Hacker News Reader

j_son Datomic Cloud

> 4. It seems totally reasonable (and arguably the smartest thing to do) for Datomic to stay with a closed source model.

It is 100% understandable / practical / reasonable, yes. It is the same to recognize using Datomic technology as a core part of a technology stack involves some degree of additional risk, which grows as dependencies increase on its unique capabilities.

j_son System Bus Radio: Transmits AM radio on computers without transmitting hardware

http://microbit.org/guide/features/#light

reversing the LEDs of the screen to become an input, the LED screen works as a basic light sensor

(only the very tiniest bit related, for the BBC micro:bit)

j_son Datomic Cloud

The similarities to FoundationDB (a unique closed source database technology acquired by Apple, no longer publicly available) encourages additional caution.

Apple Acquires FoundationDB | https://news.ycombinator.com/item?id=9259986 (2015)

I poked around for a few minutes trying to find any assurances Datomic offers their customers should they be acquired, but couldn't even find the current EULA accessible online (older versions didn't seem to mention anything).

https://www.datomic.com/datomic-pro-edition-eula.html (https://web.archive.org/web/20160310175126/https://my.datomi...)

  <Error><Code>AccessDenied</Code>

j_son System Bus Radio: Transmits AM radio on computers without transmitting hardware

For the semi-serious there is a pre-made filter "temporarily unavailable" (2018-01-15) for purchase: Raspberry Pi QRP TX Shield for WSPR | https://www.tapr.org/kits_20M-wspr-pi.html

the harmonics are filtered by a LPF, and the broadband noise is filtered by a BPF [...] a buffer amp is provided for isolation. This also provides a boost to the TX signal

And this project ties in an RTL-SDR for receiving: https://github.com/ha7ilm/qtcsdr mentioning AM/NFM/WFM/LSB/USB [...] although NFM/WFM works as expected, the AM/SSB modes need a much higher level of filtering

j_son System Bus Radio: Transmits AM radio on computers without transmitting hardware

Or take the rails completely off (5 KHz-500 MHz // FM,AM,SSB,SSTV,FSQ): https://github.com/F5OEO/rpitx

I have a „Hörmann“ garage door opener. For a long time, I want to use my phone instead of the original sender. Therefore, I thought to run a raspberry and send the signal from there.

I recorded the signal with HackRF One as .wav, the problem here is that HackRF records with a sampling rate much higher than 48kHz (by default it is 10MHz!). So one has to downsample the recorded file, which I did with Matlab (downsample(signal, „fs_of_record/fs_for_rpitx“)). The resulting .wav signal is now send at 433MHz (either my garage door listens their too, or 2nd harmonic works?!)

src: https://github.com/F5OEO/rpitx/issues/50

j_son Datomic Cloud

> (However, this is off-topic for this submission specifically.)

I think it's on-topic for a database that (in my barely informed understanding) is famous for never deleting anything!

j_son Mono and WebAssembly – Updates on Static Compilation

Investigate a possibility to support JSX | https://github.com/bridgedotnet/Bridge/issues/808

Bridge.NET translates C# to JavaScript, but JSX is not currently supported.

j_son Crooked Style Sheeding – Webpage tracking using only CSS

Against an Increasingly User-Hostile Web | https://news.ycombinator.com/item?id=15611122 (2017Nov:1307 points, 502 comments)

#oneofus https://hn.algolia.com/?query=13226170&type=comment (click a 'comments' link on the search results, then 'parent')

I've connected similar sentiment here for about a year now; I've appreciated mention of several helpful tools in this thread.

j_son Crooked Style Sheeding – Webpage tracking using only CSS

> The fanciest tracking trick is

I feel like this changes all the time; I was recently surprised to discover 'TLS Client Channel ID' (my nomenclature is a bit fuzzy - an RFC for automatic client certs "for security") and would love to learn more about the extent of its current implementation in Chrome.

https://news.ycombinator.com/item?id=15753648

>londons_explore: In Chrome, it also uses the TLS Client Channel ID, which is a persistent unique identifier established between a browser and a server which (on capable platforms) is derived from a key stored in a hardware security module, making it hard to steal. Ie. if you clone the hard drive of a computer, when you use the clone, Google will know you are a suspicious person, even though you have all the right cookies.

https://en.wikipedia.org/wiki/Transport_Layer_Security_Chann...

http://www.browserauth.net/channel-bound-cookies

j_son Jitsi: Open-Source Video Conferencing

Very granularly: simple tools like the Windows Task Manager Performance tab's Ethernet Throughput graph can provide enough of a clue that a network connection is suffering.

There are many utilities that show this info in useful form in the system tray; perhaps some would be able to superimpose it on top of the video conferencing software (like OnTopReplica).

j_son Ask HN: What's the recommended method of adding authentication to a REST API?

Separately: client certificate authentication is apparently great for "Internet of Things" (buzzword alert!) device authentication, so some of the rough edges may be worn off as things move forward.

j_son Ask HN: What's the recommended method of adding authentication to a REST API?

I've been experimenting with using the server's public SSL key as a client certificate to authenticate self-hosted and cross-server web service requests since the cert should be available at runtime in common enterprise setups yet incentives align to keep it well-secured.

I would appreciate pointers to any open source libraries demonstrating best practices and/or promoting this approach, specifically protecting against replay attacks and race conditions that come up as the cert is renewed (much more often - thanks Let's Encrypt!).

j_son Ask HN: What's the recommended method of adding authentication to a REST API?

