Hacker News Reader

gunson Flock Wants a Closely Surveilled World with No Exit

Rehnquist anticipated but unfortunately did not prevent the abuse of the third party doctrine back in 1983.

“Respondent does not actually quarrel with this analysis, though he expresses the generalized view that the result of the holding sought by the government would be that "twenty-four hour surveillance of any citizen of this country will be possible, without judicial knowledge or supervision." But the fact is that the "reality hardly suggests abuse," If such dragnet-type law enforcement practices as respondent envisions should eventually occur, there will be time enough then to determine whether different constitutional principles may be applicable.” — United States v. Knotts, 460 U.S. 276, 284 (1983)

https://www.law.cornell.edu/supremecourt/text/460/276

gunson Ghostty compiled to WASM with xterm.js API compatibility

https://github.com/mozilla-firefox/firefox/blob/FIREFOX_143_...

  # Use 17 for Ctrl, 18 for Alt, 91 or 224 for Meta, 0 for none.
  - name: ui.key.accelKey
    type: uint32_t
  #ifdef XP_MACOSX
    value: 224
  #else
    value: 17
  #endif

  // user.js
  user_pref("ui.key.accelKey", 91);

gunson Ghostty compiled to WASM with xterm.js API compatibility

You could use Firefox and then set the accelerator key to Super, changing all application bindings to use Super instead of Control. This is my setup and it’s great.

gunson Visualization 'demonic' face distortions in a case of prosopometamorphopsia

Reminds me of “Flashed face distortion effect”:

https://en.m.wikipedia.org/wiki/Flashed_face_distortion_effe...

https://youtu.be/VT9i99D_9gI?si=QHhzR00tib3ZuX-5

gunson That people produce HTML with string templates is telling us something

> People keep forgetting to sanitize inputs, for example. Does that render input sanitization a broken idea?

Possibly. You could prevent careless use of unsanitized inputs with a type system. Fail-safe designs should be more common.

gunson Unpredictable abilities emerging from large AI models

This is what Stephen Wolfram concludes in a recent article about ChatGPT:

> The specific engineering of ChatGPT has made it quite compelling. But ultimately (at least until it can use outside tools) ChatGPT is “merely” pulling out some “coherent thread of text” from the “statistics of conventional wisdom” that it’s accumulated. But it’s amazing how human-like the results are. And as I’ve discussed, this suggests something that’s at least scientifically very important: that human language (and the patterns of thinking behind it) are somehow simpler and more “law like” in their structure than we thought.

https://writings.stephenwolfram.com/2023/02/what-is-chatgpt-...

gunson The oldest privesc: injecting careless administrators’ terminals using TTY push

This attack also doesn't work if you `exec su lowpriv_user` since there is no parent shell.

gunson The availability of text generators will force positive changes to education

Essay writing unconsciously reinforces one’s opinion on a topic. This is an excellent tool for intellectual development when the student is free to argue any sensible position. Unfortunately, teachers often require students to choose orthodox positions, and thus essays become a primary tool for indoctrination.

Cheating has no place in an academic institution, but machine generated essays are an interesting way for students to avoid enforced compliance.

gunson Twilio cutting 11% – Letter from CEO [pdf]

> Layoffs like this can have a more pronounced impact on marginalized communities, so we were particularly focused on ensuring our layoffs – while a business necessity today – were carried out through an Anti-Racist/Anti-Oppression lens.

You are mistaken. The letter is quite clear.

gunson Permissive forwarding rule leads to unintentional exposure of containers (2021)

> In the above example how is someone going to send traffic to 172.17.0.2:80 through the Docker host from a box on a different network than the Docker host?

The attacker and host will generally need to be on the same network so that the attacker's packets are not dropped because they are addressed to a non-routable private IP address.

You could access the containers at 106.12.52.111 if you were in the same network (e.g. 106.12.52.0/24) and the packets did not have to traverse a router.

> Also is this still exploitable if you reject everything at the iptables level before you start using Docker?

