Hacker News Reader

feelin_googleyon Facebook denies 'listening' to conversations

It is interesting that they feel the need to officially deny it. The Twitter user co-hosts a podcast where users can call in to tell him whether they think Facebook is listening or not.

One could argue, from a PR perspective, it does not matter whether Facebook is listening or not.

First, some users do not trust them. Maybe Facebook is worried about those users telling other users.

Second, some users believe it is technically feasible to listen.

Finally, there is no legal/regulatory framework in the United States to effectively stop Facebook from listening[FN1], if they wanted to do so. They have clear business incentives to listen because the objective is to gather more personal data about users than their competitors.

NB: Added "in the United States" for clarification.

FN1. Incorrect? What are the theories of liability? What are the sources of law or regulation in the United States? Is injury required? What is the injury? How does one prove the injury?

feelin_googleyon Statistics with the array language Klong

"Personally, I think this is a feature."

That is how I see it.

The more terse the better.

If there is a downside to APL-inspired language interpreters, it is that too many are closed source.

feelin_googleyon Replacing exploit-ridden firmware with a Linux kernel [pdf]

Video of the talk was posted yesterday: https://news.ycombinator.com/item?id=15572978

feelin_googleyon Orchid: a new surveillance-free layer on top of the existing Internet

"One question I still haven't found the answer to: what's with the name?"

"Where did the name cjdns come from?

Cjdns was based on a codebase which was originally intended to handle name resolution (DNS) and so it was a combination of 'cjd' and 'dns'. The project changed direction early on and currently is still lacking DNS resolution but the name stuck. Make up your own acronym for it if you like."

Source: https://github.com/SlashRoot/cjdns

What is it? The author has said it is meant to be a single binary: a router. The router accepts "customized" IPv6 addresses, e.g., each address contains a public key fingerprint. The packets are also custom, each containing a full route to the destination, which might be reminiscent of the bang path in UUCP. The nodejs stuff is just a prototype method of getting data from the router.

I remember watching a video of him explaining this at a cafe a number of years ago. Not sure if that was the first "public announcement". In that video he mentions a concern over censorship via DNS. And then he states that at a certain point he realized routing was easier to do than DNS.

http://www.youtube.com/watch?v=zINQYkl01N8

He uses NaCl. As for the name "cjdns" and why he started out experimenting with DNS, my guess was always that the original experimentation he did with NaCl was probably related to encrypting and forwarding DNS packets (or perhaps custom "name system" packets), since encrypting DNS packets was the "PoC" for NaCl.

feelin_googleyon Replace Your Exploit-Ridden Firmware with Linux – Ronald Minnich, Google

This is quite good.

It is really about the presence of multiple Intel x86 CPUs on a single motherboard each running its own "kernel", but where the user only controls one of these kernels, and what control the user's kernel has over the hardware is easily subverted by the others.

   SMM - can disable
   UEFI - can replace
   ME - can remove components
   ISH - not discussed
   IE - not discussed

The crunched binary for intramfs is written in Go and yet only 5.9MB. No systemd. Everything, even init scripts, is written in Go.

feelin_googleyon How much traffic do I get from North Korea anyway?

RFC 2650

   __=$(exec sed -n '/^4.31.198.44 /!d;=;q' /etc/hosts);
   test ${#__} -gt 0||
   echo 4.31.198.44 www.ietf.org >> /etc/hosts

http://www.ietf.org/rfc/rfc2650.txt

Avast, NFOrce, etc. can update their BGP routing information with a routing registry probably by just sending an email with some authentication details. Apparently the veracity of provided information is not checked. The information then gets propagated to a shared routing registry database offered to the public for free by a handful of registries via WHOIS.

The blog author suggests that the inaccuracies in Maxmind may originate from fake information in WHOIS.

http://www.eecs.qmul.ac.uk/~steve/papers/geolocation-ccr-11....

This paper discusses accuracy of GeoIP databases. It concludes they are between 96-98% accurate at the country-level. Maybe the database compilers would use delay measurement for the 2-4% if the inaccuracies follow some pattern, e.g. they are consitently associated with particular countries. Maybe they already use this method. I don't know.

The IP addresses in the blog, and the idea of fake VPN exit nodes, were discussed previously: http://blog.trendmicro.com/trendlabs-security-intelligence/a...

feelin_googleyon Can You Afford It? Real-World Web Performance Budgets

"Do we need all this JS?"

