HNHacker News
TopNewBestAskShowJobs

cxcorp

297 karma · joined January 6, 2017

submissionscomments
cxcorp··on Incident Report: CVE-2024-YIKES
It's a reference to the SCP Wiki (https://scp-wiki.wikidot.com/)
cxcorp··on NPM install is stealing your passwords – I built a tool to catch it
How is it different from the established player in the game, Socket.dev?
cxcorp··on Lightning Detector Circuits
A camera! The 2.5mm TRS remote trigger jack just needs one of the pins connected to the sleeve to trigger the camera, very easy to do with an optocoupler or even relay.
cxcorp··on Show HN: Pretty-print your chess games using Prettier
I've always wanted to look into writing my own Prettier plugins, how'd you feel about getting started working with their little mini DSL (fill, join, hardline, line, etc.)?
cxcorp··on 1 bug, $50k in bounties, a Zendesk backdoor
This is very important to keep in mind when implementing OAuth authentication! Not every SSO provider is the same. Even if the SSO provider tells you that the user's email is X, they might not even have confirmed that email address! Don't trust it and confirm the email yourself!
cxcorp··on Sqlite-vec: Work-in-progress vector search SQLite extension that runs anywhere
I think Transformers.js can do that client-side, e.g. see the documentation for calculating embeddings with Sentence Transformers models: https://huggingface.co/docs/transformers.js/api/pipelines#mo...
cxcorp··on Decline Invitations
Yes, who's going to keep inviting someone who always declines?
cxcorp··on Ransomware attack affecting Tietoevry's services to some customers in Sweden
BleepingComputer's coverage[1] has this tidbit:

> BleepingComputer has been told that the Akira ransomware operation is behind the attack on Tietoevry, coming soon after the Finnish government warned about their ongoing attacks against companies in the country.

> "The incidents were particularly related to weakly secured Cisco VPN implementations or their unpatched vulnerabilities. Recovery is usually hard," warned the Finnish NCSC.

I wonder what the entrypoint was back in 2021 when they were attacked around the same time?

[1]: https://www.bleepingcomputer.com/news/security/tietoevry-ran...

cxcorp··on RAD Debugger
Thanks! Looks like this project has some high ambitions:

> What's after that?

>

> Tons of stuff. Tons and tons and tons of stuff.

> Debuggers have not substantially evolved since the first Turbo Debugger in 1988!

> For example, we have had GUI debuggers for 20 years now, and we can't see bitmaps! We can't hear sound buffers. We can't view vertex arrays.

> We can't graph values over time. We can't even load a debugging session from yesterday and review it! We have a long way to go.

> Debugging is desperate need of updating, and we see as a long term project. We'll be adding visualizers, new debugging workflows (step through code on multiple platforms at the same time for example), and new features for a long time.

cxcorp··on RAD Debugger
Anyone seeing any groundbreaking features or reasons to try this over x64dbg or other existing debuggers?
cxcorp··on Wasabi linked to "substantial" boost in memory, Japanese study finds
The article mentions that it's "usually white horseradish, dyed green", and that the real thing "can cost more per pound than even the choice tuna it sits on."

Would be interesting to verifiably taste real wasabi. Who knows, maybe I've never actually even tasted the real thing?

cxcorp··on Wasabi linked to "substantial" boost in memory, Japanese study finds
> A wasabi company, Kinjirushi Co., provided funding, though the researchers say the company had no role in the study itself.

I'm sure.

cxcorp··on ESP32 Wemos D1 Mini – Sprinkler Controller Open Source
I don't think there's a D1-ESP32 board? The D1 Mini is Wemos' ESP8266 board. They do have ESP32 boards with the same footprint, but those are not D1 Mini but S2 Mini, S3 Mini and C3 Mini, depending on whether it's ESP32-S2/-S3/-C3.
cxcorp··on WiFi without internet on a Southwest flight
The hidden SSID stops the users' WiFi list being full of random, password protected SSIDs when they just want to connect to the open portal WiFi.
cxcorp··on WiFi without internet on a Southwest flight
What if the captive portal just had a link (or on an IFE screen, a QR code) that connected your phone to a different, WPA2/WPA3 protected, hidden WiFi SSID that was generated exclusively for you? Phones nowadays support joining a passphrase protected WiFi AP via a QR code, so I'd imagine that's doable. The hard part would be finding routers that support >300 different hidden SSIDs, but honestly I would hope that that is technically feasible nowadays.