Yes. Docker appends the FORWARD chain with custom rules that explicitly forward traffic to published ports.

gunson Permissive forwarding rule leads to unintentional exposure of containers (2021)

Docker users on the Mac are not affected by this issue, but they should be aware that the "Automatically allow downloaded signed software to receive incoming connections" option in the firewall settings must be unchecked in order to block incoming connections to container ports published to 0.0.0.0.

This is necessary because Docker Desktop for Mac is presumably signed by Apple.

gunson Permissive forwarding rule leads to unintentional exposure of containers (2021)

Publishing ports to '*' is commonly done to allow Mac and Windows users to access containers through their browsers.

The macos firewall is able to block connections to these exposed sockets but:

1. The user has to explicitly turn on the firewall since it is off by default

2. The option "Automatically allow downloaded signed software to receive incoming connections" must be unchecked because Docker Desktop is signed by Apple.

I don't use a Mac, but all of the developers that use Macs at my company either did not have their firewall enabled or did not realize that connections to Docker Desktop were whitelisted.

gunson Arbitrary file write vulnerability in GNU gzip's zgrep utility

Original author of password-store was Jason Donenfeld (of Wireguard fame), and it was indeed well-written.

gunson Stamos says the US must ‘come together to protect’ democracy from misinformation

> I am not against conservative people and also not against people with different views. … It becomes a problem when some of those people can't tell the difference between truth and lie.

Perhaps we should create camps that educate these people on political issues.

gunson Tabs vs. spaces and other holy wars

The problem is that most programmers do not bother to make whitespace visible, so tabs-for-indentation-spaces-for-alignment inevitably leads to a mess of mixed tabs and spaces.

I personally use tabs-for-indentation-spaces-for-alignment in my personal code, but I think I'd lose my mind if I tried to mandate it for a public or team project without a standard code formatter like gofmt.

gunson A list of ways to “Break the Internet” for the 48 hours before the FCC vote

> [EDIT] No, this is not a charitable view of someone's potentially pure motivations. But after a few dozen iterations of the same thing again and again, you stop being charitable. Sorry.

falcolas, I was going to ask something similar to Doreen had she not posted first. While I can understand why you might assume that these posts are intended to derail and deceive, I think it's more parsimonious to believe that these HN posters are genuinely looking for discussion and enlightenment.

None of the posts you provided seem sinister. The only thing shared between them is that the posters are hesitant to throw in their support without a detailed argument befitting a complicated issue like net neutrality. An explanation like the following (battleforthenet.com):

    What is net neutrality? Why does it matter?

    Net neutrality is the principle that Internet providers like
    Comcast & Verizon should not control what we see and do online.

is insufficient to someone looking for something more comprehensive. If anything, the FUD and tribalism¹ surrounding this issue are clear signals that the underlying truth is probably quite complicated.

¹ From battleforthenet.com:

    We are Team Internet. We support net neutrality, freedom of speech.

    They are Team Cable. They want to end net neutrality, to control & tax the Internet.

gunson A list of ways to “Break the Internet” for the 48 hours before the FCC vote

> TL;DR: Someone, at this point, who claims they have never "understood" net neutrality and wants a "thoughtful discussion" is lying to us in an attempt to derail discussions.

This is not a charitable opinion. Reading old threads on NANOG¹ has convinced me that net neutrality is more nuanced and technical than the "people vs big-ISP" narrative advanced by campaigns such as the OP. If anything, the reddit and battleforthenet bandwagons have created a hostile environment for actual debate.

¹ AFAICT, the majority NANOG opinion on net neutrality is that it doesn't actually address the underlying issue that prevents natural competition in the ISP market.

gunson Tree Style Tabs Extension Ported to Firefox 57

Thanks for this tip! Private browsing mode causes the tab bar to reappear (though the tabs are still hidden), so I found that the selector #TabsToolbar works even better.

Also, the large, bright sidebar header can be hidden with the #sidebar-header selector.

Combining those, we have:

    #TabsToolbar, #sidebar-header { visibility: collapse !important; }

gunson Golang SSH Security

> PGP tooling sucks (especially in gmail, but really everywhere)

GPG integration doesn't suck in Mutt.

gunson The Real Secret to Asian American Success Wasn't Education

> But the greatest thing that ever happened to them wasn't that they studied hard, or that they benefited from tiger moms or Confucian values. It's that other Americans started treating them with a little more respect.