I know at least one user who is asking this same question. He does not believe it is needed.

Is it possible that "what users want" and what developers want may be two different things? Could developers have wants that are unique to developers?

Purely anecdotal but I do not know any fellow users who "want javascript". I know many who do not want a number of common annoyances though. And I know these hassles are in many cases enabled via javascript.

The tactic leveraged against users is to tell them they need javascript for some thing to work. Then users want it. But I think really they just want the thing to work. They have no particular affection for javascript, let alone any knowledge of why they need it.

One thing I have observed over the years the web has existed early 1990's to today is that users can adapt to anything. Whether it was learning keyboard shortcuts on the console and using text-only programs like Pine, or running www searches that took minutes to finish, or communicating with 140 characters or less, or working with tiny touchscreens and horribly slow web pages and mobile apps. Many more examples if I gave it some more thought. From what I have seen, users accept what they are given and find a way to make it work.

feelin_googleyon Public Key Pinning Being Removed from Chrome

non-javascript url: https://groups.google.com/a/chromium.org/forum/?_escaped_fra...

feelin_googleyon The New York Times Is Now Available as a Tor Onion Service

https://crt.sh/?id=240277340

feelin_googleyon The “Happy Path” to HTTPS

Compared to NaCl, for someone who wants to learn how cryptography libraries work, "TLS" is too much of a moving target. It is unfinished software that may never be finished. Too many versions of too many libraries supporting too many ciphers by too many developers. Too many knobs and switches.

As for OpenSSL, not everyone is on 1.1 yet. There is no ChaCha20-Poly1305 in 1.0.1_. So while some bits of NaCl have been adopted into the TLS suite, it is only a subset of web servers that are supporting the so-called "subprotocol". And still no Ed25519, even though it has been used in OpenSSH for some time now.

All these factors make TLS undesirable for me. Too much complexity compared to NaCl, IMO. For others, TLS may be the right choice.

feelin_googleyon Learn to use Awk with hundreds of examples

  #!/bin/sh
  IFS=:;x=0;while true;do read a b c d;
  test ${#a} -gt 0||exec echo $x
  test $c -lt 240||x=$((x+c));
  done < /etc/passwd

feelin_googleyon Learn to use Awk with hundreds of examples

  #!/bin/sh
  x=0;while true;do read a;
  test ${#a} -gt 0||exec echo $x
  a=${a#*:\*:};n=${a%%:*};
  test $n -le 240||x=$((x+n));
  done < /etc/passwd

feelin_googleyon Learn to use Awk with hundreds of examples

Kernighan and Van Wyk, "Timing Trials, or, the Trials of Timing: Experiments with Scripting and User-Interface Languages" (1998)

http://web.archive.org/web/20000829071436/http://inferno.bel...

AWK, Perl, Tcl, Scheme, C, Java, Limbo, Visual Basic

What if k scripting language was included in those experiments?

http://kparc.com/z/bell.k

k3:

1. "Basic Loop Test"

   \t 1000000(1+)/0

2. "Ackermann's Function Test"

   \t {:[~x;y+1;~y;_f[x-1;1];_f[x-1;_f[x;y-1]]]}[3;7]

3. "Indexed Array Test"

   \t x(x;|x:!200000)

4. "String Test"

   \t f:{(x>#:){(i _ x),(1+i:_.5*#x)#x:,/("123";x;"456";x;"789")}/y};do[10;f[500000;"abcdef"]]

5. "Associative Array Test"

   \t {+/("0123456789abcdef"16_vs'!x)_lin$!x}40000

6. "File Copy Test"

   `f 0:(30000 _draw 300)#\:"king "       
   \t `f 0:0:`f

7. "Word Count Test"

   \t (#:;+/(+/1<':" "=)';+/#:')@\:0:`f

8. "File Reversal Test"

   \t `f 0:|0:`f

9. "Sum Test"

   `f 0:100000#,"-123.456" 
   \t +/0.0$0:`f

Source: http://web.archive.org/web/20010501041644/http://www.kx.com:...

feelin_googleyon Microsoft Has Stopped Manufacturing The Kinect

Most interesting bit of Kinect history, IMO, omitted by the article: https://www.pcmag.com/article2/0,2817,2373107,00.asp

feelin_googleyon Coda, a “next-generation spreadsheet” – from rows and columns to custom apps

Demo of Improv on NeXT:

http://www.youtube.com/watch?v=TbsfvdZXE7s

feelin_googleyon Why We Must Fight for the Right to Repair Our Electronics

"Bowing to public pressure, Apple apologized and fixed the broken phones with a new [software] update. But a precedent had been set. Previously, Apple had made it difficult for people to fix its products by restricting access to parts and service information."

