Hacker News Reader

ge0rgon Hacking the Samsung NX300 'Smart' Camera

The NX300 doesn't support running from external power, you only can charge the battery when off, or run from battery, even when plugged in. The NX500 can be used as a HDMI or network streaming camera, but I'm not sure which protocols it's using for that.

ge0rgon Hacking the Samsung NX300 'Smart' Camera

I always wanted to look into the Sony Android API, but I'm too heavily invested into Samsung NX right now. Do you know what functions are exposed? Can you actually write a custom camera app for time-lapses, modify exposure and WB, or is it merely a "Share with" integration to post your photos to insta?

ge0rgon Hacking the Samsung NX300 'Smart' Camera

I'd recommend starting with https://mewlips.github.io/nx-remote-controller-mod/ - it's easy to install / is part of NX-KS2 mod and gives you an immediate benefit.

All the other hacks for NX1, including NX-KS2, are listed at https://github.com/ottokiksmaler/nx500_nx1_modding

ge0rgon Hacking the Samsung NX300 'Smart' Camera

Blog author here. This article is from 2014, and the latest documentation of Samsung NX cameras and their Linux underpinning is https://op-co.de/blog/posts/samsung_nx_archaeology/

My most fascinating find was actually the Galaxy NX, which is an Android 4 phone with a dedicated camera SoC running the same flavor of Tizen Linux as the NX300.

Edited to add: Since Dpreview is shutting down, I've also created a reddit for the Samsung NX fans: https://old.reddit.com/r/SamsungNX/

ge0rgon Hacking the Samsung NX300 'Smart' Camera

Blog author here. I was actually a bit upset about it, and only later realized the value they created for und community, even if inadvertently. Unfortunately, later they tried to close this door again: https://github.com/ge0rg/samsung-nx-hacks/wiki/NX300M-autoex...

ge0rgon Samsung NX Camera Archaeology

Personally, I can barely stand the smartphone UI for a camera. The only good thing you have there is touch auto-focus, but I have that on the "proper" NX cameras as well, plus all the dials and knobs for quickly adapting to the subject.

The NX mini is a great little device, but it was badly marketed and priced, and its manual focus is utterly unusable. I so much wish that the mini2 would've been released before exiting the market!

ge0rgon DPReview.com to close

The companion apps provided by ILC manufacturers are just horrible, broken, useless. I was really glad that I could hack the in-camera "send email" function of the Samsung NX500 to send the picture to a VPS which then forwards it to my favorite photo sharing chat instead.

ge0rgon DPReview.com to close

This is so ffffing sad to read. I've only recently become an active user of the forum, as it's the last island of active Samsung NX mirrorless camera users (some of which run Linux), and it was really great to have a polite and civil discourse with other nerds sharing the hobby.

ge0rgon Google cracks down on VPN based adblockers

I tend to agree, but for a few years now, Firefox has become an ad delivery vehicle for Mozilla. While not as bad as anywhere else on the web, it seems that Mozilla is working hard to destroy their brand value by pushing notification ads for its VPN service to mobile Firefox users (which is a violation of the Google Play ToS), and by using the firefox-was-upgraded page for VPN spam.

ge0rgon Playstation Store removes Studiocanal movies, no refunds offered

If complaining and asking for a refund doesn't yield a result, you will have a very hard time finding a lawyer to get this through the courts, given the rather marginal value of the content that you "purchased".

ge0rgon The weird Hewlett Packard FreeDOS option

Given that HP is also using obscure/outdated Linux images in their own Intelligent Provisioning / Smart Storage Administrator tools that are installed on the built-in flash of (at least) gen8 servers <https://op-co.de/blog/posts/microserver_gen8_fix_boot_order/>, I'm not at all surprised to see similar approaches in other situations.

ge0rgon OnlyFans to block sexually explicit videos starting in October

UK: https://www.pinknews.co.uk/2018/04/25/banned-gay-porn-uk/

Germany: https://www.wired.co.uk/article/germany-porn-laws-age-checks

ge0rgon Google will consider lowering Play Store cut to 15% for certain apps

As a full-time app developer who consequently follows all Android design, policy and direction changes, you are not going to miss that message. As a part-time / hobby project developer, I only read the news posts that made it look like it was an automatic fee reduction.

ge0rgon Google will consider lowering Play Store cut to 15% for certain apps

Indeed, after working through the new bureaucracy, I've come to this realization as well. But the quoted wording isn't really helpful to realize that.

ge0rgon Google will consider lowering Play Store cut to 15% for certain apps

From https://play.google.com/console/developers/paymentssettings :

Create an account group to help us understand if there are any other developer accounts that you're associated with. We'll use this information to make sure that you're eligible for Google Play developer programs and services, such as the 15% service fee.

This looks like a fully arbitrary requirement that has nothing to do with the 15% fee and everything with Google collecting as much data as it can get away with.

ge0rgon Google will consider lowering Play Store cut to 15% for certain apps

All their announcements read like fees will be automatically reduced to 15% for the first 1M$, and even the linked article implies that:

Starting July 1, 2021, the service fee for each developer will be 15% for the first $1M (USD) of earnings you make each year when you sell digital goods or services.

