HNHacker News
TopNewBestAskShowJobs

jf

8,604 karma · joined April 24, 2007

Joël Franušić

http://github.com/jpf https://mastodon.social/@jpf

Contact information: http://joel.franusic.com/contact

[ my public key: https://keybase.io/jfranusic; my proof: https://keybase.io/jfranusic/sigs/vA57YKepIse7lnJ6UT4aqHUOSImRjLPXXoFg3iQW5F0 ]

submissionscomments
jf··on Microsoft Confirms Password Deletion for 1B Users
Except in this case, the smart card generates a new key _per domain name_
jf··on Microsoft Confirms Password Deletion for 1B Users
An alternative viewpoint to consider is how much pain and suffering passwords cause large companies or identity providers.

One example: Large organizations often spend $1m/yr on password resets alone.

jf··on Microsoft Confirms Password Deletion for 1B Users
Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff"?
jf··on Ask HN: I don't want to code anymore. What else can I do?
I presume that you are familiar with it already, but in the off chance that you are not. Check out the Recurse Center
jf··on Y Combinator and Power in Silicon Valley
Not any more than you need to in any public forum
jf··on Perceptually lossless (talking head) video compression at 22kbit/s
I beg to differ. A Deepness In The Sky is the best sci-fi book ever.
jf··on LibLISA – Instruction Discovery and Analysis on x86-64
I've long wanted to have a way to see what actually happens inside a CPU when a set of instructions are executed. I'm pretty excited after skimming this paper as it looks like they developed a technique to automatically determine how the x86-64 instructions actually work by observing real world CPU behavior.
jf··on Zig is everything I want C to be
A Smalltalk VM: https://github.com/Zag-Research/Zag-Smalltalk
jf··on Why Login Security Sucks
WebAuthn and related variants
jf··on PHP is the new JavaScript?
Why choose between PHP and JavaScript when you can write code in CASSIS, a language that runs in the syntactical intersection of both languages?

For example:

  if (js()) {
   /* javascript */
  }
  else {
   /* PHP */
  }
https://github.com/tantek/cassis
jf··on Dynamicland 2024
I'm not sure if there's a source online as I learned about it from Otavio directly. The slightly longer story, as I recall it, is that their team basically built a "game" to help humans unshred documents, and was using that approach until Otavio happened to read about the printer dots on HN. He updated his code to take those into account and was astonished at how helpful they were.
jf··on Dynamicland 2024
Yes. Though not in the traditional way that we think of "pipe" working. A good example of this was the "zoom lens" in Omar Rizwan's Geokit: https://omar.website/posts/notes-from-dynamicland-geokit/
jf··on Dynamicland 2024
> You can't take a Cat from one program and a Dog from another program and have the dog interact with the cat. This is obvious in software - that's why we design APIs - but it's frustrating when all your programs exist in the same space

I also thought this, but learned that what I needed was an Alan Kay style "change of perspective".

The key for me was understanding the "wish" and "claim" concepts in Realtalk. In your example above, you would need to separate your "Dog" program into two programs: One that was simply a program claiming "I am a dog" and another that would encode dog behavior, something like "I wish that a bark sound would play when a dog is near a house" - then you'd leave it up to Realtalk to make that happen. Adding "Cat" behavior would mean adding two new programs: one to claim "I am a cat" and another "I wish that a meow sound would play when a cat is near a house". To make the "Dog" and "Cat" interact, you'd add a program that said "I wish that a growl sound would play when a dog is near a cat" and so on.

Another example that might help is how I learned this myself: I made a set of playing cards. What I ended up with was 52 pieces of card stock, each one had a program that was simply "Claim that I am card X" - and then I made separate programs the give those cards meaning. For example a program to give the cards a style would be something like "I wish that card 1 will have the Ace of Spaces printed on it, etc" and another program would be something like "I wish that the sum of all face values of the cards on this line is printed next to the line"

It took me several days to internalize this, but once I did things started getting fun pretty quickly. For example, I was able to make a program to "clone" a real world image onto a playing card by having Realtalk take a picture of a rectangle and then always project that image onto a particular card when it was face up. Because the cards just made claims about their identities, this let me separate the designs on the cards from the rules as well as add "training mode" programs to help teach basics. And they were all decoupled!

jf··on Dynamicland 2024
Woah! I never considered that until now. I'll bet you're right.
jf··on Dynamicland 2024
Ah, noted! With that in mind, did you know that those printer dots are what the team that won the 2011 DARPA Shredder Challenge used to win?

https://en.wikipedia.org/wiki/DARPA_Shredder_Challenge_2011

Fun fact: Otavio Good, who led the winning team, learned about the printer dots on this very site. As I recall, he said that the dots were like a map that let them reconstruct the shredded documents.

jf··on Dynamicland 2024
Correct, that doesn't work in the system as implemented. But my understanding is that there has been a goal from the start to _eventually_ get physical code editing to work. I recall hearing the researchers talking about wanting to eventually get handwriting recognition working, so you could edit code by hand.
jf··on Dynamicland 2024
I'm pretty sure that I mentioned the printer tracking dots to the researchers at the lab and certainly mentioned DataGlyphs. So they were aware of alternatives. The trick is to get a workable system with cameras that have the resolution to pick out those details from a dozen feet away, as well as a software stack that can recognize them at ~60fps.

