Hacker News Reader

inahgaon AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

Sadly I'm not. Either way, how LLMs work mean that traditional software analysis tools are every bit as important as they were in the before times. This is why we see a lot of hype around LLMs and formal verification.

inahgaon AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis.

Use zizmor in CI https://github.com/zizmorcore/zizmor

    error[template-injection]: code injection via template expansion
      --> .github/workflows/jira_issue.yml:24:29
       |
    22 |         run: |
       |         --- this run block
    23 |           # Escape special characters in title and body
    24 |           TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")
       |                             ^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix

inahgaon Nashville uses eminent domain to block data center near zoo

I don't understand his point either. I used to work off of Diehl Road not too far from the CyrusOne DC[1] and it is anything but a prairie. It has greenery, but it's just the usual fake landscaping that all the industrial parks in Aurora, Bolingbrook, Warrenville, etc. do.

And there's counterexamples to the desolate office space... the Ace Hardware corporate office[2] I think is remarkably pleasant.

[1]: https://maps.app.goo.gl/rFgzVfWNBaGxpBNg7

[2]: https://maps.app.goo.gl/5EiQy5YUPengwDE18

inahgaon LAPD lets contract with surveillance giant Flock expire

> That Pookie can show a video from a flock camera showing him somewhere else is a massive boost to his civil liberties. Same with whatever poor sap gets beat by the cops.

Not even remotely. The US is already at the stage where citizens can be brutally murdered, have said murder filmed at multiple angles, and have the officers involved get away with it.

Your civil liberties are irrelevant when we can just redefine and expand what it means to endanger a police officer. Or have the officers bypass the judicial system entirely.

Camera footage will only be used against you, not for you.

inahgaon LAPD lets contract with surveillance giant Flock expire

If you hold police accountable, they respond by refusing to work. That's a problem that, at this time, has no solution.

inahgaon Removing the modem and GPS from my 2024 RAV4 hybrid

Tesla https://www.tesla.com/support/vehicle-firmware-prevent-autos...

Ford https://www.caranddriver.com/news/a70513450/ford-4-million-v...

GM https://www.themanual.com/auto/gm-brake-fluid-warning-recall...

I think Chrysler does it too, but I only find mention of the time they bricked a bunch of Wranglers with a bad OTA update.

Broadly I don't think it's hard to imagine a software update being safety critical if the software is used in a safety critical system.

inahgaon Removing the modem and GPS from my 2024 RAV4 hybrid

Has anyone experienced a case where they needed an over-the-air safety update/recall performed, but weren't able to because they removed the cellular modem?

I'd like to think failure to apply an OTA safety update would trigger a mail-out notification requesting you bring the vehicle into the dealer. But that's probably optimistic...

inahgaon WolfGuard: WireGuard with FIPS 140-3 cryptography

The ciphers used by WireGuard are not FIPS 140-3 certified. So you have to also change the ciphers, as is done in this project.

inahgaon Better to Skip a Year for Hardware Upgrades?

On the contrary, GP's warning saved my time and attention. For that I thank them.

inahgaon DNS-Persist-01: A New Model for DNS-Based Challenge Validation

You should persist certs somewhere. Otherwise your availability is heavily tied to LE’s uptime.

inahgaon How wolves became dogs

Mostly, if not entirely due to intentionally poor breeding practices. Who betrayed who?

inahgaon How Does Microwaving Grapes Create Plumes of Plasma? (2019)

Watching this classic channel may be safer https://youtube.com/playlist?list=PLU4IMu04MIlJgB6Aaj07q-5iX...

inahgaon I Want You to Understand Chicago

Sure, I don't mean this to arouse anger. I point it out for the Democratic primaries in March. https://ballotpedia.org/Illinois_gubernatorial_and_lieutenan...

inahgaon I Want You to Understand Chicago

If he doesn't, he needs to be forthright about it in his speeches and podcasts. "The ISP is disobeying my direct orders."

Until then, he bears responsibility for their actions.

inahgaon Software update bricks some Jeep 4xe hybrids over the weekend

I don't think the software hacking side of Wrangler mods is barren. e.g. https://www.jlwranglerforums.com/forum/threads/jeep-hacking-..., which IIUC has been commercialized into https://www.zautomotive.com/products/z_tzr_jlm.

I don't know that anyone has broken the head unit firmware though.

inahgaon Not all browsers perform revocation checking

For those (i.e. me) who were concerned that the cert wasn't actually revoked, it is.

https://crt.sh/?id=20924740030

    $ curl -s http://r13.c.lencr.org/105.crl | openssl crl -noout -text | grep -A1 899DE8
        Serial Number: 055B8B1F23D5BCF09DD8E9CAF8798F899DE8
            Revocation Date: Sep 10 16:00:16 2025 GMT

inahgaon Budget Car Buyers Want Automakers to K.I.S.S

2023 Jeep: I was able to remove the cellular modem from the head unit. Disconnecting the antenna was not effective (just reduces the range).

