HNHacker News
TopNewBestAskShowJobs

eriknstr

1,862 karma · joined May 29, 2016

Dear HN, please delete this account.
submissionscomments
eriknstr··on Smartphones can be fooled by fake, digitally composed fingerprints
>It's important for people who are dissidents or engaging in criminal activity to be aware that their brain is more secure than their fingerprint, although that seems entirely obvious to anyone capable of maintaining a high security lifestyle.

The problem with the brain is that it forgets. For example if you have an important piece of information that you encrypt with a long passphrase, you will likely have no problem decrypting it if you do so every day but if you don't use the passphrase for a few months, you probably won't remember it. However you probably will remember where you have the passphrase if you write it down and put it somewhere secret where nobody will be able to both find it and to know what it's for. IOW, don't hide the paper in your house.

eriknstr··on Smartphones can be fooled by fake, digitally composed fingerprints
>You're still also only considering false negatives (user is erroneously rejected). You have no data points about false positives (user is erroneously allowed).

As far as I understood, the system is distinguishing between its members so we have some data about false positives because OP was always identified as themselves and never as another member.

eriknstr··on Get started making music
>I'm working on and off on an ear training app that randomly generates them that musicians can use to train their musical ear.

Sounds interesting. Please do a "Show HN" post when your app is ready for it.

eriknstr··on Uncensorable Wikipedia on IPFS
What he's saying is, IPFS will never be useful if it gets blocked before it has a chance to spread.

If IPFS is blocked and the people that need anti-censorship tools can't use it then they might as well not have bothered.

eriknstr··on Things to Use Instead of JSON Web Tokens
>JSON Web Token

Thanks, I didn't know what JWT meant. When I first read the title I thought it would be about the Google Web Toolkit (GWT) which I incorrectly remembered as being named Java Web Toolkit (JWT) because with GWT you use Java.

Author would do well to edit their post, changing the title to "Things to Use Instead of JSON Web Tokens" and replacing the first occurrence of "JWT" in the body text with "JSON Web Tokens (JWT)".

In addition to helping visitors from HN, this change could also improve the possibility for others to find the text in the future when they search for JSON Web Tokens using a search engine.

eriknstr··on Wikimedia Foundation spending
>Nothing can grow forever. Sooner or later, something is going to happen that causes the donations to decline instead of increase. It could be a scandal (real or perceived). It could be the WMF taking a political position that offends many donors. Or it could be a recession, leaving people with less money to give.

Does the Archive Team backup Wikipedia? Probably they do but if not I guess they should.

eriknstr··on Vue HN 2.0
Looks ok for the most part. Not going to use it myself.

For those that do use it, don't you find the jumping around of the news items distracting?

eriknstr··on Shape Catcher: Find Unicode characters by drawing them
Pretty neat. Would be useful to be able to restrict the blocks that are searched. For example I might know that the character I'm looking for is Japanese, so if I could let it know that I was looking for is Japanese then it could restrict itself to Katakana, Katakana Phonetic Extensions and other blocks if any that apply to Japanese specifically.
eriknstr··on My Struggles with Rust
Looking at it that way, I think it's possible to make "expect" more comfortable to read by how you phrase your error messages.

Instead of

    let mut file = File::open("conf.json")
        .expect("could not open file");
and

    let config: Value = serde::from_reader(file)
        .expect("config has invalid json");
and

    let jenkins_server = config.get("jenkins_server")
        .expect("jenkins_server key not in config")
        .as_str()
        .expect("jenkins_server key is not a string");
One could write

    let mut file = File::open("conf.json")
        .expect("Need to be able to open file `conf.json'.");
and

    let config: Value = serde::from_reader(file)
        .expect("The file `conf.json' must contain valid JSON.");
and

    let jenkins_server = config.get("jenkins_server")
        .expect("The config must have a key named `jenkins_server'.")
        .as_str()
        .expect("The config value of `jenkins_server' must be a string.");
Something like that.
eriknstr··on My Struggles with Rust
While it's too late to change the name "expect", could one create an alias for it and call it say, "on_error"?
eriknstr··on Python-GnuPG
Any time someone makes a choice, that is automatically the correct choice.