It seems strange to ignore the possibility that one led to the other.

gunson In Iraq, I raided insurgents. In Virginia, the police raided me

> It may have to do with knowing anyone could own and possess either legal or illegal firearms.

While this may have an influence, it's important to remember that police officers are also trained to be wary of knives:

https://www.youtube.com/watch?v=J_KJ1R2PCMM

You can't totally disarm a population, so there are diminishing returns on this front.

gunson When Solid State Drives Are Not That Solid

The 840 EVO joined the club with firmware EXT0DB6Q, which itself is a nasty little hack around a fundamental design problem with the tightly packed NAND cells.

Linux 4.0.5 ships with the patch linked above, but for a while you had to roll with a kernel built from source.

EDIT: The blatant file corruption issues only manifested after updating to firmware EXT0DB6Q.

gunson Getting Organized with Org Mode

http://github.com/jceb/vim-orgmode

I suppose an Emacs user will find it anemic, but I use it happily every day.

gunson Don't run 'strings' on untrusted files

ldd actually executes the program being probed; it is not a static analyzer. It's only safe if you trust the program in the first place.

From my /usr/bin/ldd:

    try_trace() (
      output=$(eval $add_env '"$@"' 2>&1; rc=$?; printf 'x'; exit $rc)
      rc=$?
      printf '%s' "${output%x}"
      return $rc
    )
    …
    # If the program exits with exit code 5, it means the process has been
    # invoked with __libc_enable_secure.  Fall back to running it through
    # the dynamic linker.
    try_trace "$file"

gunson Don't run 'strings' on untrusted files

Crap, so if `objdump` is likely vulnerable to overflows, and `ldd` is a simple bash script ripe for abuse¹, is there a safe and easy way to determine dynamic library dependencies in an executable?

¹ http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

gunson Why Atom Can’t Replace Vim – Learning the lesson of vi

> There might as well be no concept of "words" or "lines" in a seasoned lisp programmer's mind, there's only sexps and forms

Forgive me for plugging my own project, but vim-sexp¹ provides exactly this abstraction as Vim text-objects, which in turn may be composed with _any_ of the operations in Vim.

S-expressions as text-objects is an amazing marriage of ideas. For example, the sexp text object can be used equally as an argument to eval, yank, delete, change, select, move, and every other operator, builtin or user-defined, each optionally accepting a count. After that, the whole operation can be repeated on a new S-expression with a simple tap of the repeat command. Because Lisp forms are so regular, these actions are precise and highly reliable.

¹ http://github.com/guns/vim-sexp

gunson [dead]

Pfft, what is philosophy? The natural sciences had almost completely robbed it of its intellectual validity by the mid-19th century, and this advance continues to this day. All that's really left to philosophers is vague discussion about morals and politics, and even these subjects are not safe from the scientific method.

I gave up on the subject (after a long obsession with it, and a couple years of study at university) after reading David Hume's crystal clear presentation of the problem of induction. What a devastating attack on philosophy as a whole! What can you depend on without absolute certainty? It looks a lot like Bayesian priors, and a lot like science.

gunson Bzr is dying; Emacs needs to move

And happily for git users, the git-hg plugin makes maintaining a git mirror of the vim hg repo very convenient:

https://github.com/cosmin/git-hg

Submitting patches upstream is also not a problem as Bram Moolenaar only accepts patch files on the dev mailing list.

gunson My Dinner With NSA Director Keith Alexander

No, this issue neither falls on the "left" or "right"; it is better framed as the tension between central authority vs personal liberty. Both progressives on the left and conservatives on the right ask the government to regulate and control different aspects of society.َ†

George Washington was widely praised for disbanding the Continental Army after dispelling the British, and also declined a third term as President despite unflagging adoration from the public.

Times have changed, and some of this idealism has perhaps been lost to pragmatism over the years, but this is the golden legacy that the General and the other officers of the Executive are willfully squandering in the pursuit of a few terrorists.

† Hence the old joke that progressives want the government in their business but out of their bedroom, and conservatives want government out of their business, but in their bedroom.