"When you buy such a machine, the hardware becomes yours. But if you ask manufacturers, theyll say that the software inside still belongs to them."

Apple's strategy has been to make repair difficult by restricting information and access to parts.

They can send C&D letters to anyone who publishes information about repair.

But what about users, who are not publishing information about repair?

Apple cannot send C&D letters to users, who are free to use the hardware however they wish.

Apple may have IP covering manufacture and modifications to the hardware, they may have IP covering information about the hardware, but they have no IP on the use of the hardware that they could assert against users.

However because users rely on Apple-controlled software, Apple could manipulate the use of the device via automatic software updates. And that is exactly what they did.

The solution for the user is to select hardware that allows users to install their own choice of open source software instead of giving away control over the hardware to a corporation via corporate-controlled software and "automatic updates".

feelin_googleyon Android getting “DNS over TLS” support

"Users can switch to Google's DNS if they wish to benefit from DNS over TLS."

"If a different DNS service provider you decide to connect to does opt to enable DNS over TLS, they'll get your DNS traffic instead of your ISP. DNS requests will be encrypted, but the DNS over TLS server still gets to see your DNS traffic, though that alone might be a step above using your ISP's servers without TLS over DNS. At least this way, your ISP won't be able to attach your queries to the IP you've been assigned, and thus your name."

Author makes a plug for a third party DNS provider. Third party DNS provider also happens to sell web ads and data about users.

Author believes letting Google or other third party DNS provider see queries is "step above" letting ISP see them.

Assuming this is true (to avoid needless arguments) but wanting more, is there a "step above" letting a third party DNS provider log the queries?

IMO, yes, an obvious one. Running DNS cache and/or authoritative daemons on localhost. Using a custom root.zone can be helpful.[FN1]

Is that possible on a mobile phone? No idea. Maybe it should be.

Any other options? How about running a cache and/or authoritative daemons on a computer you can actually control. Set the mobile OS DNS settings to point to that computer. It works. I have been doing this for many years.

FN1. Per packet encryption for DNS is also available via DNSCurve. For example, I can make encrypted queries directly to the DNS servers for any website that support it. I have been using DNSCurve for years as well. It works. Only a small number of public websites have adopted it so far even though it is relatively easy to set up.

Although I personally do not care for third party recursive DNS service, third parties might provide a useful name lookup service over TLS. To illustrate, we can use Google DNS is an example.

What if we could make queries over TLS (using HTTP) but without using SNI?

To start, get the IP address for the third party provider.

    dig dns.google.com

Let us assume hypothetically the IP address is 1.2.3.4

    curl https://1.2.3.4/resolve?name=example.com.\&type=dnskey

Assuming this service is still working you should receive a DNS packet as JSON.

The reason why I think this could be useful is that we can use HTTP pipelining to the http daemon. Example below. (No publicly available dns daemons accept pipelining AFAIK.) Thus one can do multiple lookups by sending only a single TCP packet.

I have never understood is why there are no publicly released DNS servers that can accomodate multiple queries in a single UDP DNS packet. If I recall correctly, the original DNS RFC contemplates this.

The DNS data returned via TLS (as JSON in the Google DNS example) might be useful for instance in emergencies when DNS service is unavailable or untrustworthy, or it might be inserted into HOSTS file or into custom zone files served by localhost daemons. It could be useful.

   openssl s_client -tls1_2 -ign_eof \
   -connect dns.google.com:443 -verify 9 <<eof
   GET /resolve?name=example.com.\&type=dnskey HTTP/1.1^M
   Host: dns.google.com^M
   Connection: keep-alive^M
   ^M
   GET /resolve?name=example.net.\&type=dnskey HTTP/1.1^M
   Host: dns.google.com^M
   Connection: close^M
   ^M
   eof

feelin_googleyon The advertising industry has been living a lie

"'There is no basic internet knowledge among people funding the internet'"

feelin_googleyon The “Happy Path” to HTTPS

I agree. Especially with the part about CAs and a more SSH-like approach.

But unlike you I have little interest in "browsers". This is why I would want a "naclwrap" utility but you might not see any point. CurveCP is the experimental transport protocol. I do not need it in a browser because I am not interested in browsers. I like experimenting outside of browsers and the "web" so I have no reason to resist CurveCP.