It never happens that someone makes a choice, like what license to use, because they are only familiar with a subset of all choices, or because they have been misinformed or have misunderstood something.

Right?

eriknstr··on Why does Google prepend while(1); to their JSON responses?
Someone had the same question as you in a comment.

>Wouldn't returning an object containing the array, instead of the array directly, also solve the problem?

And someone else replied

>No, that wouldn't solve the problem since the same attacks mentioned in the post could still be performed. Overriding the accessor methods to retrieve the info.

eriknstr··on Windows non-LAN, wormable RCE 0-day discovered
The statement "there are far fewer ways to attack a machine behind NAT with no user interaction" is true even though NAT on it's own is not designed to be a firewall.
eriknstr··on Python-GnuPG
For a library LGPL would be a better choice than GPL.
eriknstr··on How Scratch teaches kids to follow the hacker ethic
>He still spends quite a bit of time finding keys on the keyboard, so that'd be a major distraction and would break flow.

I don't have kids yet but I am wondering if perhaps letting your child use a keyboard that is without printed letters could help them learn to type better.

Back in 2010 me and a good friend of mine decided to buy a TypeMatrix 2030 USB keyboard each and to switch from QWERTY to Dvorak.

Now of course I am not suggesting you let your child learn Dvorak. Teaching them Dvorak would probably be doing them a disservice at such an early age because of the amount of QWERTY keyboards they are likely to come in contact with.

But I think you should try to let your child use QWERTY with a keyboard that does not have any letters printed on it.

We bought black skins with printed letters and black skins without printed letters. In the beginning I was using the skin with the printed letters and I had to look at the keyboard for each and every letter I was typing. While my initial plan had been to first learn to touch type Dvorak on the TypeMatrix and then put on the skin without printed letters, I soon decided to put on the skin even though I had no idea where each letter was, in order to force myself to learn to touch type sooner. And it worked! It was really painful for the first two or three days. For each letter I was typing I started with the top left key and went through the keys one by one until I got to the correct key and then I used the backspace key to remove all of the letters I had typed which was not the one I was looking for. It was extremely annoying but it worked exactly as I had hoped it would.

Over time I've somewhat "unlearned" QWERTY, and for the first few years I was even carrying my TypeMatrix in my backpack pretty much at all times and in doing so I found it hard to use other keyboards even if I switched the computer to Dvorak.

After one of my keyboards broke due to wear from carrying it with me, I bought a new one but I stopped carrying it with me and started using whatever keyboard is available in Dvorak mode. I use the TypeMatrix at home and I have another one that I use at the office when I work but when I'm elsewhere I use for example the keyboard on my ThinkPad. Many keyboards will have QWERTY printed on them but since I am so proficient at touch typing Dvorak now I'm pretty much not looking at the keyboard at all anyway so it does no harm.

Anyway, point is, not being able to "cheat" by looking at the keyboard turned out to be a highly effective way to learn to touch type 100%.

eriknstr··on The Rust Libs Blitz
The article also links the state of rust survey. I visited the survey with intent to answer it but the first question "Do you use Rust?" only has the following three alternatives for an answer:

- "Yes"

- "No, I stopped using Rust"

- "No, I've never used Rust"

When making a survey the alternatives for the answers are very important. I feel that none of these alternatives apply to me. That's bad. Unfortunate because I would have liked to participate in the survey.

I've done a little bit of beginner programming in Rust in order to try and learn the language. However I haven't yet used it to implement anything actually useful so I wouldn't say "yes, I use Rust". It's been a while since last I did something in Rust but I wouldn't say "no, I stopped using Rust" because to me that implies that I have decided that Rust is not for me, which is not something that I feel, I want to use it, I just keep pushing it down on the list of things to do because other more immediate desires and problems keep popping up.

eriknstr··on Sourcegraph now running on an in-browser VS Code
Thanks.
eriknstr··on Sourcegraph now running on an in-browser VS Code
Looking at a file from one of my repos, the syntax highlighting looks wonky.

https://sourcegraph.com/github.com/eriknstr/VoxelMode-2.5D/-...