The goal has always been to move away from the dots, you can see this in the progress report: https://dynamicland.org/2019/Progress_report/

That said, and this is purely my opinion, the system works well enough as it is, and there is so much fun stuff to build on top of what works, that it's hard to prioritize a better object recognition system over the myriad of other interesting things to be done.

jf··on A worker from Berkeley's Urban Ore has opened a museum celebrating wingnuts
If you’re in the SF Bay Area and like secondhand stores, you owe it to yourself to visit Urban Ore. It’s a secondhand store with a focus on building material. Things to check out include:

- a section for doors, if you want it, they have it

- the outdoor bathroom fixtures

- their tool section

I visit about once a year and enjoy seeing the weird things that accumulate there.

jf··on Visual explanation of SAML authentication (2020)
The main issue that I have with XmlDSig is that the signatures are stored inside of the document being signed. Because of that, you can’t properly implement the standard without writing enough of an XML parser to do the canonicalization needed to properly compute and verify the hashes used for signatures. In practice, this means you need approximately an entire XML stack just to hash some data, something that is a simple operation otherwise.
jf··on Visual explanation of SAML authentication (2020)
Remember to make sure your XML parser doesn’t fetch remote DTDs. You’ll also want to make sure that the code which validates the signatures in the SAML assertion reports to you which specific parts were signed. You will also want to validate the schema of the assertion. Also make sure to reject assertions which aren’t signed at all. Don’t forget to store the ID of the assertion to avoid replay attacks.
jf··on Visual explanation of SAML authentication (2020)
As someone with a decade of hands-on SAML experience, I highly recommend against implementing SAML. Use OIDC instead.

This article covers many of the reasons to avoid SAML: https://workos.com/blog/fun-with-saml-sso-vulnerabilities-an...

jf··on Visual explanation of SAML authentication (2020)
It’s hard enough to debug SAML as it is, I can’t imagine debugging artifact binding without having full control of both the SP and IdP.
jf··on North Texas community says crypto-mining facility brings never-ending noise
The idea that Texans don't like government regulations isn't really backed by evidence. For example, the Cato Institute ranks Texas #17 in terms of overall freedom versus nearby states like Arizona which ranks #4 and Nevada which ranks #5.

https://www.freedominthe50states.org/

jf··on A Gentle Introduction to SAML
You are 100% correct... SAML is one case where ignorance truly is bliss.
jf··on A Gentle Introduction to SAML
I regret learning nearly everything that I know about SAML.
jf··on A Gentle Introduction to SAML
Try implementing XMLDsig yourself and you'll quickly learn how awful it is. Aside from the other comments mentioned in these replies, one of the horrible things about XMLDsig is that it requires you to mutate ("canonicalize") the XML that is to be signed. Then, the signature is injected into the document that was signed ... to be removed by the verifier before it has to canonicalize the document, etc, etc
jf··on Introduction to Calvin and Hobbes: Sunday Pages 1985-1995 (2001)
This is the essay that introduced me to Krazy Kat and the main motivation for my project to find Krazy Kat Sunday comics in the public domain: https://joel.franusic.com/krazy_kat/
jf··on Mechanical computer relies on kirigami cubes, not electronics
I highly recommend that you read the book “Hieroglyphs: A Very Short Introduction” which I expect you will enjoy as much as I did: https://academic.oup.com/book/470

In short: Hieroglyphics were phonetic, but they eluded translation for centuries because only a small number of people could read and write them, and (importantly) the directions that the pictographs faced determined the direction that you’d read in.

My favorite fact from this book is that the hieroglyphic word for “cat” is the combination of the sounds for “me” and “ew”

jf··on I am using AI to drop hats outside my window onto New Yorkers
Thanks! I was one of the 10k and I’ve been a daily HN user for a long time!
jf··on A low budget consumer hardware espionage implant (2018)
The article has a section on that very topic: https://ha.cking.ch/s8_data_line_locator/#detection
← PreviousPage 3 of 27Next →