meta / Amazon, getting rich through RSU time-of-award to time-of-disposition growth, then doing private investing in a company like Windsurf, then getting even richer as an investor, all actual employees creating value be damned?

cnst··on 79% of OpenBSD kernel source is AMD DRM
I'm not talking about this specific AMD DRM code that's taking over the entire tree, I'm talking about the specific other examples that I've outlined in my prior message.

Instead of violating the HN guidelines by assuming malice and portraying me as never having bothered to think about the issue, why don't you educate all of us why exactly is it a problem to have the build lists and usbdevs/pcidevs artefacts be part of the repos of reputable open-source projects like OpenBSD / NetBSD? Specifically, addressing the lack of benefits that I've identified as existing in the status quo?

Because all these other people who have an issue with such practice, never bother to provide any convincing arguments why the rule should never be violated, either, and how the benefits that I've identified, aren't worth the hassle. They literally just don't even listen why we're doing it, and they never provide alternatives that fit the requirements and don't require lots of extra worse or hassle. And they're not even doing OSS, either, so, it's not like their code quality is even better in any way, because it's well known that the quality of the closed-source software is often far worse than OSS, especially when we're talking about OpenBSD here.

cnst··on M5 MacBook Pro No Longer Coming in 2025
I mean, that's the reason I got the late-2020 MBA M1 16GB in September 2022, instead of going for M2 24GB 512GB for twice the price, because M2 downgraded the 256GB SSD, so, you'd have to get 512GB to get the same performance as M1 256GB, and then might as well max out the RAM at 24GB, too, and now suddenly you're paying 2x for the base model with max RAM compared to the maxed-out base M1 MBA.

So, if you agree with the constraints I've mentioned, how are they inaccurate? The early-2020 Intel MacBook Air does support dual external monitors, it's an M1 regression where it's no longer supported, and it took them until M4 to finally fix the regression, it's present in every MBA until then, and in several MBP models, too.

cnst··on M5 MacBook Pro No Longer Coming in 2025
I think the last power loss here was 8mo15d ago at my place (around Christmas time in 2024?), but it could easily result in a data loss if you're using an external SSD through a dock, because your MacBook lacks a sufficient port supply, and because internal storage is severely limited by Apple, too, so, you may as well be required to use it with an external SSD at all times.

4k@27in may be too small pitch, but QHD@27in would be too pixelated. Especially on macOS that does NOT allow turning off antialiasing.

I'm currently using the 400nit HP Z24m G3 @ 2560x1440 @ 24in with my 16GB MBA M1, the colours are absolutely amazing compared to the cheaper Lenovo monitors.

Firefox works great, because it lets you turn off antialiasing, but there's no way to turn it off in Brave or Chrome, which results in super washed out and blurry text everywhere.

Honestly, macOS is not production ready at this point. Data loss because you have to use an external SSD through a dock, poor monitor support with regressions after moving to Apple Silicon, no ports for anything, inadequate RAM/storage that cannot be upgraded in any way besides the external SSD through a dock with a UPS.

Basically, the most simple things are super complicated.

Didn't it used to be the opposite with the Macs, where they were actually simpler and more flexible?

cnst··on M5 MacBook Pro No Longer Coming in 2025
That's the thing, the brightness is actually only 350nits on Dell, but 400nits on HP and Philips I've linked; the original MSRP was the same as the Dell, it's only the sale price that ended up being really good on those. So, the only TB monitor in its class actually has worse brightness than many of the non-TB options.

The HP is calibrated and has amazing colours, and it's 90Hz, too, although I keep it at 60Hz.

The Philips monitor is 4k UHD and also IPS Black, same 2000:1 contrast as all IPS Black panels share, so, I'm not sure why you'd get the Dell with the lower resolution and lower brightness at a higher price. The only true benefit of Dell is 2.5GigE and 120Hz, but 350nits is actually a downside compared to 400nits of the cheaper monitors I've listed.

BTW, you've never addressed the UPS issue.

