Hacker News Reader

evhon T-Mobile employees across the country receive cash offers to illegally swap SIMs

Lazier than you think! You almost nerdsniped me into seeing how fast I could whip up a crawler but then I checked the search and found out it can find comments and use a custom date range.

https://hn.algolia.com/?dateEnd=1700092800&dateRange=custom&...

evhon T-Mobile employees across the country receive cash offers to illegally swap SIMs

https://news.ycombinator.com/item?id=36336256

This one seems to fit. Happy I've never had reason to write one like it.

evhon Linux Text Manipulation

    awk '{ k = $1; sub("^[^ ]* *", "", $0); d[k] = $0; } END { print d["Title"], "by", d["Artist"]; }'

Personally I'm a bit of a sed fan

    sed -nE '/^Artist/{N;s/^Artist +(.*)\nTitle +(.*)/\2 by \1/p;}'

evhon How ‘open’ should your open source be?

Ctrl-F free - Phrase not found

What a coincidence.

I'm not a card carrying FSF member but that seems like a deliberate omission from the admittedly brief history. However also fairly off-topic as criticisms go.

A maintainer willing to reject contributions is a good sign to me - BDFL with a vision prevents mission creep and associated ills. The right to fork alleviates most of the negatives.

evhon Brave New Trusted Boot World

> the windows partition was using hardware-bitlocker

That sounds way too exciting, even without that involved I keep my Windows install on its own disk.

evhon Brave New Trusted Boot World

> I personally use a boot-stub based booting method with my own SB keys

Same here - stub, kernel, initrd and embedded cmdline all in a signed UKI on the ESP. I do encrypt my root however, so I wouldn't go as far as "painless" for the grub->efibootmgr switch (but I also switched initramfs generator so... always keep a rescue stick around).

But it's all about ownership and trust. I control the keys - hence I am the owner of my computer - and I don't trust e.g. Microsoft[1] to not eventually try to fuck me over. But that's not the important part.

> Also, I don't understand where remote attestation entered the conversation here, and I also don't see why that can't be a community based thing (al la let's encrypt is now everyone's CA) where you can choose your providers or even roll it yourself.

Remote attestation is mentioned five times in TFA and is where this can get really pernicious - indirectly limiting user choice because $safety_critical_industry (e.g. banking) only allows "the corporate keys" (likely including a few Linuxes too, but something like Gentoo couldn't be). They'll even have very good and completely valid security reasons for not allowing arbitrary user keys, but they'd lock me down to approved choices remotely. A reverse AGPL if you will.

Of course, workarounds will exist: "just multiboot", "just use multiple devices", "just choose the bank that allows you to whitelist your key" (assuming there is one, it's nice to dream) - but user freedom is reduced without malicious intent being strictly necessary anywhere in the process.

That's focusing on the negatives with my paranoiac hat on, of course.

[1] https://www.theregister.com/2022/07/07/lennart_poettering_re...

evhon Brave New Trusted Boot World

Now that's the most ominous title I've read all year, and it's a piece in favor of it? Maybe I've just read too many dystopian novels, but come on.

I'm all in favor of secure boot as long as I can enroll my own keys, but remote attestation gets scary quickly.

evhon The cult of dd (2017)

> Another reason to prefer the cat variant is that it lets you actually string together a normal shell pipeline.

That's just as easy with dd, decompress|dd is especially useful:

xzcat linux.img.xz | dd of=/dev/sdb bs=1M

Throw pv in there if you want to.

> here are two ways to create a 100 MB file containing all zeroes

And here's a better way: truncate -s 100m zero.img

evhon JPEG of Shakespeare is also a zip file containing his complete works (2018)

For more X is also a Y-style fun, check out PoC||GTFO - "This PDF is also an MBR boot sector" is just the beginning.

evhon OpenBSD 7.2

> I've read that the PCEngines struggles to keep up with network traffic in excess of 100Mb/s.