However, when you read on, you realize that it's an opt-in that you need to take action on:

To officially enroll for the 15% service fee tier, you must: [list of requirements and steps]

ge0rgon How Prosody developers spent 2020

There have been significant efforts to reduce this kind of fragmentation and to outline which XEPs a client or server developer should focus on, given a certain target application.

We are reviewing the most important specifications on a yearly base and provide recommendations in the form of Compliance Suites with different profiles like Instant Messaging, Mobile etc.:

https://xmpp.org/extensions/xep-0443.html

ge0rgon Apple Announces App Store Small Business Program

I'm publishing the same (paid) app on Google Play and on Amazon's store, which is AFAICT the most widely used alternative (outside of markets where Google is not active).

My Amazon income is less than 2% of the Google income.

ge0rgon Btrfs Coming to Fedora 33

btrfs has made some headlines in the past about its severely broken checksum computation in RAID modes, which rules them out for production use, i.e. https://phoronix.com/scan.php?page=news_item&px=Btrfs-RAID-5...

The wrong parity and unrecoverable errors has been confirmed by multiple parties. The Btrfs RAID 5/6 code has been called as much as fatally flawed

It would be interesting to know if this has been addressed already.

The big fat red warning on btrfs' own wiki page is not inspiring trust either: https://btrfs.wiki.kernel.org/index.php/RAID56

For data, it should be safe as long as a scrub is run immediately after any unclean shutdown

ge0rgon Don't Terminate People's Internet Connections

Not universally. In Germany, there is only a federal decree guaranteeing 56kbit/s modem speed, and this is not a human right but merely an obligation to the state telco.

ge0rgon Revoking certain certificates on March 4

There is a list of all affected certificates posted under https://letsencrypt.org/caaproblem/ - and it looks like they are also leaking the account IDs from the list, so now you can map different domains/certificates to the account that got them issued.

ge0rgon End torture and medical neglect of Julian Assange

It is our opinion that Mr Assange requires urgent expert medical assessment of both his physical and psychological state of health. Any medical treatment indicated should be administered in a properly equipped and expertly staffed university teaching hospital (tertiary care). Were such urgent assessment and treatment not to take place, we have real concerns, on the evidence currently available, that Mr Assange could die in prison. The medical situation is thereby urgent. There is no time to lose.

ge0rgon OpenPush: A Free, Decentralized Push Messaging Framework for Android

So as an app developer, I need to integrate each of those into my app, or provide alternative builds for all?

ge0rgon OpenPush: A Free, Decentralized Push Messaging Framework for Android

Open Source and centralized are orthogonal to each other. Signal is both, just to name an example.

An open push framework only makes sense (for battery optimization at least) if it's centralized, and all applications make use of it.

ge0rgon Cache Poisoned DoS Attack: Shutdown any CDN Website with One HTTP Request

Many intermediate systems such as proxies, load balancers, caches, and firewalls, however, do only support GET and POST. This means that HTTP requests with DELETE and PUT are simply blocked. To circumvent this restriction many REST-based APIs or web frameworks such as the Play Framework 1, provide headers such as X-HTTP-Method-Override, X-HTTP-Method or X-Method-Override for tunnel blocked HTTP methods

This is so f*ing scary. Who in their right mind invents such crazy tricks that absolutely circumvent all we know about web API security, implements them in frameworks, and leaves them enabled by default?

ge0rgon PoisonTap (2016)

Previous coverage:

* https://news.ycombinator.com/item?id=12971503

* https://news.ycombinator.com/item?id=12966673

* https://news.ycombinator.com/item?id=12974121

Potential counter measure: https://news.ycombinator.com/item?id=13118227

ge0rgon Former Fortnite UX lead digs into ethical game design

As was said in other threads, what she writes is more comparable to cigarette industry or casino operators than to ethical design. Therefore, even if she wasn't directly responsible for the loot boxes, she seems to have thoroughly internalized and rationalized the unethical design of the game.

ge0rgon Matrix.org Security Incident

The most favorable reading of the current defacement page is that the attackers still controls the DNS, but no other parts of the infrastructure.

Otherwise, the page probably wouldn't run off github.

ge0rgon Making email more secure with MTA-STS standard

So this obviously doesn't solve the initial-connection issue (where it relies on untrusted DNS for discovery... if only we had DNSSEC).

But for later connections, it is essentially defining a caching of:

- a boolean flag that a trusted certificate is to be used

- a flag whether violations are to be reported to an endpoint obtained from untrusted DNS

- a maximum age of this "policy"

how is it superior to:

- just querying / dumping this policy as informational headers after STARTTLS (possibly guarded by a new EHLO feature)

- TLS TACK (https://tools.ietf.org/html/draft-perrin-tls-tack-00), which is kind of abandoned, but is an equivalent to HSTS, just at the correct layer

and how does it solve the problem that even if you have a policy defined, a MitM attacker can just redirect all policy reports with a very-long-lived _smtp._tls.example.com DNS record pointing to their own property or to nowhere?

ge0rgon The Nokia N9 Alarm Clock (2014)

You can tap on the title of the widget to get into the month / year selection. It doesn't exactly help discoverability that it looks like a title and not like a button.