Everything on every line after '#' on line 21 is the same save for backslashes and ":3" which are blue.

eriknstr··on Red Hat OpenShift.io – Free, end-to-end, cloud-native development
Why do I need to provide my e-mail and create a password when I choose to sign in with GitHub? First of all they were supposed to be able to retrieve the e-mail address from GitHub I think, like they did with name and company. Creating a password should not have been needed at all.
eriknstr··on Jeff Atwood on growing Discourse
I've been on HN for a long time (this is not my first account even) but I had completely forgotten about pagination on HN. Even when you talked about it I only get a vague feeling that I've seen it ever. Probably I have seen it but still it feels like the sort of memory that one has of something that didn't actually happen but which you have a "memory" of because someone told you it happened.

I guess I usually simply stop scrolling before I get to the very bottom of HN.

Just to be clear though, are we talking about a "next" link at the bottom of the page, or Reddit-style "continue" links for subtrees of comments beyond a certain depth?

eriknstr··on Disabling Intel AMT on Windows
I thought so too at first but I guess whereas the title now says "Completely Disable Intel AMT on Windows", it probably used to say something along the lines of "Completely Disable Intel ME on Windows".

Edit: The title has been changed again and now reads "Disabling Intel AMT on Windows". That's better and less confusing.

eriknstr··on Which is the best Twitter bot you have come across?
Clickable link: https://twitter.com/tiny_star_field

Neat bot. Twitter suggested a couple of related accounts which turned out to be cute as well.

@tiny_astro_naut - https://twitter.com/tiny_astro_naut

@tiny_mssn_ctrl - https://twitter.com/tiny_mssn_ctrl

eriknstr··on Show HN: Shortern URIs using Huffman Coding, not a database
Performance in terms of compression ratio or in terms of speed or in terms of both or in terms of something else like for example memory usage?

Is SMAZ encoded data URL safe?

eriknstr··on Which is the best Twitter bot you have come across?
Also relevant to you I think: Which are the most useful reddit bots?

Off the top of my head:

- /u/colorizebot

- /u/RemindMeBot

- /u/AutoMod (special because it's been made an official part of reddit)

eriknstr··on Kiwi – a 68k Homebrew Computer
It appears that the page won't load.

Here is the most recent snapshot from the IA Wayback Machine.

https://web.archive.org/web/20161028130628/https://www.ist-s...

eriknstr··on Hacker Leaks Episodes from Netflix Show and Threatens Other Networks
And in fact from the additional attention that Netflix has gotten from this leak I would expect that they get more new subscribers than they would have if the series wasn't leaked.
eriknstr··on A Large Self-Annotated Corpus for Sarcasm
What I mean is, it looks like the researchers only looked at whether or not the "/s" was intentionally placed at the end of the comment, not whether the comment was actually sarcastic or whether the person that wrote it understood that "/s" is meant to convey sarcasm.
eriknstr··on Forcing the password gropers through a smaller hole with OpenBSD's PF queues
https://securitytoday.com/articles/2017/03/03/top-5-countrie...

The United States is the #2 top source of cyber attacks, accounting for about 10% of all malicious traffic in the world and with 17.12% of cyber attacks initiated from there.

What you need to look at is how much of the traffic that hits your servers specifically is malicious relative to the amount of traffic that is bringing you revenue. Then you decide what countries to block.

eriknstr··on A Neural Parametric Singing Synthesizer
The mixed version sounds really good. Acapella it sounds robotic but the acapella is the exact same voice track that is used in the mix, right? Amazing.
eriknstr··on A Large Self-Annotated Corpus for Sarcasm
I've seen people add '/s' to their comment when what they wrote wasn't actually what I'd call sarcastic. Probably quite a few people have seen others use '/s' but they've inferred the wrong meaning of the label and then they use it incorrectly.

Seems from what was said above that this is something that has not been taken into account.

← PreviousPage 6 of 18Next →