SSL client authentication usually winds up authenticating physical devices similarly to SSH keys, but there is near zero infrastructure simplifying/protecting/distributing a single software certificate for an individual user (especially non-technical users!) across multiple devices -- and this is really complicated by mobile devices. (Enrolling a new cert on every machine is an exponential management nightmare.)

SSL client authentication is widely used by the US military on smartcards requiring additional hardware readers: https://en.wikipedia.org/wiki/Common_Access_Card. AFAIK using a smartcard doesn't work reliably on Mac without installing 3rd-party software. The difficulties of usage in practice has spawned a cottage industry of commercial software and support, like http://militarycac.com.

I assume companies selling end user hardware tokens like YubiKey would love to see client certificate authentication become more usable, but initiatives like FIDO U2F seem to be gaining momentum instead.

j_son Ask HN: What's the recommended method of adding authentication to a REST API?

Definitely depends on timeline; PAST is a reasonable recommendation gaining momentum as best practice. The recent Show HN annoucement discussed many caveats of authentication tokens:

Show HN: PAST, a secure alternative to JWT | https://news.ycombinator.com/item?id=16070394 (2018Jan:361 points,137 comments)

j_son Jitsi: Open-Source Video Conferencing

A discussion two weeks ago pointed out that much of the hate Atlassian endures from developers towards their JIRA product is employer-inflicted:

>nunez: JIRA is a really nice product, but one's experience with it heavily depends on who "owns" it

>wwalser: the hellish existence [...] where JIRA comes up [is] because of one of three things:

· Your admin(s) set it up once and hasn't bothered to iterate on those workflows

· The business mapped their autonomy stripping processes onto JIRA intentionally [...]

· You're on an instance that is serving too many people with too few resources

source: How Atlassian Built a $10B Growth Engine | https://news.ycombinator.com/item?id=16052743 (2018Jan:226 points,170 comments)

j_son Skia: an open source 2D graphics library

Similar situation to the freetype/harfbuzz all-but-Microsoft/Apple (open source) monoculture.

I'm interested to understand more about how some categories of software libraries don't foster multiple strong open source alternatives, while others do.

j_son Ask HN: How do I prepare for an interview for AMZ/GOOG/APL/FB?

There is a Discord started by a small group on Twitch who have streamed mock interviews (mostly last summer): https://discord.gg/ndFR4RF

Example: https://www.youtube.com/watch?v=tdmXDjXz26c

j_son Dropbox Files Confidentially for U.S. IPO

Evolving the Dropbox Brand | https://news.ycombinator.com/item?id=15393684 (Oct 2017, 67 comments)

> mugsie: Wow. that is (from my perspective - but only mine) terrible.

> supernintendo: This is the worst UX I've seen in a long time. Not only that, it's visually garish.

> chrissnell: That typeface is just dreadful.

j_son Signal partners with Microsoft to bring end-to-end encryption to Skype

They're hiring: https://news.ycombinator.com/item?id=16054356

j_son Dropbox Files Confidentially for U.S. IPO

> Dropbox has been willing to get their hands dirty in their pursuit of user-friendliness since day one

https://news.ycombinator.com/item?id=13742251

Props to those for whom this finally pays off!

j_son Ask HN: What do you use/do for keeping your eyes healthy

Easing Eye Strain with the Right Lenses (2012) | https://news.ycombinator.com/item?id=15373992

Exercising for Healthier Eyes | https://news.ycombinator.com/item?id=7480946

Save your eyes, start using f.lux | https://news.ycombinator.com/item?id=5036590

#eyehealth

j_son Ask HN: What's your cloud storage option?

Seconding YouTube -- better than losing video.

j_son In Tucson, subsidies for rainwater harvesting produce big payoff

http://water.state.co.us/SurfaceWater/RainwaterCollection/Pa...

> 110 gallons of precipitation [...] can be collected and stored

With additional restrictions.

j_son Notes from the Intelpocalypse

This is the first time I've seen this suggestion; it is something that could be done relatively easily for systems that otherwise have no updates/mitigations.

If performance is better some variant of this (auto-scaling dedicated cores) may even become the default solution rather than all the other workarounds! Bare metal hypervisors should get their own core(s) too.

Is anyone already doing this? (Qubes, etc.)

j_son iMac Pro's T2 chip

How has [edit] T1/T2 device driver support worked out in practice so far for Linux and less-popular alternative operating systems on the new hardware?

https://github.com/Dunedan/mbp-2016-linux (T1) not working: audio, suspend/hibernation. 2/6 models working: WiFi

I'm probably most interested in hearing more about OpenBSD support, I'm not finding much recent info.

j_son Notes from the Intelpocalypse

IIRC, the GCE security white paper mentioned alarms triggered by ROWHAMMER, another hardware design defect. Is it possible to reliably detect any of this year's new attacks?

j_son Techniques for Factoring Numbers in Your Head

ReCurta: Our goal is to build the first Curta calculator since 1972 | https://news.ycombinator.com/item?id=16035091

j_son Yes, Amazon Echo Is an Ad Machine

Can you point to what you consider the current best option?

j_son Intel Confronts Potential ‘PR Nightmare’ With Reported Chip Flaw

Thanks for summarizing. Does anyone have time to link to more on the "side-channel leaking kernel address information into userland via JavaScript" ?