Hacker News Reader

eloyon Restructuring a giant, ancient codebase to make LibreOffice work well everywhere

I'm quite surprised that the markup incompatibility with Microsoft Office is still an issue. Are they actively sabotaging the Open Document Foundation, or is it just really difficult to achieve?

eloyon Show HN: A site to look up DNS records

Looks very nice, but instead of sending ANY queries it should just send multiple queries for different RRs, because ANY is deprecated by Cloudflare (and probably more services)

eloyon Void Linux

Why did you choose Linux over OpenBSD? I'd choose pf over iptables, although nftables looks pretty neat.

eloyon OpenBSD 6.1 is not a CD release

> Sorry guys.

> Anyone want to buy some well-used CD burners?

CD burners that were used to burn OpenBSD CDs over the years? Well, that would be a nice collectors item :)

eloyon Ask HN: Best budget Linux laptop for a developer?

Yep, I have the highest spec CPU for the T60, the T7600 :)

I paid $15,- on Ebay for the CPU with free shipping.

eloyon Ask HN: Best budget Linux laptop for a developer?

I don't encounter any slowdown yet, it's 50% full. Maybe I will put a new SSD in this thing when I really need more storage for applications.

eloyon Ask HN: Best budget Linux laptop for a developer?

Ah yes! @OP, if you buy a second hand ThinkPad, buy a 'p' version (T43p, T60p). Those have the high-res UXGA screen, which has almost as much pixels as full HD, just another dimension. But watch out, there are different versions made of the P ThinkPads. Some have the UXGA screen, others the SXGA+ with 1400x1050 which you don't want.

eloyon Ask HN: Best budget Linux laptop for a developer?

> You may also look at X200 with LibreBoot. Quite a lot of places sell these.

Those are very expensive, OP stated that his budget is $300, those are almost $600. I don't know any company apart from Minifree that sells those.

eloyon Ask HN: Best budget Linux laptop for a developer?

I have a way cheaper machine myself that I still use everyday.

It's a T60 with upgraded CPU (T7600), second hand 60GB SATA II SSD, 3GB RAM (limited due to chipset bug), ExpressCard with USB 3.0 and a 9-cell battery which lasts for 1/2 hours.

I spend around $100 for this machine in total, only $25 for the T60 itself.

I'm not using this particular machine because the specs are so great, but because I found it on Ebay and it was painted yellow. It's such an awesome thing. It runs Debian with XFCE4 fine, but websites like Facebook in Firefox isn't that fast. For development purposes it's perfectly fine.

I'm thinking about upgrading this machine with a motherboard from a T60p with a FireGL GPU one day, but I have to research if that would work.

You could take the same route as I did, but if that's too much work I'd go for a X201 with SSD and 8GB RAM.

eloyon Tor blocked in Turkey as government cracks down on VPN use

Events like this is the reason I operate a few Tor Bridges. It gives uncensored internet to vulnerable people in countries that are (semi-)dictatorships.

The Streisand VPN includes a Tor Bridge by default, so if you ever have problems with an advanced firewall that blocks most VPN protocols, Streisand with Tor is your friend.

Tor Bridges are also a nice playground for modern cryptography, they are working on PQ Crypto: https://gitweb.torproject.org/user/isis/torspec.git/plain/pr...

eloyon GreatAgain.gov

How did Trump even got this domain before he was President-elect? .gov is limited for only the US government, nothing else. Before the elections, Trump was not part of the government. But the certificate dates from 1 November 2017.

eloyon Experiments with disabling the ME on Sandybridge x230

Oh wow, I didn't knew this. Will look into this, thanks.

eloyon Experiments with disabling the ME on Sandybridge x230

That's true. They don't officially support the Raspberry Pi because it needs proprietary drivers and thus breaks the "chain of trust" needed for flashing Libreboot.

It's a bit over-the-top paronoid to expect firmware modifying software in GPU drivers, but I understand their point.

eloyon Experiments with disabling the ME on Sandybridge x230

Agreed. But it has to rewritten, that takes some time and costs money. It's another barrier preventing Intel to chanige their mind about it. But in the end it would be open source if Intel changed their mind.

eloyon Experiments with disabling the ME on Sandybridge x230

I don't have any hope for other hardware. The only hope that I have is that Intel will change their mind and remove it, or make it fully open source.

