HNHacker News
TopNewBestAskShowJobs

compsciphd

2,248 karma · joined February 15, 2012

submissionscomments
compsciphd··on Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
if I had to guess (not a user or employee of cloudflare).

1. dm-thin operates at 64kb block sizes, but many file systems operate at 4kb block sizes.

2. the point of skip_block_zeroing is to say if we write a 4kb fs block we don't have to zero out the rest of the 60kb dm-thin block (save performance).

why would one do this? perhaps the design was that one isn't exposing the raw block device to the container, only an ext4, xfs or the like fs. In those, the fs also knows what blocks are allocated and if you try to read an unallocated block will probably cheaply return you all 0s (why spend IO time reading something you already know is all 0s, similiar to a quick format).

Therefore, zeroing out the remaining 60kb is also just a waste of IO (ala not using quick format).

However, perhaps someone then decided to use the same provisioning mechanism to enable containers to have block devices (where one can now read the underlying content directly) and boom you have a problem.

or perhaps someone didn't realize the mismatch in dm-thin block size and page size that things are written at.

compsciphd··on Ideas on modernizing the open-source desktop
one thing I'll keep on beating the drum on is that microsoft missed an opening with windows 8. WinRT UI was great for mobile, but as noted desktop is different and they tried to force it onto it.

What we need (and to some extent we get in web, i.e. gmail is different based on resolution) is different UIs based on the interface one is using. a single app that can switch between UIs.

I strongly believe the lack of this is why convertibles have remained more of a gimmick than anything else, as in practice you either keep using the app the same way you always did as you switch usages or you use different apps in the the different usage scenarios because they are tailored to that specific usage scenario. Neither are things that really sell the convertible as something with strong usage.

The closest we've gotten is things like DeX on samsung and perhaps what google is rolling out with android.

compsciphd··on Show HN: Analyst Index – analysts who make money telling you good stock calls
when I worked at thomson reuters (and then bloomberg) they already did this had their own proprietary ratings of analysts to construct a weighted average for analysts reccomendations for stocks.
compsciphd··on The Cables That Connect the World
On this note, there is/was an apartment I'm semi looking at (in practice its just a bit out of my stretching ability) in my beach town that isn't quite first row to the sea, but one street back.

But the lot behind it (which would be across the street from the first row to the sea buildings has an empty lot that actually gives a decent sea view (through some hotels, but surprisingly not that blocked). so the question is why, is this lot empty? from my research it seems its not landing site for one of the major fiber networks and is built into an underground data center for the landing. So the assumption is that this is basically about as good as one can get that the lot wont be developed (at least in the semi near future) due to the difficulty of relocating the fiber and the security implications of building a residential building on top of it. Still just a bit out of my ability (which makes me a little sad) but cest la vie.

anyways just something I learned about the fiber optic networks that connect the world in my hunt for an apartment.

compsciphd··on 2004 RuneScape fit a multiplayer RPG into 56k dial-up
Honestly, I dont know why "xbox mode" isn't this for PCs. Instead of anticheat, reboot into a stripped down mode just for playing the game that has a secure boot chain that the app can attest and report to the servers about and then reboot back into normal windows.

booting is so quick today that its hardly a friction point as it used to be.

compsciphd··on Trial is 40 days. Not until you're 40
I mean unrar is included in windows now too....
compsciphd··on AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.

However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.

With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.

compsciphd··on Debian has begun voting on the future of AI/LLM contributions
the question is, what's the worst situation for society.

People not trusting the votes being counted properly or people being coerced paid to vote some way and this making it more valuable.

