Hacker News Reader

exikyuton Bluetooth keystroke-injection in Android, Linux, macOS and iOS

This doesn't mention Windows at all.

That sounds great on the surface, but it would be really helpful to understand why Windows is not actually at fault so I can better measure the risk profile.

For example, knowing that the Windows Bluetooth stack has the architectural equivalent of BlueZ's `ClassicBondedOnly=false` would be really helpful to know; that would tell me to keep an eye out for it being `true` in environments I'm trying to harden, for example.

Alternatively the stack might work entirely differently and the status quo might consist of a different set of considerations to keep in mind.

This is awesome and I'm looking forward to the PoCs and (pleeease) video with lots of demonstrations :)

But Windows has enough market share and enough sysadmins are going to be going "!!!...???" that some info would be helpful.

That info might be "I haven't attacked Windows yet". That would be good to know too :)

exikyuton Show HN: Play Othello in your web browser (made with Mithril)

I really liked this reply :D

I was probably already dealing with the quirky subtle delirium I get with onset head colds/flus when I wrote that yesterday (I'm now past it and at the sniffle stage lol). That's my excuse for the "u ok?" word salad there :P

Some clarifications following this feedback:

- ballmer peak: yep, pretty much - the latter interpretation is new to me

- liminality: the defocused focus referred to in the above, but specifically referring to the need to drink to make it work

- NP-hard: I was trying to make a joke about it being impossible to achieve the effects of the ballmer peak without drinking lol

exikyuton I bricked my Christmas lights

Tuya is so hilarious in this regard. The protocol is just TLS over TCP, but the app happily sprays your Wi-Fi password to every STA in the area every time you add a new device.

(It's how pairing is done - the app blindly broadcasts packets to 255.255.255.255 and the target device (lightbulb, power outlet, et al) just sits in promiscuous mode. The packet contents are protected by WPA2 et al, but the packet lengths aren't, so the protocol sends a bajillion tiny packets with each packet's length set to the ASCII byte value of the next character in the setup handshake. I believe it sends it multiple times in a row. This is why pairing takes 2 minutes then always abruptly stops before the counter reaches zero.)

\o/

exikyuton Show HN: Play Othello in your web browser (made with Mithril)

> React is what a young hacker would invent under heavy hallucinogens after a week of reading Advanced Haskell tutorials

That's precisely why it works: it presents an alternative to the liminality requirements of maintaining the Ballmer Peak (which is is too NP-hard to reproduce) by tapping into the underdeveloped PFCs in young developers everywhere and making them productive by psyop-hacking their sense of adventure into the pursuit of complexity.

It's honestly sad, but a nonetheless really interesting study in emergent psychological dynamics.

exikyuton Font Sizes from 4px to 99.9px

That web page was using Comic Sans MS, too, wasn't it

I can't understand why something would be published in that condition - and that it would be considered acceptable and signed off on and stuff :)

Or maybe the page owner never actually visited the website...

exikyuton Ask HN: Best resources on abstracting and dealing with complexity

PDF: copy-paste entire link into new tab or `base64 -d` encoded section

data:text/plain;base64,aHR0cHM6Ly96bGlicmFyeS50by9maWxlZG93bmxvYWQvZGVzaWduLXJ1bGVzLXZvbC0xLXRoZS1wb3dlci1vZi1tb2R1bGFyaXR5LTA

Not a converted EPUB, either. ^^

exikyuton LogoFAIL: Secure Boot bypass with manipulated boot logos

Thanks very much for this :)

exikyuton BSD on Windows: Things I wish I knew existed

I honestly wouldn't mind learning what these looked like! I wasn't really aware of the long tail of the scene back in the day.

exikyuton Patching around a C++ crash with a little bit of Lua

In trying to pin this down just for the sake of curiosity, the closest I can imagine is a feature phone passing some sort of of `Accept-Encoding: nih`... and that's unfortunately morbid-insanity-sniping me with even more questions.

I'm trying to figure out what profound excuse the client has for not using gzip et al; "feature phone land" definitely provides no shortage of possibilities (hence the morbid "oh no I must know").

That's a hallucinatory rabbithole I could get stuck staring down all day because it's too fun (welp hehe) and there's surely a simple explanation I'm missing :)

exikyuton LogoFAIL: Secure Boot bypass with manipulated boot logos

From https://www.boost.org/sgi/stl/StrictWeakOrdering.html:

> A Strict Weak Ordering is a Binary Predicate that compares two objects, returning true if the first precedes the second. This predicate must satisfy the standard mathematical definition of a strict weak ordering. The precise requirements are stated below, but what they roughly mean is that a Strict Weak Ordering has to behave the way that "less than" behaves: if a is less than b then b is not less than a, if a is less than b and b is less than c then a is less than c, and so on.

So if I take it correctly, std::sort will happily ticker-tape your array into the nearby dragon's lair if the sort callback doesn't return -1/0/1 correctly?

<Rueful mental note>

exikyuton LogoFAIL: Secure Boot bypass with manipulated boot logos

> This commit also adapts our jpeg fuzz test to work with the modified

> API. After limiting it to deal only with approximately screen sized

> inputs, it fuzzed for 25 hours CPU time without a single hang or

> crash. This is a notable improvement over running the test with our

> old decoder which crashes within a minute.

