HNHacker News
TopNewBestAskShowJobs

fensipens

128 karma · joined May 24, 2014

submissionscomments
fensipens··on Auditing GitHub users’ SSH key quality
I agree, this is rude and as far as I remember, it's not mentioned anywhere in the key upload interface.

It's equivalent to uploading someones PGP key to a keyserver without his or her permission.

fensipens··on F-Droid Dropping Firefox
I had no idea, thanks for the quotes, especially the Turing quote.

I hope fetchmail makes its choice too and dies. End of story.

fensipens··on How I learned to stop worrying and love React
Thanks, that's what I've been looking for!
fensipens··on How I learned to stop worrying and love React
> But there's something to be said for having a single template file for a single page in Angular, versus having JSX scattered among 20+ components for that same single page in React.

Good point; How does one view the resulting react-page anyway? CTRL+U shows <body><script.../></body> no matter what state the SPA is in..

fensipens··on Rspamd – Fast, free and open-source spam filtering system
How does rspamd compare to mopher (http://mopher.org) in terms of functionality?

I see some interesting things like the surbl module but other than that this seems to be more like mimedefang (or that's at least what I've picked up from the landing page).

Also do you consider supporting multiple database drivers or will you stick with sqlite3?

fensipens··on Ext4 encryption patches for Android
> Anyone know why I'd want to use this over dm-crypt?

    - mixing unencrypted with encrypted data (why encrypting object files during bulk builds?)
    - file-based, encrypted backups for free (including incremental jobs!)
    - passwords/keys per directory
    - passwords/keys per user
    - passwords/keys per group
    - (...)
People who like encfs/cryptfs will probably like this too.
fensipens··on Google warns of unauthorized TLS certificates trusted by almost all OSes
Goodin can't help but say borderline moronic things every once in a while:

Defenders of current system for acquiring and and revoking TLS certificates have recent chafed in response to statements from this author that it's hopelessly broken. Besides remembering that almost all of these critics have a strong financial interest in the way the system works now

"chafed" because of this:

https://twitter.com/ivanristic/status/578536108662861824

So Ristic working for ssllabs automatically disqualifies him from asking the perfectly valid question "What is a better approach, in your opinion?"..

You still like your Goodin, tptacek? ;)

fensipens··on GPG and Me
Don't bother. While I have much sympathy for the average user and see several problems with PGP, the gen-pop here is creating way too much buzz around a tool that is working reasonably well.

And with respect to the PGP-user / character link.. this is just beyond stupidity.

fensipens··on GPG and Me
Matthew D. Green, the "expert in applied cryptography and network security" who was invited to take a look at the Snowden-stash but declined because he was scared. Which is funny, because since Snowden he became some sort of web-celebrity always ready to tweet and comment on every little crypto/security issue.
fensipens··on GPG and Me
To quote another commenter:

"Way to take a dump on people who make an effort."

fensipens··on GPG and Me
These rants are not very useful until one of the two geniuses (Green, Moxie) can come up with a comfortable solution to the core problem of key distribution.

And given that nowadays Green seems completely consumed by twitter while Moxie believes in fixing whatsapp, I wouldn't hold my breath.

fensipens··on Once-starving GnuPG crypto project gets a windfall. Now comes the hard part
Removal of PGP-2 support

Some algorithms and parts of the protocols as used by the 20 years old PGP-2 software are meanwhile considered unsafe. In particular the baked in use of the MD5 hash algorithm limits the security of PGP-2 keys to non-acceptable rate. Technically those PGP-2 keys are called version 3 keys (v3) and are easily identified by a shorter fingerprint which is commonly presented as 16 separate double hex digits.

With GnuPG 2.1 all support for those keys has gone. If they are in an existing keyring they will eventually be removed. If GnuPG encounters such a key on import it will not be imported due to the not anymore implemented v3 key format. Removing the v3 key support also reduces complexity of the code and is thus better than to keep on handling them with a specific error message.

There is one use case where PGP-2 keys may still be required: For existing encrypted data. We suggest to keep a version of GnuPG 1.4 around which still has support for these keys (it might be required to use the --allow-weak-digest-algos option). A better solution is to re-encrypt the data using a modern key.

https://gnupg.org/faq/whats-new-in-2.1.html

This only affects data encrypted by PGP-2, the original Phil Zimmerman PGP. If you are on GPG 1.4 or 2.0 and want to switch over to 2.1 this shouldn't be a problem.

fensipens··on Once-starving GnuPG crypto project gets a windfall. Now comes the hard part
AFAIK, classic (1.4) and stable (2.0) use a different format/layout for ~/.gnupg than modern (2.1).

Edit: see quoted text above.

fensipens··on Once-starving GnuPG crypto project gets a windfall. Now comes the hard part
> Goodin is a journalist, not a security researcher. He depends on researchers as sources for his story

My main issue with the article was the way he presented the story as if it was based on facts instead of a few unproven claims. Subsequently, the story spread to other non-technical platforms, re-reported as fact.

> Robert Graham (...)

Well, that doesn't really matter.. extraordinary claims were made in the complete absence of extraordinary proof. And then a multi-page story was written based on nothing.

> I think Green is being a bit unfair to GPG in this piece

I agree, his comments were slightly smug.

fensipens··on Once-starving GnuPG crypto project gets a windfall. Now comes the hard part
Is there some other story that I'm not aware of here?

If it's from Goodin, you should always take it with a teaspoon of salt. He is often in way over his head with certain subjects he decides to write about, best example being BADBIOS, the story about a hearsay BIOS uber-virus. Made everybody shit their pants for days (even the MSM picked it up) and after weeks of waiting, the swarm of curious FW/BIOS analysts that were demanding dumps from Goodins source finally declared the story BS.

