Hacker News Reader

fidgeton Out-of-bounds write in systemd-resolved with crafted TCP payload

Yeah, we really should rewrite the kernel.

fidgeton An Ancient Kernel Hole Is Not Closed

That's GRSecurity for you

fidgeton Telegram founder: US intelligence tried to bribe us to weaken encryption

Man, I've got some horrible news about your CPU.

fidgeton Krypt.co raises 1.2M to securely store your SSH private key on your phone

There are other bad things about ssh. Tofu sucks balls and ssh users are far too comfortable with it.

fidgeton US Government Fears Another Explosion Of The Ransomware Plague It Helped Create

Doesn't particularly make a difference, given that this issue is about users not upgrading (for whatever reason) their windows XP installations. Would the exploit having being disclosed by the NSA or by someone else have changed the fact that these users would not have upgraded and gotten a patch?

fidgeton Falklands minefields: de facto nature reserves for penguins

His arms and influence is also changed the way I view conflict between states.

fidgeton How to ship production-grade Go

It's not strongly coupled beyond requiring that the wrapper implement a `Cause() error` method. I don't really think that could ever be considered strong coupling

fidgeton How Google Could Collapse

So short it

fidgeton Uber gets sued over alleged ‘Hell’ program to track Lyft drivers

Please let me know where you work, so I can avoid any product potentially produced by you.

fidgeton How We Built r/Place

Are you suggesting that you had a concurrency bug that was solvable without changing your entire storage layer? Heresy..

fidgeton Jeff Bezos’ Annual Letter

No one does, you estimate each task to have a different number of points, which modify the task's contribution to the burndown graph.

I guess the idea is that points should correlate to time (questionable), and if you're estimating perfectly, that should give you a linear burndown graph. Which is stupid. What might be less stupid is that if you want to get some idea of how well your team is estimating tasks, compared to i.e. this time last year, you could look at the volatility (across several sprints) this year compared to last year, and a lower burndown rate volatility might suggest that the team has improved at estimating the duration of tasks.

However, when you just focus on the volatility as a metric, then people start optimizing for it, which is not the point at all.

fidgeton DNSCrypt – A protocol to improve DNS security

Isn't anycast ip usually used for that instead?

fidgeton What the CIA WikiLeaks Dump Tells Us: Encryption Works

Right, which is why I said those blackbox methods were pretty rubbish. You step through it with a debugger.

fidgeton What the CIA WikiLeaks Dump Tells Us: Encryption Works

Unannounced side channels seems like by far the easiest thing to deal with there; send a 2mb file, observe network patterns, raise an eyebrow if 2mb gets sent over a channel that you didn't expect.

As for using the correct key, dismantle the signal message envelope until you get your blob of encrypted message. Then see if the same blob appears on the target device. Multiple keys? I imagine either correlating message size and network traffic (encrypting stuff twice could well show up), or going at it with a debugger.

Which is really the answer to all of these questions instead of any network shenanigans. You root your phone and attach a debugger, then step through what signal is doing.

Not a security researcher, never reverse engineered anything for security reasons in my life.

fidgeton Notepad++ V 7.3.3 – Fix CIA Hacking Notepad++ Issue

Phew lad. You're a bit far gone aren't you.

fidgeton The Tragedy of Newcomb Mott, Who Thought He Could Walk into Soviet Russia

>I think you're giving too much importance to something quite insignificant here, his race and background.

How about his entire socialisation?

fidgeton Ask HN: Is S3 down?

The GCS being referred to by the GP is Google Cloud Storage, not Cloud Sequel. You really do need failover set up though. That's true for basically any MySQL installation, managed or not.

fidgeton Ask HN: Is S3 down?

They have a minimum of 1 year deprecation policy in their terms of service.

fidgeton Ask HN: Is S3 down?

Functions are going beta this week

fidgeton When “Dumb Pipes” Get Too Smart

Helps a ton if you're terminating SSL at the edge, due to the number of roundtrips you need before the server can even start generating that first byte.

fidgeton Torus development has been stopped at CoreOS

Well that seems eminently reasonable

fidgeton How both TCP and Ethernet checksums fail (2015)

The end to end principle says no, you need application level checksums anyway

fidgeton Trident whistleblower: nuclear 'disaster waiting to happen' (2015)

It was before the vote to renew, and was not disclosed to people making that vote.

fidgeton Introducing Riptide: WebKit's Retreating Wavefront Concurrent Garbage Collector

Well that seems like an easily applied solution to the problem of GC in javascript.

fidgeton IPv6 Support for EC2 Instances in Virtual Private Clouds

8 IPs per instance, max :/

fidgeton Grafana 4.0 with alerting is released

https://twitter.com/fabxc/status/803870900097523712

> I repeat: Your alerts and dashboards belong into your SCM, not a random SQL database!

(And I 100% agree, particularly for alerts)

fidgeton Never accept a counter-offer

> my ace in the hole was an unsecured network share drive where I found an offer letter for a coworker showing he made $135k.

Eww

fidgeton Creating a PostgreSQL Cluster Using Helm

God I hate helm. Buggy piece of shit

fidgeton Docker not ready for primetime

Yeah setup time is great. However, it seems that the number of commands required for stability with docker swarm -> ∞

fidgeton Britain’s scientists are freaking out over Brexit

Not everyone has the means to change country