For reference, quick iperf3 TCP tests on my APU2 (cpu[0123]: AMD GX-412TC SOC, 998.27 MHz; em[0123] at pci[1234] dev 0 function 0 "Intel I211" rev 0x03):

LAN host <-> APU: ~410 Mbps

LAN host <-> APU (over WireGuard): ~140 Mbps

However, I've put em[123] together as a veb(4) switch without pf involvement and two LAN hosts will get almost the full gigabit between them over that. Would need something bigger if I had a faster uplink or more complex LAN requirements.

evhon Using the same Arch Linux installation for a decade

A large part of it is just that it's "home" after finding it at the right time in my skill curve - probably could've been Arch as well.

The Arch wiki might be a bit better and we all benefit from it to some extent, the Gentoo wiki is also good and honestly I don't use either that much anymore.

The great differentiator is portage. I never run into "maintainer built the package without xyz support" - sometimes I'll run into "stupid user disabled xyz support when installing" but that's just a config change and easier to accept since I'm the stupid user. In theory they might've missed adding a USE flag for that feature and I'd have to overlay my own ebuild or live without it. Custom source patching is built in and package versions can be (un)blocked via package.mask/.accept_keywords. Version 4.3 broke something? package.mask: =pkg-category/pkgname-4.3 to downgrade to 4.2 and still automatically get 4.4 when that shows up. Mask >=4.3 instead and nothing will change (but eventually dependencies might force you to fix it, of course).

Compilation is pretty fast on a modern computer. Significantly slower than binary packages sure but it's mostly with browsers and maybe qemu/compilers that you really feel it (and several of those do have binary packages, e.g. www-client/firefox-bin, dev-lang/rust-bin). On my old laptop this turned into an excuse to experiment with distcc and nfs for speedups (Core2Duo with 4GiB RAM is a bit weak for encrypted ZFS + compiling gcc, and also it's fun).

Compilation times is still the strongest con but having compilation as a first-class citizen is what enables most of it and the big stuff you just run in the background.

(For the unaware, do note that "compiling myself" means "emerge pkgname" or "emerge -auvDNU @world" and includes dependency tracking, not "./configure && make" and manually hunting things down.)

evhon Using the same Arch Linux installation for a decade

s/Arch/Gentoo/

I did run Arch for a while around 2010 but it didn't take. It's nice to find a permanent home - I've been on Gentoo since 2013 and an acquaintance has been on Slackware since the 90s.

Those three seems to be where us tinkerers end up.

evhon Using the same Arch Linux installation for a decade

> blatant user hostile elitism

...and that's a feature. There's nothing wrong with Arch doing its thing, there's always Debian/Ubuntu/Fedora/Manjaro/whatever - and Gentoo for those with taste.

evhon Practical bruteforce of military grade AES-1024 (2021) [video]

Those who want to try it for themselves can check out https://cryptopals.com/sets/2/challenges/12 (and that entire set).

evhon OpenBSD 7.1

Yeah wlan is by far the weakest point of OpenBSD networking - especially as an AP. Slipped my mind completely actually. The way most do it is to have separate APs.

Still, you can check https://man.openbsd.org/pci.4#Wireless_network_interfaces to get a general idea. Unfortunately only a few support host AP mode (last I checked).

evhon OpenBSD 7.1

Setting up an OpenBSD router is almost trivial - it's all there in the base system. dhcpd, unbound, net.inet.ip.forwarding=1 and a forwarding rule in pf.conf and you're good to go. Then the tinkering starts, of course (even wireguard's available in base). Do run a few benchmarks - my APU2 can't really live up to gbit IP throughput (iperf3 speeds were about 500 Mbps, no performance tuning ). Luckily the veb(4) software switching does reach 1 Gbps locally and my uplink is only 100/100.

Would recommend it, very nice to work with.

evhon An argument for a return to Web 1.0

I think most of us do get that.

However I also believe that's only because they haven't considered the potential impact of constant surveillance from everything you own sent to third parties who will keep the data forever.