Cooool.

exikyuton Dogbolt Decompiler Explorer

His brain is relegated to spewing out the Matrix unparsed as he receives it. He gets none of the blondes, brunettes or redheads.

exikyuton The weirdest bug I've seen yet

How's that even supposed to work, given that the average corporate ecosystem is so vastly cloud-based now that the majority of services use desktop and mobile apps that pin HTTPS certificates?

exikyuton Why does the moon change size when you snipe it in GTA?

Been trying to load that website for the past 24 hours, it keeps timing out :(

exikyuton Three chips in and Google Tensor is on life support

As someone with a lot of interest in but no fluency with chip design, or the dividing and conquering of math within silicon, for that matter, how would you multiply a 1m² matrix?

exikyuton Why does the moon change size when you snipe it in GTA?

Oh no

I logged in

exikyuton Why does the moon change size when you snipe it in GTA?

OK let's make this interesting then, hopefully you can at least answer this: is there anything out there that might help someone intrepid enough to work out at least the general gist?

And where do they look? Game data? Obscure forum comments?

exikyuton TrasHTTPandas – Trash Panda HTTP Responses

This is super cute, but unfortunately it's currently both misconfigured and broken. Very easy fixes though.

Firstly, it's eyebrow-raisingly slow. A quick network check shows everything is capped at 100kbps download. For PNG images that translates to a hitch-y 2-3 second pause.

Secondly, the slowness is amplified to the point of "this needs fixing" by the total lack of caching. Everything pauses every time the image loads.

Thirdly,

  $ wget -O- https://httpraccoons.com/jpeg/100 | md5sum
  ...
  Length: 530755 (518K) [image/jpeg]
  ...
  9a7aa269111ca315277bbec79bfab5c1

  $ wget -O- https://httpraccoons.com/100 | md5sum
  ...
  Length: 530755 (518K) [image/png]
  ...
  9a7aa269111ca315277bbec79bfab5c1

It's changing the mimetype but serving the same image!

Critically, besides these issues, this is perfect and fit for purpose :)

exikyuton Greg Brockman quits OpenAI

Facepalm

It took a minute (and reading other comments) before that clicked :)

SHIFT key...

exikyuton Greg Brockman quits OpenAI

Getting "page not found". I don't think I have an account....

exikyuton What I learned getting acquired by Google

The vegan effort option.

exikyuton Show HN: Inshellisense – IDE style shell autocomplete

The fact that it's coming from Microsoft is even crazier, because obviously you know they had to go through clearance - and made it.

I half wonder if the author checked the name first, then started coding......

exikyuton The Cloud Computer

I got curious about the book mentioned, and found an EPUB:

data:text/plain;base64,aHR0cHM6Ly92ay5jb20vd2FsbC00ODQxMzg3Ml82NjAyNg==

exikyuton Meta is banning people from advertising after running ads for Python and Pandas

Confused Google

"medireview. Erroneous, computer-generated form of medieval."

Enlightened facepalm

exikyuton Show HN: Unity like game editor running in pure WASM

Just to contribute: yet another instance of "cool slideshow" on my (most definitely low end) laptop with integrated graphics.

Then tried it on my aging Mate 20 Pro (not too new, not tooo old), and it just seemed to get stuck at "Downloading runtime". Got a funny feeling my flaky 4G wasn't actually to blame, inspected the tab from my laptop (chrome://inspect) via USB, and was greeted with

  Uncaught (in promise) Error: Needs OES_texture_float_linear to function
      at M (worker-3ec07b2e.js:1:3338)
      at J (worker-3ec07b2e.js:1:3403)

It is what it is. It's a good philosophical question about whether it's worth coding up an error screen, since it's all just to tell people they can't play with the toy. Hehe.

exikyuton GNU/Linux Aviation HOWTO (2006)

I went on a bit of a rabbithole trying to look for firmware downloads for the G1000 to run `strings` on but sadly they're not publicly available anywhere.

But I'm very happy to be able to say that you don't need to be sad you didn't get a photo anymore because I found https://mooneyspace.com/topic/21333-g1000-pfd-start-up-error... :D

No amount of quote-googling got me any further though, which was why I went firmware hunting. Now at least I have a good conversation starter for anyone who looks like they might have a dealer account next time I'm at a hangar though...

exikyuton Tell HN: There is a highlights page on HN

There should be, and it should be under /changelog!

exikyuton GNU/Linux Aviation HOWTO (2006)

Ooo, what did it look like? A Mach kernel oops (aka "just start painting text from the top-left"), a BSOD (more structured), a dialog box over the top, or...?

Also what info was printed? An inscrutable Guru Meditation, a register dump, or...?

Just idly fascinated to figure out how much info would be dumped by a piece of avionics running in end-user production mode.

exikyuton enron :: discover the power of WHY (2001)

The (small) list of removed items is hilarious: http://www.enron-mail.com/email/removed

The other comments explaining that this is a restoration project make me wonder where this script came from. The archive of the original website?

There are more directories: http://www.enron-mail.com/email/

exikyuton LÖVE: a framework to make 2D games in Lua

(The JS runtime doesn't make it past the salt line while the WASM modules do, causing the the app runtime to fail to find critical exports and go into an infinite loop which persists after Chrome is closed because boot was managed by a service worker)