Hacker News Reader

colmmaccon We just shipped support for the ugliest part of HTTP: Vary

Wow this brings back memories. Over twenty years ago I added Vary support to various mod_cache submodules for Apache 2.0, and it was way too high a pain to reward ratio. It just uncovered so many user agent bugs and crazy backends. I remember arguments about being able to cache variable based on non-literal virtual headers (e.g. a geo location header), and a crazy request to Vary based on "Date:" ... which makes absolutely no sense. The whole thing was just too clever for its own good. It's no surprise that language selection ended up in URLs (/en-US/..) rather than "Vary: Accept-Lang" features.

colmmaccon Anthropic's ‘watermark’ text adulteration in Claude is a perversion of writing

I think the article is wrong on this but it's more subtle than that. Probability distributions have a peak; there is still a token with a peak probability. What's interesting about these techniques is that token by token it can actually make the peak token even more probable. A distribution doesn't have to be "flattened" to leave a watermark - it can be "amplified" and made "more peaky".

colmmaccon France's Anssi Will Block PQC-Free Products from Certification Starting 2027

I was at ANSSI headquarters last year doing a technical presentation and several of their questions were about Post-Quantum Cryptography, "Q day" (when a practical Quantum Computer is expected) and other related things. They keep a close eye on this stuff and it's to their credit. Similarly the BSI in Germany have been promoting Post-Quantum security for some time now.

I work at AWS, where we have been deploying Post-Quantum Cryptography for quite some time and have experts. We're making easier than ever, but the sudden changes in deadlines do make me wonder how many companies are going to have to spend more time than they'd planned on migrations and settings. The "context switch" of working on PQ can be quite expensive. Most tech people have no idea what ML-KEM, ML-DSA, or HQC are, or how to not worry about SHA, HMAC, or AES. It's going to be a ride!

colmmaccon Delta flight hit by firework while landing at Midway Airport on Fourth of July

You're right but in my experience in Washington state - Park rangers, forest fire marshals, and reservation police will all rigorously enforce the bans in places that are prone to wild fires. The local community won't have much sympathy either. People get how dumb that is. You also see bans enforced in very well off communities that basically have their own police force too. It's fascinating how these micro-cultures all self-regulate.

colmmaccon 24-bit/192kHz music downloads and why they make no sense (2012)

32-bits are great for recording too because they do an incredible job of capturing the dynamic range without having to be precise on the preamp settings. It removes an entire job from the recording workflow.

192 for mixing and mastering can be useful especially if you're doing a lot of effects, especially anything that pitch shifts. But I've seen low quality phone-microphone recordings make it to the master; if you capture lightning in a bottle, it hardly matters what the settings were, what the microphone was, or anything else.

colmmaccon Anthropic's open-source framework for AI-powered vulnerability discovery

Unless it is very specific to a proprietary product, craftspeople take their jigs with them from job to job, building up a personal library over a career. As a software developer I've always had a well-tuned IDE and shell config in a safe place.

Something I think about a lot is what is the equivalent for the software builders of today using AI tools? how do make these harnesses exportable and portable? You might think employers would be against this; make it more costly to leave. But I actually think most will favor this because it makes people more productive more quickly. But we have to find ways to normalize it and show that there are no security leaks in the process (like might make it in to a set of personal steering prompts).

colmmaccon How Shamir's Secret Sharing Works

Reed-Solomon is an Erasure code, and I definitely wouldn't look to that for Secret Splitting. Those leakage models are gnarly. But if you want something else that is more general - there are Monotone Span Programs. Seriously underused.

colmmaccon Pope Leo XIV’s first encyclical Magnifica humanitas to be published May 25

Chris Olah, one of Anthropic’s co-founders, got in touch. What followed was, by McGuire’s own description, mind-blowing. “They basically were asking for direct help from the Vatican to convene and help the industry, because the industry was going so fast down this road,” he recalled.

colmmaccon IPv6 traffic crosses the 50% mark

If GitHub flipped a switch and enabled IPv6 it would instantly break many of their customers who have configured IP based access controls [1]. If the customer's network supports IPv6, the traffic would switch, and if they haven't added their IPv6 addresses to the policy ... boom everything breaks.

This is a tricky problem; providers don't have an easy way to correlate addresses or update policies pro-actively. And customers hate it when things suddenly break no matter how well you go about it.

[1] https://docs.github.com/en/enterprise-cloud@latest/organizat...

colmmaccon Is legal the same as legitimate: AI reimplementation and the erosion of copyleft

The four essential freedoms of the Free Software movement are ...

1. The freedom to run the program as you wish 2. The freedom to study how it works and modify it (which requires access to source code) 3. The freedom to redistribute copies to help others 4. The freedom to distribute modified versions, so the whole community benefits from your improvements

To my mind ... GenAI coding make all of these far more realizable, especially for "normal people", than CopyLeft ever has. Let's go through them ...

