Hacker News Reader

dmartoon Crates.io phishing attempt

And now the phishing page is advertising data for sale:

> crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<)

So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.

dmartoon Crates.io phishing attempt

Heh, the phishing page now redirects to a rickroll.

dmartoon TCP connection timeout mystery

Here is the author's latest update and the revelation of the mystery:

https://devnonsense.com/posts/asymmetric-routing-around-the-...

dmartoon Backdoor in upstream xz/liblzma leading to SSH server compromise

Vendoring is nice, and I usually prefer it, but you don't always have the time or people for it.

Vendoring + custom build system (Bazel?) for everything is basically googles approach, if what I have read is correct. Definitely better than everything we have, but the resources for it are not something most can afford.

P.S also what mrcus said, if we trust the upstream build process, we may as well trust their binaries.

dmartoon EEG channels with low-cost PiEEG device

With an active electrode, it should be good enough. After all, we are talking about hobby-grade results.

The Olimex ones are 10-bit (supporting both active and passive electrodes), while it's claimed[0] that 12-bit resolution is sufficient for EEG.

However, it's worth noting that there are obvious advantages to the higher resolution.

[0] https://www.biosemi.com/faq/24bitsystem.htm

dmartoon EEG channels with low-cost PiEEG device

There is also the OpenEEG project[0], the boards are way cheaper (sub 100eur[1]) and also they are both open source and open hardware.

[0] - https://openeeg.sourceforge.net/doc/index.html

[1] - https://www.olimex.com/Products/EEG/OpenEEG/

dmartoon Backdoor in upstream xz/liblzma leading to SSH server compromise

You have perfectly put into words, all my thoughts.

I have been thinking about ways to secure myself, as it is exhausting to think about it every time there is an update or some new dependency.

After this attack, I think the only sure way is to unplug the computer and go buy goats.

The next best thing? Probably ephemeral VMs or some Codespaces/"Cloud Dev Env thingy". (except neither would save me in the xz case)

dmartoon Backdoor in upstream xz/liblzma leading to SSH server compromise

Kinda relevant, as I saw few comments about how safer languages are the solution.

Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1].

[0] - https://github.com/c-skills/rust1

[1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...

dmartoon 10 Years EDIS Raspberry Pi Colocation (and Chocolate)

> One single RPi was sent back to his owner in California (was some kind of a limited edition, valuable first batch device).

By the magic of HN, there is not a small chance that person is here and can tell the story of this RPi.

dmartoon Finding the Last Editor

> One that isn't tied to a specific platform, or preferably even a specific company, and that I trust will still be around until I'm done programming.

That is Geany[0]: no opinions, no company affiliations, no editor wars. It has been around forever, works on everything, and is open-source.

[0] https://geany.org/

dmartoon Updating Gov.uk’s crown

Got curious, turns out their WordPress theme adds a wild

  <link rel="shortcut icon" href="https://insidegovuk.blog.gov.uk/wp-content/themes/gds-blogs/favicon.ico">

at (or near) the bottom, and that is the old favicon.

dmartoon Why are shopping carts always broken?

I do the same, but for a different reason. In my mind, they are less accessible, as the end of the line usually has metal guardrails, thus leaving the closer and easier-to-reach carts for other people.

On the other hand, in my area, I have never seen a broken cart, perhaps because they require coins to operate.

dmartoon 37signals first ONCE product: Campfire

The 'globe icon' feature could be useful for channel names (et al.) in multinational companies where English is not the native language.

Even if most of the communication occurs in English, names and titles are often in the local languages.

Not sure if it was intended for such cases or just for i18n.

dmartoon My Wild Experience Interviewing with Real Engineers – Ludicity

I may be on a bit of a tangent here, but the "bar is below the floor" effect (if I can call it that) is often the result of continued experience in multiple (so-called Tier I, in the author's version of it) companies. It leads to stagnation and a lack of concern for the product or result of their work. In other words, if they pay me, and they don't care about the work, why should I?

Such environments can demotivate and sap the joy from most mental work. I guess this is one of the reasons the author is committed only to part-time work. To paraphrase him - this is how he stays sane.

dmartoon Naming things needn't be hard

Also some backstory from the author - https://paulrobertlloyd.com/2023/272/a1/classnames/

dmartoon Ask HN: Why don't we cover parking lots with solar?

Cost. The price increase is 50% to a 100% more then conventional. [0]

Some countries, like France, have passed legislation to make sure large parking lots have at least 50% of their lot covered in solar canopies. [1]

Other studies are trying to convince stores and owners of such places, that the investment is worth it and can possibly even take them of the grid.

[0] https://digitalcommons.mtu.edu/cgi/viewcontent.cgi?article=1...

[1] https://www.forbes.com/sites/carltonreid/2022/11/09/solar-pa...