A plausible solution would be to significantly delay the distribution of the record. i.e. if every election was only printed out 2-4 years after the fact, it could give people confidence that the votes are being counted properly (as otherwise they would be found out eventually), but significantly reduce the incentive for the bad behavior (if one things this actually significantly incentivizes it) because it will be a long time before they can validate if what they were given is true.

compsciphd··on State of multi-player Wayland
re #2 see metavnc (old at this point)

https://metavnc.sourceforge.net/

TLDR: it leveraged a specific client that could

a) connect to multiple vnc instances b) display them in a single window c) act as the "window manager" / "desktop environment" - doing this by enumerating menu entries from each instance and creating a composed whole. Enumerating the active applications from each instance and composing them into a single "task bar"/"window switcher" interface.

this is probably close to 20 years old now.

compsciphd··on Woman in Brazil enslaved for 55 years by 3 generations of the same family
to lose less money on the prisoners?

i.e. its not a good motivation to increase the number of prisoners (even if one looses less money per prisoner, more prisoners will mean more loss), but it does motivate investigating ways on how one can minimize the loss on individual prisoners.

compsciphd··on A Farmer Donated Land to Turn into a Park. The City Is Building a Data Center
I used to walk from the main library to the metreon every sunday (made a day of visiting library and seeing a movie). It's not a long walk to most americans. It's easy, in that its a flat walk. Less easy (at least then) as it wasn't always the most pleasant area to walk through depending which way one went (detours et al). Staying on market was fine, walking up minna (sp?) less so.
compsciphd··on Stripe is friendly to “friendly fraud”
you were thrown that way in Kazakhstan? :)
compsciphd··on How Shamir's Secret Sharing Works
that's just 3 shamir secret sharings.

key is protected by a 3 of 3 keys.

1 protected by 3 of 4 (i.e. SSS the key into a 3 of 4) 1 protected by 2 of 3 (i.e. SSS the key into a 2 of 3) 1 that just is.

so you take your original key and SSS into a 3 of 3.

you take part 1 and SSS into a 3 of 4, and take part 2 and SSS into a 2 of 3.

compsciphd··on How Shamir's Secret Sharing Works
before I learned of shamir secret sharing, I wondered why one couldn't do the same exact thing with a par2 like system (albiet with smaller pieces than a par2 system would traditionally have). i.e. you have X bits of data, you create Y*X/N sized recovery blocks (where Y > N). You hand each recovery block to individual users. and any N users can get together to recover the key and decrypt the contents.
compsciphd··on New Lifetime Plex Pass Pricing
it is annoying that it can't remember it by series. Perhaps for a normal series I don't want captions but for a foreign language one I do. Perhaps for a foreign language that I'm good at I don't want it, but for others I do. Perhaps for a foreign language that I'm learning, I want it in that foreign language (ala english for english content) but dont want it for others.

Global "works", but remembering by series would be so much better.

compsciphd··on New Lifetime Plex Pass Pricing
as someone who bought a lifetime pass years ago when it was cheap, I'm more concerned about this indicating that they are in desparate straits and are heading towards going out of business.

I like plex, I've tried jellyfin and emby and plex has always come out ahead (handling the metadata and the general user experience) and if plex goes bellyup i guess I'll move, but I'll be sad. At least I feel I've gotten my value out of my lifetime plex pass.

compsciphd··on New Lifetime Plex Pass Pricing
I had a jellyfin server on the same machine as my plex. I really tried to use both, the jellyfin experience was so much worse overall.

It had one technical feature that I valued (the ability to tone/color map dolby vision content for non dolby vision devices), but that was such a minimal feature for me (very little of my content is in the proprietary dolby vision colorspace).

compsciphd··on I’ve built a virtual museum with nearly every operating system you can think of
why could you not implement it as ptys.

Currently the terminal doesn't really process input itself, it just gives the program running the "raw" fd.

If instead the terminal gave the processes a pipe (for instance) and consumed all the pty input itself (and its end of the pipe being a buffer of that content), why wouldn't it be the same?

compsciphd··on New York, California pension leaders oppose 'extreme' SpaceX control structure
in the country I'm now in somewhere around 18% of my salary is basically put into my "pension" (basically equivalent to a 401k). around 6% from my salary, around 6% match from employer and around 6% for severance (that one gets when they leave said employer, but can stay in pension, and most reccomend it stay there unless you really need it to make ends meet as otherwise pulling out 1/3 of your pension contributions).

This is external to disability insurance that we and our employers also have to contribute to. So I'd agree to a large extent that the govt forcing employees and employers to contribute significant amounts to 401k like programs could be in the interest of everyone in the USA but one needs a disability insurance program on the side as well and that isn't particularly cheap.

compsciphd··on New York, California pension leaders oppose 'extreme' SpaceX control structure
it doesn't cover you getting disabled so you can't work anymore at the age of 30 after working 8 years.