See e.g. https://sandsprite.com/blogs/index.php?uid=7&pid=462&year=20...

inahgaon Return of wolves to Yellowstone has led to a surge in aspen trees

Colorado, at least, provides several resources for minimizing and compensating wolf depredation.

https://cpw.widencollective.com/assets/share/asset/pzqhipzb1... (see Funding)

Cursory search shows that not just Colorado does this.

inahgaon My AI skeptic friends are all nuts

It's rather shocking for a company to admit to flaunting software licensing in public communications.

But this is not new https://fly.io/blog/wrong-about-gpu/

> At one point, we hex-edited the [NVIDIA] closed-source drivers to trick them into thinking our hypervisor was QEMU.

inahgaon You do not need NixOS on the desktop

What's been driving me batshit is when nixos-rebuild decides it wants to build from source. I just burned an hour the other day trying to update, and getting stuck because Nix decided my little old laptop needed to compile node.js from source. Had to trial-and-error remove packages to figure out which one was transitively pulling in node.js.

It turned out to be ansible... which is a pure python tool. Beats me.

There's also some cases where it wants to build Android Studio from source. I've just removed it and now run it in a VM.

I'm sure I'm doing it wrong, and I'm sure nixos-rebuild has a reason to build things from source, and maybe I'm not RTFMing hard enough. But good god, I just need my system to update.

inahgaon A $20k American-made electric pickup with no paint, no stereo, no screen

Darn, with removable doors and top, I thought this could be a Jeep killer. But no 4WD makes that a non-starter.

inahgaon DOJ will no longer prosecute cryptocurrency fraud

Something about first two links gives me Breencast vibes.

e.g. https://youtu.be/1gKcGrxZbFA

https://combineoverwiki.net/wiki/Breencast

inahgaon Kink and LGBT dating apps exposed 1.5M private user images online

I've flopped a few dating opportunities because I insisted on using Signal or iMessage before sharing pictures...

inahgaon The Practical Limitations of End-to-End Encryption

Signal on Android is reproducible https://github.com/signalapp/Signal-Android/tree/main/reprod..., so _theoretically_ the play store version could be monitored to detect tampering by Google (or whoever).

That is, if the reproducible build didn't constantly break https://github.com/signalapp/Signal-Android/issues/13565.

It also ignores the fact that the vendor could send updates targeted to specific devices.

inahgaon Mapping the University of Chicago's 135-year expansion into Hyde Park and beyond

> train

Hah, there's my only lament about Chicago: no pet-friendly public transit if you have a large dog. I don't really have the stomach for the loopholes either: service dog lies or carrying her in a duffel bag NYC subway-style.

inahgaon Mapping the University of Chicago's 135-year expansion into Hyde Park and beyond

Thanks for the tips!

inahgaon Mapping the University of Chicago's 135-year expansion into Hyde Park and beyond

> You can find pretty much anything there, the only thing I struggled with is I like the outdoors and there isn't good hiking (but Chicago actually has really good birdwatching in the city).

Lincoln Park north is not what I would call "good hiking", but I think it's nice for those who like the outdoors. Good for daytime walks, large beaches, dog beach, bird sanctuary, some small natural areas, lakefront trail (paved).

For good hiking, yes you'll have to drive out of the city.

inahgaon Jeep owners fed up with in-car pop-up ads

I brutally ripped the cellular modem out of my Jeep and have not had this problem since then.

See https://sandsprite.com/blogs/index.php?uid=7&pid=462&year=20....

It has the drawback of breaking the GPS and compass. Also I imagine any recalls that are fixed via over-the-air updates won't apply. Hopefully that never happens, because I don't want to have to try to explain to the dealer that I need them to apply the update locally.

inahgaon IBM completes acquisition of HashiCorp

IBM switched off Notes to Microsoft 365, maybe two years ago or so.

I only correct you because it's an even bigger indictment of Notes that IBM switched off of it.

inahgaon Dogs may have domesticated themselves because they liked snacks, model suggests

I don't think this is a rational feeling, but I can relate.

I've successfully trained my dog to be non-reactive towards squirrels/birds/etc. on walks. The other day she walked by a rabbit from within a few feet, and hardly gave it even a look. And I felt bad, as though I've suppressed her natural self and ability to be excited about such a thing. She's now pacified to live in my world.

An irrational feeling, because she's now at much less risk of being run over by a vehicle, but it was a feeling nonetheless.