That aside, the following paragraph alone says a lot about Goodin's ham-handed journalism:

Still, it's not clear whether it makes sense to dump massive amounts of cash to refurbish code in such disrepair.

I glimpsed over the 1.4 branch for a few minutes (I bet longer than Goodin) and while some parts look complicated, it is not remotely as ugly as for example fetchmail or certain parts of the glibc.

fensipens··on Dementia 'linked' to common over-the-counter drugs
Let me complement your helpful answer with some details about the stuff I'm eating..

Fexofenadine (Allegra, Telfast..):

"Unlike older antihistamines, fexofenadine does not have anticholinergic activity." http://www.medscape.com/viewarticle/406437_3

Bilastine (Bilaxten):

"No anticholinergic adverse events were observed in the clinical trials.." http://en.wikipedia.org/wiki/Bilastine

"bilastine's safety profile is satisfactory, since it lacks anticholinergic effects" http://www.ncbi.nlm.nih.gov/pubmed/22149338

fensipens··on ZFS vs. Hammer
If you want ZFS you need lots of expensive ECC RAM. (...) The rule of the thumb is that you typically need about 16GB of RAM to begin with ZFS and then about 1-2 GB for each additional TB of data.

Ugh.. can someone please tell me who started this ZFS-ECC-UBER-RAM fetish? Whenever I read anything about ZFS, some gollum first has to scream at me how superimportant a ridiculous amount of ram (especially ecc-ram) is. Why? Who said so? When?

fensipens··on A Shark on the Network
This.

I was hoping to read some recommendations on chipsets that are able to monitor multiple channels simultaneously.. but then it was just another misleading headline.

fensipens··on Taming non-terminating Bash processes
there might be no lines which contain this flag

Again, untested:

        #! /bin/sh

        timeout=5
        fifo=/tmp/discover-vnc.fifo
        rm -f $fifo
        mkfifo $fifo

        dns-sd -B _rfb._tcp >$fifo &
        pid1=$!

        while read line; do
          case $line in *_rfb._tcp.*)
            # do something here.. then test
            # if flag=3 and break otherwise
          esac
        done <$fifo &
        pid2=$!

        sleep $timeout && kill $pid1 $pid2 &
        pid3=$!

        wait $pid2
        kill $pid3
It's also rather ugly to create a named pipe for this purpose

Because it creates a file in /tmp? Who cares? The alternative is bash voodoo magic.. the same magic that gave us shellshock.

fensipens··on Taming non-terminating Bash processes
$BASHPID and $! are two different things.
fensipens··on Taming non-terminating Bash processes
$! is not working with the distributed Bash version (currently 3.2) on OS X.

  $ bash --version
  GNU bash, version 3.2.48(1)-release (x86_64-apple-darwin10.0)
  Copyright (C) 2007 Free Software Foundation, Inc.
  $ : & echo $!
  [1] 329
  329
fensipens··on Taming non-terminating Bash processes
Try something like this (untested):

  #! /bin/sh

  fifo=/tmp/discover-vnc.fifo
  rm -f $fifo
  mkfifo $fifo

  dns-sd -B _rfb._tcp >$fifo &
  pid=$!

  while read line; do
    case $line in *_rfb._tcp.*)
      # do something here.. then test
      # if flag=3 and break otherwise
    esac
  done <$fifo

  kill $pid
fensipens··on Taming non-terminating Bash processes
Sorry Pädu but this smells for many reasons.. first:

     The dns-sd command is primarily intended for interactive use.  Because
     its command-line arguments and output format are subject to change,
     invoking it from a shell script will generally be fragile. Additionally,
     the asynchronous nature of DNS Service Discovery does not lend itself
     easily to script-oriented programming. For example, calls like "browse"
     never complete;
Second, "SIGKILL is too verbose, SIGINT is too soft".. how about SIGTERM? Its very likely that you're doing it wrong if you need to use -KILL in your scripts.

Third, "[1] 58181 killed ./discover-vnc.sh --- It's crucial to suppress this line." again, if you think you must suppress this, you're doing it wrong. This shouldn't pop up in the first place.

Fourth, what about fifos and `$!'?

Fifth, why bash? Use the sh-subset.

etc.

It's cute that you managed to solve your problem but this is nothing more than an unreliable hack, pompously presented ("Taming non-terminating Bash processes", "Kill the children"..)

fensipens··on Vim After 11 Years (2013)
Eh, I've been using vi{,m} for 15 years too and I `ftFT;,' things on a daily basis.

Remove two `a' characters of the current line:

fax;.

Note: no mode change necessary

Also, line editing in /bin/{,k,ba}sh -o vi without `ftFT;,' is a pain.

fensipens··on ASCII art editor designed for the Mac
> That's an attitude I love to see.

Because when OSX n+1 is released, it's immediately impossible to get any work done on OSX n?

I'm still on 10.6 and see no reason to upgrade.

fensipens··on ASCII art editor designed for the Mac
ASCII? The arrows alone scream UTF-8 and require proper charset- and font-support.

But it's a cute tool, no question.

fensipens··on When should I not kill -9 a process?
What earlier implementations? The initial import of /bin/kill into the NetBSD source-tree accepted signal names and that was 21 years and 2 months ago. Same with FreeBSD and their commit message even implies that signal names were allowed in the original 4.4BSD-Lite source.

WRT shorter: Magic numbers don't just suck in programming.

fensipens··on When should I not kill -9 a process?
When should I not use signal names in conjunction with kill?

Never.

← PreviousPage 2 of 2