The sad thing is that ME isn't even developed by Intel, but a third party. They sublicense it to Intel. So even if Intel would be willing to distribute the source, they couln't.

eloyon Experiments with disabling the ME on Sandybridge x230

It's a shame that ME can't be removed or disabled on modern Intel CPU's. Same goes for AMD and maybe companies that implement something like ME in ARM. OpenSPARC is quite dead, sadly enough.

Highly recommended read about x86 security: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

The author of this paper is also the developer of Qubes OS. They recently added another requirement to laptops who are 'Qubes certified': they must run Coreboot. It's not Libreboot yet, but that is a huge leap forward for x86 security. Hopefully this will trigger vendors to make their hardware Coreboot compatibile. It won't do anything about Intel ME, but it is a step in the right direction.

I ordered a Thinkpad x200 to flash it with Libreboot last week, just to have at least one device without any malware (in RMS sense)

eloyon Ask HN: Where do you go for civil discussion on the Internet?

I'd say Reddit. There are some heavy moderated subreddits for insightful discussions, like reddit.com/r/truereddit. Because Reddit has a voting system like HN, quality content is being upvoted and shown as first.

If you search you can probably find some more subreddits with less general content. And HN is of course a really great website for such discussions, with a lot of highly intelligent people that post quite lenghty comments. HN is probably my favorite website when it comes to discussions.

eloyon The DNS-Based Authentication of Named Entities (DANE) TLS Protocol

rant about DANE from tptacek incoming

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

I don't have a strong opinion on DNSSEC myself, but I agree with him that DANE is a bad replacement for standard TLS connections. DNSSEC is by far not the best security protocol ever designed, but it can protect to some threats, like cache poisoning.

eloyon Linux is 25 today

NO! It is GNU/Lin.. oh wait...

Congrats Torvalds, thanks for changing the world!

eloyon Satellites auto detect buildings in OpenStreetMap

I've drawn a few houses on OSM a few years ago. Great to see projects like this that are automating this process!

eloyon On the fly SSL registration and renewal inside Nginx with Let's Encrypt

Please, please stop using the name "SSL" and use "TLS".

As others replied, x509 would be even more correct, but SSL is completely incorrect, because that protocol is insecure and shouldn't be used. Using SSL suggest that the software supports that protocol, although it doesn't (as it should)

eloyon How I verify data breaches

That was an awesome insight, thanks. I guess that fakers in the future will leave out Mailinator addresses... But that leaves still plenty of room for the other methods.

eloyon Inside Palantir

If I had to make a choice to contact the author, I would go for Signal. You can make a lot less cryptographic mistakes by using it, and it doesn't backup all the conversations to Google Drive like WhatsApp or store them in the cloud like Telegram.

eloyon iOS Supporting IPv6-Only Networks

It's less ugly than Dual Stack. Just one address per device, nothing more. This should be the long term goal too.

eloyon iOS Supporting IPv6-Only Networks

> DNSSEC would only matter to the end client (the iPhone in this case) if it actually verified DNSSEC responses on the client, but it doesn't.

If you tunnel the DNS resposes over a TLS connection, then it would be secure. This has been specified in an RFC recently.

And about XLAT464: Apple could've just added that to iOS, instead of this. Google did the same a few years ago. If all the vendors would apply the same transition mechanism, that would make it a lot more easier for carries to deploy IPv6.

eloyon iOS Supporting IPv6-Only Networks

Hmm, good point. I guess that most of the apps that use BSD/Unix sockets are libraries then.

eloyon iOS Supporting IPv6-Only Networks

Out of curiosity, why would anyone use Unix or BSD sockets on iOS if Apple provides way better APIs?

eloyon iOS Supporting IPv6-Only Networks

The negative thing about this is that they don't use a XLAT464 resolver. With DNS64, they break DNSSEC. Android has an built-in XLAT464 resolver since version 4.1 IIRC. So a carrier can't choose for this as long as there is a vendor (Apple) that don't support it.

T-Mobile in the USA is currently using such a network, which is the best transition method in my opinion.

eloyon Diffie and Hellman Win Turing Award

Martin Hellman actually has a PhD, and their work together resulted in a Turing Award.

eloyon The Most Dangerous Writing App

I read the most dangerous App Writing... so I tried making a basic Javascript app to see what would happening... Now I read it again I see why everything disappeared...