That way you'd at least have the protection of the WPA GTK.

cxcorp··on Nginx Unit – Universal web app server
> NGINX Unit – universal web app server – a lightweight and versatile open source server project that works as a reverse proxy, serves static assets, and runs applications in multiple languages.

https://github.com/nginx/unit

cxcorp··on Optimizing Postgres's autovacuum for high-churn tables
For the postgres config, set fsync=off and full_page_writes=false, and increase min_wal_size, max_wal_size and checkpoint interval with the hope that your tests pass before having to flush the WAL. Maybe slap in some tunings from PGTune.

If you're using docker/podman or docker-compose and your db size is small, a major speedup on linux is to just mount the entire data dir into memory with --tmpfs /var/lib/postgresql/data (or tmpfs: - /var/lib/postgresql/data in docker-compose)

Additionally, if you constantly reset your db in the tests, consider making a template db at the start and later just doing CREATE DATABASE ... TEMPLATE foo; to copy the pages from that template instead of running migrations that produce WAL log. In fact, consider making a db for every test suite from that template at the start - then you can run each suite in parallel (if your app's only state is the db and a single backend).

cxcorp··on The surprising impact of medium-size texts on PostgreSQL performance (2020)
It looks similar to the style you get from draw.io if you choose "Sketch" as the style for an object (add box -> "Style" from right sidebar -> Sketch).
cxcorp··on New in Chrome 115
I like that ScrollTimeline is coming, I hope to get rid of JS scroll listeners for good. Can't wait to use this in like 5 years when all browsers finally support it.
cxcorp··on Driver adventures for a 1999 webcam
Is..is it not the webcam that's reporting the endpoint? Not Linux?
cxcorp··on Node.js – v20.0.0
> V8 11.3

> The V8 engine is updated to version 11.3, which is part of Chromium 113. This version includes three new features to the JavaScript API:

> ...

> - Methods that change Array and TypedArray by copy

> ...

Excited to see these in. I've been waiting for the non-mutating versions of .sort() and .splice() and now they're finally here (.toSorted and toSpliced)!

> - Resizable ArrayBuffer and growable SharedArrayBuffer

Does this mean that WebAssembly memory can also now grow without making a copy of the entire buffer?

> The V8 update was a contribution by Michaël Zasso in #47251.

Well done Michaël!

cxcorp··on ESP32 Buyer’s Guide: Different Chips, Firmware, Sensors
I have one of the Wemos C3 pico boards which rely on the C3's native USB serial controller. The experience is pretty rough for quick iterations on a devboard on Windows.

You restart the board to programming mode by holding down the BOOT button down while pressing RESET. Wait a few seconds, then COM7 is available. You program the board, and then manually RESET the board with the button. COM7 disappears. Then you wait a few seconds, then COM6 appears. Oh, did you print some debug info on boot? Too bad, it takes a few seconds for the virtual serial port to appear in Windows so you just can't get input during that time because the reset resets the USB controller as well (the entire chip).

This is the benefit of on-board USB-UART chips: if you need to reset the chip, your USB controller doesn't need to be reset so your serial port stays open. Additionally, most ESP32 dev boards offer automatic reset by utilizing the DTR or RTS pins of the UART chip and a couple of transistors.

cxcorp··on AutoHotKey V2 (Breaking Upgrade)
Well, it is the second sentence on the page:

> AutoHotkey v2 aims to improve the usability and convenience of the language and command set by sacrificing backward compatibility. As such, scripts written for v1 generally will not work without changes on v2

cxcorp··on JBIG2 Undetectable Data Corruption: Destroying Our Past, One Character at a Time
There has been previous discussion about this issue with JBIG2:

https://news.ycombinator.com/item?id=6156238

https://news.ycombinator.com/item?id=29223815

cxcorp··on Original source of `(seed * 9301 and 49297) % 233280` random algorithm? (2014)
I usually save my bookmarks on the Wayback Machine just so there's at least one copy out there.
cxcorp··on U.S. Army Camouflage Improvement Explained (2013)
There's a system named ADAPTIV [1] which is essentially a bunch of tiles that can alter their temperature to make a tank look like a civilian car on the infrared band.

[1]: https://www.baesystems.com/en/feature/adativ-cloak-of-invisi...

cxcorp··on Permissive forwarding rule leads to unintentional exposure of containers (2021)
This is even worse than falsely binding to 127.0.0.1. If I don't publish a port in a container, I expect to *not publish any ports*.
cxcorp··on Plain text, with lines
Because standards compliant SVG introduces XSS surfaces.
cxcorp··on How Uber Uses Zig
Obscurity depends on how closely you're looking. In fluid dynamics (meteorology, atmospheric sciences) and other scientific fields, Fortran definitely sees widespread adoption.
cxcorp··on Render mathematical expressions in Markdown On GitHub
I really like how GitLab has implemented this. Using code blocks but just with "math" as the language is so much clearer, and avoids having to do awkward dollar sign escaping.
Page 1 of 3Next →