...or maybe they just trust faceless strangers more than I do.

evhon Ask HN: Why is everything changing too fast?

Discord certainly works, but when I see a chat box lag on an i7 8700k with 32GB of memory I die a little inside.

And that happens occasionally with Discord, without running make -j42.

evhon Quake 1 gets its first major co-op content update in 25 years

I believe so, there was talk about putting servers in Guam for that reason a while ago around regular QW.

evhon Quake 1 gets its first major co-op content update in 25 years

I would try to compile

- QuakeSpasm-Spiked, modified QuakeSpasm with framerate-independent physics and other improvements: https://triptohell.info/moodles/qss/

- FTE QW, will let you play singleplayer, multiplayer, and I think even Quake II (and III?): https://fte.triptohell.info/

- QuakeSpasm (sibling comment has a link)

If all else fails, I know some QW guys are playing on M1 using ezquake. That's really a multiplayer engine and I wouldn't recommend it for SP but it could do if you're desperate.

evhon How to Learn Nix

>I think for many developers with Linux experience, probably getting a reasonable NixOS desktop setup is straightforward.

I took this as an excuse to try NixOS myself and an opportunity to provide anecdata.

Previous Linux experience: Lots, including about 7 years of Gentoo use, some Arch and the usual distro hopping before that. Mostly on laptops (not counting VMs). Lately it's mostly been the BSDs so I'm a little lost.

It took me about 45 minutes from searching for their site to have a working XFCE install using their minimal install ISO with VirtualBox. Certainly a different experience, but with their install guide and searching "nixos xfce" you'll get it done.

Promptly rebooted and went for an encrypted ZFS root - less straightforward but after a few PEBKAC snags I got it up in an hour or two.

My immediate impression is that this is great but not being allowed to just

    # which zsh >> /etc/shells

rubbed me the wrong way. Definitely something I'll consider using in the future, seems like a good fit for i.e. a VPS you might want to move easily.

Naturally I haven't learned the config language fully, but it seems easy enough if the docs aren't terrible.

evhon OpenMW: Open-source reimplementation of TES3 Morrowind

There's also a fork with multiplayer support (to an extent): https://github.com/TES3MP/openmw-tes3mp

OpenMW is great, played it a lot a couple of years ago. I love when games get future-proofed like this. See also the various Quake and DOOM source ports, although those started from id Software releasing their engines under the GPL so had an easier start.

evhon OpenBSD 7.0

Lots (just some? most? I haven't really used it much) of FreeBSD system utilities are using libxo for output, so you can use e.g.

    ps --libxo json

and get json output, or xml/html

evhon Microsoft admits to signing rootkit malware in supply-chain fiasco

> That is nonsense, otherwise the driver would have to be loaded at boot time, which in turn would mean installing a game would need a reboot which just isn't the case these days.

Riot Games' anti-cheat Vanguard (for LoL and Valorant) loads early during boot, requires a reboot after installing and if I recall correctly they now allow unloading it (because who wants to do banking with a rootkit loaded) but then require a reboot before playing again.

evhon Microsoft admits to signing rootkit malware in supply-chain fiasco

Valve is working on using ML for anti-cheat but it's still quite a way from being ready.

https://win.gg/news/8115/is-ai-the-future-of-csgo's-anti-che...

evhon Request for comments regarding topics to be discussed at Dark Patterns workshop

I get this on docker.com without my script blocker.

Essential only -> Processing please wait (but you can cancel)

Customize -> Trying to trick me into allowing more, then processing as above

Accept -> Instant success

Took some screenshots since this is ridiculous (I may just not be used to the modern web since I aggressively block scripts): https://imgur.com/a/fJB0aHz

My favorite part is having to pull a bar up to decrease my consent-level.

evhon What changed in OpenSSL after heartbleed

> though I think there is a YouTube video somewhere

"LibreSSL with Bob Beck" at https://www.youtube.com/watch?v=GnBbhXBDmwU