Want to run a program as you wish? Great! It's easier than ever to build a replacement. Proprietary or non-free software is just as vulnerable to reimplementation as Copyleft is.

Want to study a how a program works and to modify it? This is now much more achievable.

Want the freedom to redistribute copies to help others? Build your own version! It may not even be copyrightable if it's 100% generated (IANAL).

Want to distribute modified versions? yes! see previous.

I dunno; seems like generative coding can be as much a liberator as any kind of problem.

colmmaccon How Big Diaper absorbs billions of extra dollars from American parents

EC only works if parents are the sole carers, and every success story I've heard had one main parent doing 90% of the care-taking. No daycare would do it, and if you can find a nanny, au-pair, grand-parent or other carer who is up for it ... small kids still just behave differently around different people. If they have a different level of comfort, anxiety, or reluctance with a person it breaks down.

colmmaccon How Big Diaper absorbs billions of extra dollars from American parents

Our two year old is potty training right now, and this was definitely a factor for us. We had to wait until it could be explained. Another factor is that diapers are now so absorbent that the kid feels no real discomfort from a pee or a poop. His main motivation is peer pressure and to be a bigger kid; concepts he's only recently caught.

colmmaccon 1940s Irish sci-fi novel features early mecha and gravity assists

That's almost certainly right. I couldn't see that as anything other than "Teal" but Éalú makes perfect sense especially thematically.

colmmaccon 1940s Irish sci-fi novel features early mecha and gravity assists

That does make more sense.

colmmaccon 1940s Irish sci-fi novel features early mecha and gravity assists

Native Irish Speaker and Sci-Fi fan here. What an unexpected delight. For those who might not pick it up , the author name "Máiréad Ní Ghráda" is that of an unmarried (that's the "Ní") woman ("Máiréad" which is like a variation of Mary).

Here's my Translations of the Chapter titles. I'm pretty sure many of these have old-Irish style séimhiú (a dot above a consonant denotes what would now be a h after the consonant) in the originals that have not been translated by the OCR, so there are several missing h letters. If I weren't on a plane over Afghanistan, I'd download the PDF to check. Will update the repo when I can!

   Pláinéid na feaca Súil Duine riamh = A planet no person's eyes have ever seen
   An Radarc, tríd an gCiandracán = the view throughout the [Ciandracan] (this is a compound proper noun, "Cian" is "head" or "brain" and "racán" could be visor or rocket)
   An Turas go Manannán = the Trip to Manannán
   Manannán = Manannán (it's a noun, which is very similar to the Irish term for the Manx and the Isle of Mann). 
   Muintear Manannáin = the people of Manannán
   na 'Cráidmí' = the Craidmi (I think it's just a plural noun)
   An tÁrd-Máigistir = the high Magistrate, or possibly the supreme magistry
   An Priorún = the Priory
   Oidce sa Coill = The class/lesson/teaching in the woods/forest
   An tinneall = the fire
   Oidce tar Oidceanta = Lesson upon lesson
   Lug Lám-fada = the long-armed lug
   An Tróid leis na 'Cráidmí' = The war with the Craidmi
   Diogaltas = Revenge
   An téalod = not sure about this one

colmmaccon Ireland rolls out basic income scheme for artists

Grafton St buskers at their best are really really good, but there are also some very average buskers there every day too. New Orleans is a stand-out in the US where you can find world-class jazz bands playing on the streets.

Nashville has plenty in the evenings, and then you can find hot spots in some cities. I've seen regular buskers in Boston, Seattle, Sarasota, and Boulder - usually in pedestrianized touristy quarters.

colmmaccon The Feynman Lectures on Physics (1961-1964)

Lesser known but possibly more relevant to most HN readers are Feynman's lectures on computation - https://theswissbay.ch/pdf/Gentoomen%20Library/Extra/Richard... . There's some really great explanations in there of computability, information theory, entropy, thermodynamics, and more. Very little of it is now out-dated.

colmmaccon Irish man with valid US work permit held in ICE detention for five months

I don't support this kind of detention, but the case reads like he overstayed his original conditions of entry.

According to the court order, he entered the US on the Visa Waiver Program in 2009. He may have a work permit now because anyone can file for an Employment Authorization Document (EAD) through an I-765 while they are applying for a green card through marriage, but there's no indication that he had work permits before that. I've encountered Irish people throughout the US in similar situations.

colmmaccon What came first: the CNAME or the A record?

I am very petty about this one bug and have a very old axe to grind that this reminded me of! Way back in 2011 CloudFlare launched an incredibly poorly researched feature to just return CNAME records at a domain apex ... RFCs be damned.

https://blog.cloudflare.com/zone-apex-naked-domain-root-doma... , and I quote directly ... "Never one to let a RFC stand in the way of a solution to a real problem, we're happy to announce that CloudFlare allows you to set your zone apex to a CNAME."

