HNHacker News
TopNewBestAskShowJobs

devit

4,235 karma · joined September 10, 2015

submissionscomments
devit··on RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems
One of these:

1. Using a proper programming language that doesn't allow you to setup arbitrary functions as signal handlers (since that's obviously unsafe on common libcs...) - e.g. you can't do that in safe Rust, or Java, etc.

2. Using a well-implemented libc that doesn't cause memory corruption when calling async-signal-unsafe functions but only deadlocks (this is very easy to achieve by treating code running in signals as a separate thread for thread-local storage access purposes), and preferably also doesn't deadlock (this requires no global mutexes, or the ability to resume interrupted code holding a mutex)

3. Thinking when changing and accepting code, not like the people who committed and accepted [1] which just arbitrarily removes an #ifdef with no justification

4. Using simple well-engineered software written by good programmers instead of OpenSSH

devit··on Using SIMD for Parallel Processing in Rust
Are you really writing them?

Seems written by an LLM for the most part.

devit··on Google Sheets ported its calculation worker from JavaScript to WasmGC
How about writing it properly in an efficient language that doesn't use a GC? (i.e. Rust or something equivalent)
devit··on Starlink Mini brings space internet to backpackers
BTW, their specs says it wants minimum 100W USB PD, so you'll actually need a different battery that can do that which is probably going to be heavier (the NB20000 tops out at 45W), assuming that's accurate.

The 630g Anker 737 PowerCore 24K might be a good option, and also the 765g HyperJuice 245W.

So this adds 0.3-0.45kg to the estimate.

devit··on Starlink Mini brings space internet to backpackers
But if you are driving (and thus can haul unlimited weight including huge solar panels, batteries and inverters) it seems like the existing Starlink dish would be fine, and this looks like might be worse since it doesn't have automatic orientation.
devit··on Starlink Mini brings space internet to backpackers
It will be very niche because most people who spend time in nature seem to be either:

- Car campers, vanlifers or people living in a place permanently, which can just use the heavy Starlink version or go where there is LTE coverage

- Thru-hikers who hike every waking hour and want to be as light as possible and for which this system isn't even remotely light enough

- Casual weekend hikers for which it's going to be too expensive and also unnecessary since they'll have Internet access on Monday again.

It's only really a consideration for those who regularly go on multiweek trips or live long-term in the wilderness and move camp on a weekly/monthly frequency (rather than daily or never), and these people seem to be relatively rare.

devit··on Starlink Mini brings space internet to backpackers
I mean ideally (for Internet access purposes) one would have worldwide LTE coverage via cell towers and just use smartphones; the Starlink system is an alternative to that, so it makes sense to compare it.

From an individual perspective, if you want Internet access and don't have to be in a specific place, the current alternative to Starlink is to simply limit your wilderness living to places with or near areas of cell phone coverage (which potentially results in tradeoffs, of course).

devit··on Starlink Mini brings space internet to backpackers
Compared to being in LTE coverage and only needing a smartphone with 2-3W power draw (around 10% of the Starlink Mini).
devit··on Starlink Mini brings space internet to backpackers
So basically, you can carry:

- FlexSolar 40W panel: 1.35kg

- Nitecore NB20000 ~75Wh battery: 300g

- Starlink Mini: 1.1kg

- Smartphone: 250g

For 3kg you have something that should give 2-3 hours of Internet usage on an average EU/USA good weather day (assuming 20% solar panel for 10 hours = 80Wh/day, 25-35W power usage of Starlink Mini + smartphone).

For each extra 1.65kg you get an additional 2-3 hours, resulting in 7.95kg for 8-12 hours, 11.25kg for 12-16 hours.

Not bad, but not good either.

devit··on How to test without mocking
Testing both your code and the message system is exactly what you want, since if the message system is broken in a way that upstream didn't catch, you want to learn about it during testing and not production, if possible.
devit··on First look at the upcoming Starlink Mini
Is there a way to make a Starlink dish that is viable for backpacking (i.e. 5kg at most, but preferably 0.5-2kg, including the solar panel and battery needed to power it) or is the satellite LTE service the only possibility?
devit··on Whiteboard interviews are a test of obedience, not intelligence
They are a test for people who are very strongly identified with being highly intelligent/skilled where their definition of "intelligence/skill" includes solving programming and computer science problems (and have the capability to achieve a good level).

If that's your identity, then not being able to solve hard Leetcode problems (which, to my knowledge, are not even actually hard, since they seem to be easier than the problems in actual top competitions like the IOI, ICPC, etc.) is completely unacceptable and thus you will study and practice relentlessly until you manage (if you can); conversely, if that's not your identity, it's probably going to be hard to find the motivation to do so.

devit··on How to copy a file from a 30-year-old laptop
Seems far easier to figure out the hard drive connector and find software that can read the filesystem.
devit··on After 6 years, I'm over GraphQL
No, I mean of whitelist of full GraphQL queries with string/number arguments, where you can only run one of the queries in the whitelist, and the client can only choose which query and the string/number values, but not submit an arbitrary query string.
devit··on After 6 years, I'm over GraphQL
I think the only reasonable way to use GraphQL on a freely accessible server is to only allow a set of whitelisted queries, ideally automatically extracted from the frontend codebase, stored on the server and invoked by id and arguments.

This essentially turns GraphQL into a DSL for implementing REST endpoints, which is still a useful thing since it allows to write the REST endpoint with only knowledge of the GraphQL API rather than knowledge of the whole backend architecture, which is generally useful if the backend and frontend are written by different people or teams.

