Hacker News Reader

ge0rgon The Nokia N9 Alarm Clock (2014)

The Android widget is a huge design fail. If you accidentally touch the wrong hour, or get into PM instead of AM, you have no way to correct. It became bearable to use once I forced myself to always swipe the hours and minutes until it read the right value, and to lift the finger then.

It's still not as bad as the Samsung and iOS vertical dial with 60 options, though.

My old Symbian phone (pre touch) allowed to just type the desired alarm time on the keyboard. I could blindly set an alarm. Those were the times...

ge0rgon Developing for Android is like being a demonetized YouTuber

But there are some APIs that don't work, e.g. ExifInterface (that you need to properly process image orientation) can only read from InputStream starting with r24, and you need access to the raw File before that [0].

[0] https://developer.android.com/reference/android/media/ExifIn...

ge0rgon Matrix 1.0 – Are We Ready Yet?

The second point will only address the vendors that are actually interested in federation, not the ones that want to close down their silo. XMPP fifteen years ago is a prime example.

Regarding the first point, I'm not sure it will be ever possible to pull this off. The proprietary IM silos are many orders of magnitude larger than IRC, XMPP and Matrix taken together. You are doing a good job with promoting Matrix to nerds, and there will be _some_ value in being able to directly contact the French government (provided that they will allow federation from the public network, which I have a hard time imagining).

I think the only viable route today is to push for legislation (e.g. in the EU, in the context of ePrivacy / GDPR) that will force silo providers to open up their silos and to offer interop by means of standardized protocols. But even in this improbable case they will probably rather create their own rubber-stamped standards (remember Office Open XML) than follow what is already out there.

ge0rgon Graying Out

Direct Client Connections (DCC) became infeasible about 20 years ago with the proliferation of NAT routers. The workarounds (connection tracking and rewriting) never arrived for the masses.

ge0rgon Graying Out

Yes, large amounts of money can help rationalize working against your ideals, especially when there are always more potential engineer candidates to do the work that your conscience tells you not to do.

ge0rgon Graying Out

Pidgin essentially stopped supporting new XMPP features a decade ago. This includes multi-device support and many new convenience features (delivery receipts, file uploads). There are some plugins that might be able to compensate, but at significant effort.

OTR wasn't made for the multi device use case at all (and even OTRv4 is explicitly single-device). If you happen to log in with multiple clients, it will most probably confuse the other side's OTR plugin

ge0rgon Facebook to integrate the infrastructure for WhatsApp, Instagram and Messenger

Facebook got into trouble for opening data about users to its business partners. I'm sure this is not the same kind of "open API" that you would use to access and control your account and your interactions with the Silo. However, this kind of API will empower you to use a client that allows you to spend less time on Facebook, the opposite of their strategy.

ge0rgon Intro to hacking MicroSD cards (2013)

This is the 2013 presentation about firmware analysis / modification of the internal controller inside of uSD cards.

ge0rgon Approaching the kernel year-2038 end game

It only makes sense from a shortsighted "today's" perspective. What happens if there is another API change? Do you call the new new suffix _NEWER? _NEWNEW?

ge0rgon Happy Birthday, XMPP: 20th Anniversary of Jabber

I wish Pidgin would just disappear. It is absolutely unusable without all these plugins in a modern multi client world, and most users don't know they need them.

The delivery receipts issue is a decade old [0]! Libpurple is a mess to implement all the modern features, because it tries to support the baseline of so many different protocols.

[0] https://developer.pidgin.im/ticket/6940

ge0rgon Happy Birthday, XMPP: 20th Anniversary of Jabber

Hey Jeremie! It's really awesome to have you here!

I've tried to dig up some more historical background besides of the Slashdot announcement, but failed. Do you happen to have an old copy of the 1999 changelog / code base (maybe a backup of the CVS or SVN server), just out of historical interest. The archive.org history only goes back to around 2004.

Also it's really amazing how far you've been looking into the future back then...

ge0rgon Open Real Time Messaging System: Jabber (1999)

Twenty years ago, ICQ and AIM were two different, incompatible, networks, and AOL did everything it could to prevent third-party clients:

From http://www.linux-mag.com/id/902/ :

But AOL has always been adamant about not wanting their users’ screen names and their passwords going through any software that’s not controlled by them. It’s an understandable position. I don’t know if it gives them the right to try as hard as they do to block everybody.

From https://nplusonemag.com/issue-19/essays/chat-wars/ :

AOL was causing the client to look up a particular address in memory and send it back to the server. This was tricky, vastly trickier than anything they’d done so far. It was also a bit outside the realm of fair play: exploiting a security hole in their own client that our client didn’t have!

And they even used trademarks on terms like "instant messenger" and "buddy list" to fight competition: https://www.wired.com/1999/05/does-aol-own-buddy-list/

ge0rgon Open Real Time Messaging System: Jabber (1999)

My favorite is actually the NIH reproach at https://slashdot.org/comments.pl?sid=15607&cid=2048695 - somebody always tries to reinvent the wheel!

ge0rgon Slack closes account of an Iranian user living in Canada

I wouldn't subscribe to the "15 years ago" statement, but we have figured out mobile battery use pretty well, and the respective solutions are avialable in both server and client implementations. Have a look at [0] and [1] for (slightly biased but more detailed) elabortations.

simply declaring it a myth is, I suspect, unlikely to convince remaining skeptics

It's hard to provide specific counter-arguments to anecdotal evidence repeated since back when gtalk was a thing.