The problem? CNAMEs are name level aliases, not record level, so this "feature" would break the caching of NS, MX, and SOA records that exist at domain apexes. Many of us warned them at the time that this would result in a non-deterministic issue. At EC2 and Route 53 we weren't supporting this just to be mean! If a user's DNS resolver got an MX query before an A query, things might work ... but the other way around, they might not. An absolute nightmare to deal with. But move fast and break things, so hey :)

In earnest though ... it's great to see how now CloudFare are handling CNAME chains and A record ordering issues in this kind of detail. I never would have thought of this implicit contract they've discovered, and it makes sense!

colmmaccon What an unprocessed photo looks like

I've always considered that Tim Jennison quote to be a reference to C.P. Snow's "The Two Cultures" lecture. Steve Jobs' ambition for Apple to be "where the Liberal Arts and Technology meet" also seemed similarly influenced. If you haven't read Snow's lecture, it's well worth the quick read.

colmmaccon Maybe the default settings are too high

There is a great meditation in Zen and the Art of Motorcycle Maintenance about the differences between riding and driving. Being open to the elements, in and a part of nature, is visceral. Bubbled in a car, our surroundings are observed more than experienced. That's always resonated for me.

colmmaccon The IPv4 address swamp: The new normal

The transition to 7200 VXRs as core routers really hit a tipping point around 2000. They could handle millions of entries in the FiBs and really led to a relief in pressure. Subsequent devices had to match that.

On the IPv6 side; by 2002, nobody was really experimenting with A6 records any more, and EUI64 was needless. Both were parts of IPv6 designed to facilitate "easy" renumbering, so that single prefixes could be replaced with larger ones. But the ISPs weren't complaining any more about table size.

colmmaccon Ireland’s Diarmuid Early wins world Microsoft Excel title

The Oscars, The Golden Globes, the Emmys, just a few!

colmmaccon Constant-time support coming to LLVM: Protecting cryptographic code

I don't think it's nefarious but it is sabotage. There's long been an implicit assumption that optimization should be more important than safety.

Yes, languages do lack good mechanisms to mark variables or sections as needing constant-time operation ... but compiler maintainers could have taken the view that that means all code should be compiled that way. Now instead we're marking data and section as "secret" so that they can be left unoptimized. But why not the other way around?

I understand how we get here; speed and size are trivial to measure and they each result in real-world cost savings. I don't think any maintainer could withstand this pressure. But it's still deliberate.

colmmaccon The Pen and the Spade: The Poems of Seamus Heaney

I bought this latest Heaney book while I was in Ireland recently and it lives in my nightstand, along with the other Heaney books in the series (his letters, and his translations). They are an endless marvel and constantly make me ponder. Part of the attraction for me is that Heaney is simultaneously a peerless transcendent writer, but also is very everyday. He came from a working class, or maybe lower middle class, background and stuck to Belfast and Dublin and lived a relatively humble life. When I think of Yeats I can only see him in Tweed suits, visiting country estates with servants, and making posturing speeches in the Irish Senate. Yeats was an expert commentator, but removed from many of the experiences and lives he documented. Heaney really lived them. It's so much more relatable.

colmmaccon Public trust demands open-source voting systems

So they open the source ... how do I know that's what's running on the voting machine? There's really no good practical solution to this problem. What matters more is that there is a voter-verified paper audit trail and that this record is actually counted. At least by spot check risk-limiting audits, but ideally just count every vote manually to verify.

colmmaccon Secret diplomatic message deciphered after 350 years

No, this absolutely is not how forward secrecy works in TLS. Forward secrecy protects against a break in the signature algorithm, but not in the key agreement algorithms.

Both the FFDH and ECDH key agreement algorithms are vulnerable to quantum crypt-analysis; someone capturing traffic today could later break that agreement and then decrypt the data. An attacker would have to capture the entire session up to the "point of interest" though.

This is why FFDH/ECDH are being augmented with Post-Quantum secure KEMs.

colmmaccon Ultrasound is ushering a new era of surgery-free cancer treatment

https://www.statnews.com/2024/06/22/hank-green-pissing-out-c...

Watching Hank Green's YouTube video where he found out that his cloudy pee was cancer leaving his body, he was surprised that doctors don't tell you to expect it. It can be such a morale boost.

colmmaccon Corporations are trying to hide job openings from US citizens

Completely open borders migration between all countries would be the biggest such market correction. If every development job was open to every qualified developer in the world, I suspect software salaries in the US would be much lower.

colmmaccon Corporations are trying to hide job openings from US citizens

Interestingly, there's a whole category of H1B visas just for fashion models. H-1B3, which is for models with "distinguished merit and ability".

A famous supermodel can most likely get an O1 visa, for people of extraordinary ability. But agency models more commonly work on H1-B. Melania Trump is a famous example. These visas are tied to an employer and there's less portability. It's a two tier system.

Personally I think that there is some harm here. Agencies bring in young women from relatively poor countries and they are put in conditions where abuse, even sexual assault, is common and can face pressures to tolerate conditions and shoots that a local person with a safety network would not.