What is the advantage of scraping TLS? If you mean for everyone, maybe there is none. Why not allow both TLS and NaCl to coexist? Why does TLS have to be "redone" with NaCl?

For me personally, the advantage of "scraping TLS" is that I get to ignore all the cruft and complexity that I have to sift through to get to the proper "subprotocol" within TLS. Too much work.

I am not the one who will write "naclwrap" if it ever is released. The person who wrote it does not introduce bugs and security issues. He is not like the people who work on TLS and most developers in general. He is careful.

In any case, I am not tasked with persuading anyone else to scrap TLS. I am simply a user who 1. likes NaCl, 2. prefers the idea of per packet encryption to the notion of encrypted "tunnels" and 3. is apt to complain about TLS only because like other web users I am forced to use it whether I want to or not.

For someone focused on influencing developers who write programs for other people, shaping web standards or at least very interested in where they might be heading, your comments are poignant. But I am just a user. I write trivial programs for myself. I am not futilely trying to tell developers what to do, shape standards nor am I very interested in where things are heading, except to the extent I can minimize the computer usage-related annoyances I must endure.

feelin_googleyon The “Happy Path” to HTTPS

One of the things that perplexes me as a naive user about TLS is the ridiculous number of cipher choices. How do you explain it? Some people still need them? Impossible/impractical to cut TLS down to size? People who comment intelligently about crypto seem to agree that complexity is the enemy of security, but does TLS even try to reduce complexity?

There is so much accumulated cruft to SSL/TLS and the implemented x509 certificate scheme that to me, as a noob who knows nothing about crypto i.e. the average user, the easier path is to scrap all that ("shed all legacy" junk) and focus on learning a few things that are both flexible and known to be useful. I believe NaCl fits this role.

I have some basic UNIX-like utilities built with NaCl, one for each function (crypto_box, crypto_secretbox, etc.). Minimal non-djb code. In the interests of experimentation and learning, I prefer using small, separate utilities versus applications that do multiple jobs.

I would be interested in an "expert" opinion on my experiments with these utilities but crypto is such a devisive topic. Though they may be initiated as sensible, honest questions, online discussions quickly turn toward dogma supporting status quo, mindless memes, subtle insults and are sometimes derailed into the realm of absurdity. I would post an example of the usage for comment, but I am not interested in being chastised by the HN peanut gallery. It is just intellectual experimentation, nothing more.

IMO, as a general principle not limited to crypto, there is nothing wrong with "custom" anything if it has passed the same QA tests as the "mass-produced" version. Sometimes in fact custom is higher quality than mass-produced. Popularity does not always signify higher quality. Perhaps nowhere is this more evident than in the world of software.

IMO, a "naclwrap" program would be very useful, even in a "TLS world". Like stunnel but for nacl. Whether "everyone" would use it is an interesting question but ultimately not something I care about.

feelin_googleyon Deep C (2011)

    # make your own (large) PDF from slideshare url
    # image resolutions available: 320, 728 or 1024 pixels
    # example: $0 http://de.slideshare.net/olvemaudal/deep-c 728 deepc.pdf

    test $# -eq 3||exec echo usage: url $0 {320,728,1024} file.pdf
    browser='curl -s -O';
    #browser='ftp -4';
    test ${#TMPDIR} -eq 0||cd $TMPDIR||exec echo set TMPDIR 
    $browser -o 1.htm $1;
    echo downloading images... >&2;
    tr '\40' '\12' < 1.htm \
    |sed '/-'"$2"'\.jpg/!d;s/\.jpg.*/.jpg/;
    s/.*https:/https:/;s/\".*//' \
    |while read a;do $browser $a;done #slow step;
    test -f  *-1-$2.jpg ||exec echo download failed 
    pdfimage -o $3 *-$2.jpg;
    exec rm  *-$2.jpg 1.htm;

    # pdfimage is sample program included with pdflib
    # http://www.pdflib.com/

feelin_googleyon PC-MOS released under GPL

   8
   Insufficient disk space to install Operating System.
   PC-MOS Requires 800k to store systems files.
   Press F10 to Exit to PC-MOS.
   [PCMOS]

https://github.com/roelandjansen/pcmos386v501/blob/master/SO...

feelin_googleyon Alarming number of DNS requests made by iOS devices

I have been logging, redirecting and blocking these queries for these domains and more for years.