1600% higher return is great when you work from yours 20s to your 50s/60s and can essentially self insure yourself at that point with it, but as the person you are responding to you is (I believe) trying to say, that's not everyone.

compsciphd··on Unauthorized Anthropic stock sales and investment scams
these policies hurt employees (at least US taxed ones, other countries only tax at liquidity events).

Large insiders (founders, investors et al), still get to unload their shares (i.e. to future investors), while employees who might have worked for the company for years and accumulated options (or sometimes unsellable RSUs) due to the company not being public get hit with large tax hits either at the same of vesting (for RSUs, but at least that's somewhat manageable) or at the time of leaving the company (due to the need to buy one's shares within 90 days or lose them and then be hit with a tax on the delta).

compsciphd··on Starship V3
why do you assume we wouldn't have seen value in satellites if we didn't see value in going to the moon (or mars)?

There's clearly an extraordinary value in satellites from a military perspective, for instance to enable spying. Heck, Hubble directly benefited from the work that went into spy satellites and NASA was afterwards gifted 2 uneeded spy satellites to use for scientific exploration (1 is (was? as in finished) being converted to be used, the other AFAIK is still in storage).

GPS wasn't created to enable us to do anything in space, but to focus down here on earth. i.e. what was needed to fight wars better. One can argue if that was "necessary" but it was clearly earth focused.

compsciphd··on Rewriting Every Syscall in a Linux Binary at Load Time
this has been done for ages with a simple kernel module that just wraps the real kernel syscall, no binary changes needed.

example how we used it in early 2000s to implement pre linux namespace containerization.

https://www.usenix.org/legacy/publications/library/proceedin... (note the shepherd and where kubernetes arguably got the pod name from).

and security policies on top of it

https://www.usenix.org/legacy/event/lisa07/tech/full_papers/...

compsciphd··on Netflix Prices Went Up Again – I Bought a DVD Player Instead
lots of cell phone services are no longer doing that either.
compsciphd··on Evacuation of U.S. troops from Mideast base sends community groups scrambling
"In response to an NPR request, a Navy spokesman acknowledged that 1,500 sailors, their families and several hundred pets were relocated back to the U.S. from NSA Bahrain."

Because the US moves civilians out of an active war zone?

compsciphd··on HandyMKV for MakeMKV and HandBrake Automation
If one is going to store the originals anyways (i.e. the ISO images one backs up from disc), then I'd still stand by my statement, you're not saving anything by encoding it then, beyond perhaps limitations in how much storage one can keep online at a time (and in that context then, my initial statement of storage being cheap further applies, as one is saving the same content twice).

If one is just download encodes off of usenet so doesn't have the originals, and one is content with the limitations of encodes, great. But here we are talking about tools for people who are encoding their own media (and sadly, from personal experience, I consider backed up ISOs to have a longer shelf life than many of optical discs, I have media I backed up 20 years ago now that still works, while the optical discs have degraded. Hard Disks die as well, but there are effective means of mitigating that).

compsciphd··on I built a 516-panel financial terminal in 3 weeks using AI
I haven't been at TR in 10+ years as well. AT TR, I mostly dealt with Eikon's pipeline for estimates, actuals and the like (IBES data) ingestion, querying and analytics. So can't say much, though some of my old colleagues still seem to be there.
compsciphd··on HandyMKV for MakeMKV and HandBrake Automation
I disagree. But to each their own, also depends how one watches it. a truehd atmos audio stream for a movie can be 3-4GB by itself. Of course, for many perhaps a TrueHD atmos audio stream is overkill, but for many its not.
compsciphd··on I built a 516-panel financial terminal in 3 weeks using AI
it's all about the bas
compsciphd··on I built a 516-panel financial terminal in 3 weeks using AI
as someone who worked at TR (now Refinitiv) and then Bloomberg, it's not even the data. it's IB. After IB it's the data. :)
Page 1 of 34Next →