Do any docks at all work when the power is out? How do you take that into account when you need to connect stuff like SSD, kb and mouse? Do you suffer data loss on your SSD because your laptop lacks standard ports and dock use is required that can't be powered by the laptop anymore? Or do you get UPS for your laptop just for the dock? I just don't understand how the dock requirement is not a big deal. I got a laptop simply because it's fanless and has an integrated UPS, I didn't need it to be portable otherwise.

cnst··on Emailing a one-time code is worse than passwords
What about all those services that force you to enable 2FA with SMS? How could you possibly know whether or not that opens you up to these SIM swap attacks?
cnst··on Emailing a one-time code is worse than passwords
SMS is literally the least secure form of authentication, because numbers expire after mere weeks, and get re-assigned shortly, within months, because of number shortage in many area codes.

Nothing like this could happen with any mainstream mail service like Gmail, where it's officially advertised that the accounts could never be reused.

The worst part about SMS is that not only is there the potential to be locked out permanently, but also you never know whether or not the service would allow login or password reset via SMS, thus, you never know if you're opening yourself to account takeover.

cnst··on M5 MacBook Pro No Longer Coming in 2025
Yeah, my $79 Chromebook, could literally already do 2 external USB-C monitors, at 1/10th the price of an M4 MacBook Air!

The best part about DP MST is that most monitors already have a DP-Out, so, you can already daisy-chain even without having to buy a cheap dock.

I'm pretty sure DP-Out would be even more popular if not for the macOS users leaving all the negative reviews about the daisy-chaining not working after paying a full half price for a DP MST monitor compared to a Thunderbolt one!

Ironically, some manufacturers simply remove the DP-Out port, and release the resulting product as a Mac-friendly version of an identical PC monitor with a DP-Out.

My fav USB-C / DP MST monitor deals, have been HP Z24m G3 at $149.99 USD in early 2024, and PHILIPS 4K UHD IPS Black 27E2F7901 at $209.99 in mid/late 2024, both 400nits with DP 1.4, USB-C and DP-Out, at far cheaper prices than any comparable Thunderbolt monitor:

https://slickdeals.net/f/17456364-23-8-hp-z24m-g3-2560x1440-...

https://slickdeals.net/f/17650827-philips-creator-series-27e...

cnst··on M5 MacBook Pro No Longer Coming in 2025
> CalDigit TS4

Wait, that's a $379 dock? Isn't it a bit too much to pay so much just to get back about the same ports that most non-Macs still have?

If I connect my peripherals like SSD and mouse/kb through this dock, will they continue working during a power outage? Or do I now have to get a UPS for my laptop, too, because I can't use the native ports anymore, and have to use a dock to connect the most basic equipment?

> Dell U2724DE

https://www.dell.com/en-us/shop/dell-ultrasharp-27-thunderbo...

$599 USD for QHD 2560x1440? That's just not very competitive.

I got a QHD 2560x1440 with RJ45 and a DP-Out for $149 brand new, for HP Z24m G3:

https://slickdeals.net/f/17456364-23-8-hp-z24m-g3-2560x1440-...

So, it's basically a 4x premium for TB.

---

Many monitors on the market today do come with a dock built-in, but most of the time, it's a DP MST kind of dock, so, the daisy-chaining won't work in macOS, since it has no support for DP MST.

Thunderbolt is VERY rare across most monitors. It's even more rare on the models that go on sale and aren't broken in some fundamental way (IIRC, some Samsung TB monitor that was on sale, would actually have terrible reviews specifically because it still didn't work daisy-chained properly).

Since you're a Dell fan, I've just casually looked over the filters at https://www.dell.com/en-us/shop/computer-monitors/ar/8605, and it's got 42 for USB-C, but only 6 for Thunderbolt; that's 7 times more non-Thunderbolt monitors that Thunderbolt.

If we limit the search to QHD 2560x1440, there's 11 USB-C, but only 1 Thunderbolt. You're basically paying 2x more, or $300 more, for a "free" Thunderbolt dock.

Compare to DP-Out options. For example, HP Z24m G3 2560x1440 was on sale for many months throughout 2024 at $149.99 USD brand new, it does have DP-Out and RJ45, a very quality monitor.

As for battery life, I'm not doing video encoding or compiling on my Mac, so, battery life is just a matter of power consumption. There are many ARM-based Chromebooks that are powered by like 5W CPUs. By definition, they're INCAPABLE of consuming their 50Wh battery in less than 10 hours; this often results in a better battery life than my MacBook Air, simply because M1 is still a 15W CPU, and can easily made to waste lots of cycles doing pointless webpage busywork that noone cares about, diminishing the battery life.