That's the way Facebook uses it on their main website: they pass the query id in the "doc_id" form field, the arguement in the "variables" field, the server gets the actual GraphQL query based on the doc_id from some sort of internal dictionary and AFAIK no GraphQL query string ever goes on the wire in production.

devit··on DuckDuckGo was down
They probably start with Bing results and do custom filtering, ranking and presentation, so without the initial Bing results they can't do anything.
devit··on SpaceX's most-flown reusable rocket will go for its 20th launch tonight
It seems the problem in the ULA analysis is that it assumes that the cost of the reusable parts, saved by reuse, is only 30% of the total launch cost.

But Falcon 9 seems to cost $40-60 million and carries 200 tons of RP-1 which seems to cost $200-500k, and all other costs should either be small or removable by automation, so the reusable part is actually up to 98-99%, not 30%.

Of course if you just flush boatloads of money down the drain for each launch for no reason, reusing the booster doesn't change much.

Also in general that sort of mathematical modelling is usually worse than useless since the output is usually a straightforward function of the assumptions and the model just makes bullshit assumptions seem more legitimate.

devit··on Lions OS: secure – fast – adaptable
All circumstances where correctness and security are more important than maximum possible performance, once it's mature enough (which will probably never happen), since it provides a proper and secure architecture.
devit··on Running DOS Apps on Windows from 1.0 to 95 (2020)
https://forum.osdev.org/viewtopic.php?t=56727&p=345558

Presumably and perhaps more compatibly can also call the DOS function with interrupts disabled but with an interrupt line active (e.g. a timer) and handle it.

devit··on U.S. imposes first-ever national drinking water limits on PFAS
Weight gain/loss depends on calories, so you can eat anything to either gain or lose weight as long as it's the proper quantity (although if you want to gain muscle then you also need enough proteins).
devit··on Antimatter Propulsion [pdf]
The 1T$/mg figure also is only based on electricity costs, since energy efficiency of antimatter is currently 0.4*10^-9 according to the paper.
devit··on U.S. sues Apple, accusing it of maintaining an iPhone monopoly
It's pretty simple: "it's my phone, I do what I want with it, just like my house or car".

Which includes "go to any website and run any app I can download from it, regardless of whether it's illegal or against any rules or against the interests of the phone maker" and "change any aspect of functionality that I don't like (e.g. apps being able to show ads) and that I can find out on the web how to change".

It doesn't include "Google or Apple make rules about what I can do with my phone that I can't override".

devit··on U.S. sues Apple, accusing it of maintaining an iPhone monopoly
Anyone can buy a laser printer, print any book, sell it, take 100% profits, and anyone can buy and read it.

But you can't do that with a mobile app because only Android users can use it, while anyone with an iPhone can't use the app unless you submit to Apple's rules.

devit··on U.S. sues Apple, accusing it of maintaining an iPhone monopoly
This is a really bizarre viewpoint.

In my view, my phone is MY DEVICE. It is most definitely not "Google/Apple's platform"!

Google is merely manufacturing my phone, and I intend Google to have no rights or control whatsoever regarding my phone, and merely have the obligation (not right, obligation) to manufacture it correctly and provide open-source software for it that works correctly and properly provides Android interfaces (obviously, I don't use an Apple phone since Apple doesn't offer that, while Google does since they provide devices with unlocked bootloaders that run open-source OSes).

It only runs Android because Google with Android happened to win the adoption lottery and it would run PodunkOS by ACME if PodunkOS by ACME had been the one that managed to gain critical mass.

Again it is absolutely not even remotely close to "Google/Apple's platform", and I have no intention for Google to interfere in my use of it and certainly not interfere in any relations I might have with people providing software for my phone like taking a cut of the transaction or deciding how that software should behave.

devit··on Shattered Pixel Dungeon is an open-source traditional roguelike dungeon crawler
With the exception of NetHack, which is famous for it, current roguelikes generally don't end the run for stupid shit (e.g. instead of killing you if you accidentally step into lava, they just don't let you do it), but more for wrong strategy or tactics.
devit··on Rive Renderer for real-time vector graphics is now open source
This problem seems to create a continuous stream of software attempting to solve it with no definitive solution.

It's kind of strange, because there is a single objectively correct rendering for any vector graphics scene given a pixel sampling function and colorspace metric (the one where each output pixel's value is the closest representable color to the convolution of that function with the scene, expressed as a function from R^2 to R and a linear color scheme respectively), and it seems like it would be achievable with GPU compute and some care with error bounds on either curve tessellation or numerical computation of the exact symbolic integrals of curves.

And it also seems easy to make such a solution have a tunable level of approximation to have faster rendering.

devit··on Stability.ai – Introducing Stable Video 3D
What's the best that can be achieved with this method?
devit··on Gaining kernel code execution on an MTE-enabled Pixel 8
One of the main goals of GrapheneOS is to release security updates as soon as possible, so if it's patched upstream GrapheneOS almost surely includes the patch.

Sometimes they even adopt pre-release AOSP security patch levels or backport security fixes from unreleased AOSP or kernel sources.

devit··on Cranelift code generation comes to Rust
Presumably the LLVM and Cranelift backends in the same rustc version generate code with the same ABI, and it would be a bug if that wasn't the case.
devit··on Why are there suddenly so many car washes?
According to several sources, car washes seem highly likely to damage the car, and are also usually unnecessary (the car works fine even if dirty, unless visibility is seriously impaired, and eventually it rains and the rain automatically washes the car if you park it outside).

Probably a lot of people are conditioned that they need to have a clean car.

← PreviousPage 5 of 34Next →