[0] https://gultsch.de/xmpp_2016.html

[1] https://wiki.xmpp.org/web/index.php?title=Myths#Myth_Three:_....

ge0rgon Researchers have significantly increased the scope of the Rowhammer threat

What measures can you take upon receiving such an alert? Shutdown the server? The reporting doesn't include the task / user causing the error, so you don't get anything actionable.

ge0rgon Show HN: Quicksy – Jabber with phone number verification and contact discovery

Some siloed messengers offer some subset of XMPP connectivity.

However, we need to differentiate multiple aspects here:

- does the messenger allow users to use an XMPP client? This was possible on Facebook messenger for a while but was discontinued.

- does the messenger allow users to talk to XMPP users on other servers? This used to be possible with GTalk, but only if you didn't install Hangouts and only if the other server allowed unencrypted communication (which they typically don't since at least 2013). It's possible with Cisco and was possible with Lync/Skype for Business, but only after convincing your domain admin to whitelist the remote server.

- is it using XMPP under the hood? WhatsApp used to, before they mutilated the protocol. https://xmpp.org/uses/gaming.html lists some online gaming platforms that are technically XMPP, but it doesn't really matter for the users.

Quicksy answers to all these questions with a clear "yes", giving its users (and their friends!) more choices than any other phone number based IM system.

ge0rgon Show HN: Quicksy – Jabber with phone number verification and contact discovery

JMP.chat gives you a new phone number that you use via XMPP, with Quicksy you use your phone number to automatically discover other users on the (federated) xmpp network.

ge0rgon Show HN: Quicksy – Jabber with phone number verification and contact discovery

This looks like a nice way to get your non technical friends onto the federated network, and shows that xmpp really isn't behind centralized silo messengers in functionality and usability.

ge0rgon Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

Indeed, it would be great to have a standalone recipe / how to for setting that up. From the scripts there is no black magic involved, except a tiny bit for the integration with LE certificates.

ge0rgon Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

Looks like this is similar to other self hosting projects like FreedomBone and NextCloud. It's great to see more tools to take back control over our data.

ge0rgon Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

What's the problem with leaking your IP address? If you host a website or any kind of API there, your IP is public anyway?

ge0rgon What is the revenue generation model for DuckDuckGo?

Do you have some hints on effectively using DDG, based on that experience?

ge0rgon Talking to the Mailman – Interview with Richard Stallman

I can't see how it is satire if it is a more fitting description to what the system is designed to do.

ge0rgon Messenger systems compared by security, privacy, compatibility, and features

We have the XMPP Compliance Suites 2018[0] providing an overview of protocol-level specifications that a modern client or server should implement, and there was recently a nice article[1] for some example use cases.

What is still missing is everything above the wire protocol level. The XSF, being the XMPP Standards Foundation, is guarding the protocols, and things like UX and client interoperability are considered as off-scope. However, there are people interested in these topics as well looking for fresh collaborators.

[0] https://xmpp.org/extensions/xep-0387.html

[1] https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-...

ge0rgon Converse 4 released

It's really nice to see this web based Jabber client making progress! Congratulations to the 4.0 release!

ge0rgon The People Who Grind Out Movie Trailers

It's really sad that you can't read this article on mobile Chrome without getting trapped into an annoying "you have won" ad page that also clears the browser history.

ge0rgon Slack Is Buying HipChat from Atlassian

OTR hasn't aged very well (it doesn't support asynchronous communication, multiple parties or multiple clients per party). For XMPP there is OMEMO, which is gaining traction (and is based on the Signal ratchet), but like with OTR, the forward secrecy it provides might be unwanted or even forbidden in corporate environments where you have retention policies in place. E2EE is great for private chats over an untrusted cloud provider, but really not a priority in enterprise environments.

ge0rgon Slack Is Buying HipChat from Atlassian

Customers with HipChat installed on their own servers will be able to use it for an extra few months or as long as two years, depending on the version.

Slack and Atlassian will make it easy for customers to move, but they won’t be forced to switch, Butterfield said.

So they are not forced to switch, but if they don't then their chat will cease to work?

ge0rgon EU fines Asus, Denon-Marantz, Philips and Pioneer $130M for online price fixing

It's funny how almost one hundred years after the Phoebus cartel[0], Philips is still participating in anti-competitive behavior. Apparently the invisible hand of the market is not so well suited after all.

[0] https://en.wikipedia.org/wiki/Phoebus_cartel

ge0rgon AI and Blockchain: An Introduction

This is a very interesting insight into how AI and blockchain are seen by VCs. I agree with IoT and AI being the next big things, but I fail to see how the blockchain fits into the picture.

The author linked the "blockchain is the worst possible database" idea, but this is a consequence of the design requirements, so making a "better performing" blockchain database won't solve the problem.

The ideas about a decentralized market for AI training data are interesting as well, but we have a hard time securing our local databases. If followed through, this will end up with malicious actors and buying up our personal data from these markets in bulk, and to blackmail us.

Maybe the tech will be developed in the next decades, allowing a remote AI to be trained on my data without exposing it to third parties, but I'm sceptical about the technical feasibility, and this will require significant up-front resources to get there.