Yes, they've finally fixed the regression with a second monitor come M4, but it's still missing the most basic ports and expansion features.

cnst··on Flipper Zero dark web firmware bypasses rolling code security
The problem is that the overwhelming majority of cars are effectively abandonware on this metric.

This is exactly the benefit of the free software, and why having your own ability to fix, recompile and reinstall the software, is essential, even on things such as cars where you may think it's not needed or is too complex to handle.

cnst··on M5 MacBook Pro No Longer Coming in 2025
I'm writing this on a 16GB M1 MacBook Air, but I've gotten disillusioned with macOS and Macs.

When everything is done in a browser, the biggest differentiator on a laptop would be monitor and peripheral support, and Apple is behind the competition.

macOS has no support for daisy-chaining with DP MST, no support for a second monitor (new to M1, the 2020 Intel model does support dual external monitors), no way to turn-off antialiasing, limited ports, RAM and storage options, limited repair and expansion options.

Why exactly do we even still use macOS anyways?

Even the cheapest Chromebook laptops have better monitor support and better expandability, at 1/10th the cost.

cnst··on M5 MacBook Pro No Longer Coming in 2025
How's a "2-3 year cycle" sensible or sustainable?

Who's forcing you to get every upgrade every year?

The yearly releases make a lot of sense for everybody, because then you can upgrade on your own schedule, instead of delaying the upgrade because the product was released a full 2 years ago, at a time your older one is on its last breath.

In fact, yearly releases are then also more sustainable, too, since the purchasing would be spread out to each year (on an as-needed basis), instead of having a month-long cycle every 3 years, necessitating the extra infrastructure all along the way (from the stores to manufacturing to shipping).

cnst··on A message from Intel CEO Lip-Bu Tan to all company employees
Like this?

https://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished...

https://news.ycombinator.com/item?id=6033113

cnst··on AWS Restored My Account: The Human Who Made the Difference
https://www.theregister.com/2025/08/06/aws_wipes_ten_years/

> An AWS spokesperson told The Register: "We always strive to work with customers to resolve account issues and provided advance warning of the potential account suspension. The account was suspended as part of AWS's standard security protocols for accounts that fail the required verification, and it is incorrect to claim this was because of a system error or accident."

Note that this deletion — without the supposedly standard 90d grace period — was NOT an error (up until the time it's been reinstated, apparently).

cnst··on 79% of OpenBSD kernel source is AMD DRM
Not relevant because AMD DRM is still the same, and it is distributed via Linux.
cnst··on AWS Restored My Account: The Human Who Made the Difference
That's just excuses that ignore the fact that AWS was never popular even before any of these restrictions came about.

Many of the providers on those lists are older than AWS, and/or have been in business for many years since before 2010, many for 20 years or more, long before the data sovereignty concerns went mainstream all around the world in the last 10 years.

cnst··on AWS Restored My Account: The Human Who Made the Difference
Visa® Account Updater for Merchants exists precisely for this reason:

https://developer.visa.com/capabilities/vau

https://developer.mastercard.com/product/automatic-billing-u...

https://stripe.com/resources/more/what-is-a-card-account-upd...

I'm super annoyed by any hosting or telco provider that has failed to implement it, I think it amounts to negligence, especially if they stop and completely erase your entire portfolio only a couple of days after payment failure, which some officially do.

I lost my Online.net Scaleway test servers this way, because they have failed to implement the updater. Of course, their support will always blame the customer.

BTW, these Account Updaters are also the reason why changing a card number will not prevent any recurring charges, either; it's by design.

I can confirm that Amazon Prime, Visible and 123-Reg have no issues with VAU and equivalents. Your monthly Amazon Prime in the US will continue getting billed to an expired credit card without any issues, for example. Same with Visible and even the annual renewals on 123-Reg. They all don't show the new card in the interface, and still DO issue warnings that the card is expired, yet, on the billing date, it all just bills as if nothing has happened.

T-Mobile US may lack support, and Callcentric, Hetzner and Online.net, don't seem to implement an Account Updater, either, not sure about OVH.

← PreviousPage 4 of 26Next →