It is one of our biggest complaints about the "new" Apple.

There is no option for the user to disable the nonstop phoning home. iOS is a BSD-like OS configured so that the user does not fully control it (e.g. can't stop someone else's software from incessantly trying to phone home). The user cannot fully configure it (e.g., can't access HOSTS file). Only Apple can (they get root and they do not even own the device). Important settings are placed off limits to the owners of these devices. This is no fun.

Turn on an iOS device and it will keep trying to connect to Apple servers; it will not stop. An incredible tracking device if those servers keep logs, irrespective of Apple's reasoning. Not to mention lots of unnecessary network chatter on the home network.

Clarification: After many years of desensitization to this practice since the first iPhone, it is neither "a secret" nor "scandalous", but it is still disappointing. Moreover, I am not advocating any other mobile OS simply by making a comment about iOS. In fact, none of the "smartphones" being sold today are satisfactory to me as portable computers when compared with the control I get using an open source OS with i386, amd64 or even a development board.

feelin_googleyon Plain emails not only save time but work better (2016)

"The trouble with text-only email"

https://lwn.net/SubscriberLink/735973/17bdb163fddd41ae/

https://news.ycombinator.com/item?id=15478546

Tracking users via email is such a lucrative business, we would need hundreds if not more of these blog posts to even make a small dent in the mindshare that HTML email has captured. How many phishing attacks rely on HTML email? All of them?

feelin_googleyon Critics say WeWork is an overvalued real-estate play

Retrieve the page with a small http client instead of a large browser. e.g., wget, curl, fetch, etc. Save it.

   wget -o savedpage.htm https://www.wsj.com/amp/articles/wework-a-20-billion-startup-fueled-by-silicon-valley-pixie-dust-1508424483

Delete the Javascript.

   sed -i '/<p>/,/<\/p>/!d' savedpage.htm

Open savedpage.htm in a browser.

feelin_googleyon Analyzing HN moderation and censorship

https://github.com/sctb/woe

Indeed this is cool.

To compile on BSD, I used

   gcc -static -std=c89 -Wall -pedantic -o woe woe.c -lm

feelin_googleyon Critics say WeWork is an overvalued real-estate play

s,com,&/amp,

https://www.wsj.com/amp/articles/wework-a-20-billion-startup...

Then view in "Reader" mode. Most of the major browsers have it.

Alternatively, extract the text from the page and leave the Javascript behind. The Javascript is not needed to read the text.

feelin_googleyon The “Happy Path” to HTTPS

The point of SNI, i.e. the reason for its existence, is to allow more than one SSL-enabled website to use the same shared IP address. Prior to SNI each SSL-enabled website required its own dedicated IP address. On a home network, is shortage of RFC1918 IP addresses really a problem?

feelin_googleyon The “Happy Path” to HTTPS

"What's the point if it isn't end-to-end?"

Cynical answer: The padlock, the "https://" in the address, etc. A phony sense of "security".

CF's comfort with playing man-in-the-middle should not surprise anyone familiar with the company's origins in examining the content of web traffic. Remember Project Honeypot?

feelin_googleyon The “Happy Path” to HTTPS

Not using dhparam? Dont like ECDH?

I wrote a similar amateur script years ago which has required updates from time to time to reflect new developments in the ongoing SSL saga.

This was started before anyone cared about SNI.

If the use case for the CA is a home network, I prefer using a local SSL-enabled proxy for connecting to both remote and local SSL-enabled endpoints. This lets me specify a short list of acceptable ciphers. It also permits me to use legacy, non SNI-enabled SSL/TLS clients. The remote and local hosts are "backends" that go in the proxy config file. I control DNS via local root or use HOSTS to redirect to the proxy.

If I was running multiple local SSL enabled devices/servers from the same local IP on a home network, then I believe I could just put these in the config file as backends listening on high, unprivileged ports. I do not believe I would need SNI because I could filter requests based on domain name and/or the filepath in the url.

The ultimate solution IMO would be an sslwrap type utility that has been revised to use more modern encryption, i.e. NaCl. Any application could then use NaCl instead of SSL/TLS, without having to modify the application. The NaCl author has menitoned several times that he has written such a utility and even said he will release it at some point.

IMO, that would be a big step in freeing us from the ills of SSL/TLS and the 3rd party CA system. Users would get easy-to-use, high quality, high speed cryptography without having to learn all of the SSL/TLS complexity, not to mention having to keep up with incessant bugs and security updates.