HNHacker News
TopNewBestAskShowJobs

jiveturkey

2,457 karma · joined February 16, 2018

submissionscomments
jiveturkey··on PS5 Relapse Exploit
they aren't in the business of selling consoles (duh). they are in the business of selling games. jailbroken consoles can run pirated games ...

consoles are sold at a loss, best information i can dig up is that this is still true today, even after all the volume.

jiveturkey··on Three Days in August: What a DDoS Attack Exposed in Our Network
> services that can be used for amplification attacks, are they constantly getting patched to prevent the latest iteration of attack type?

unfortunately, no.

jiveturkey··on Three Days in August: What a DDoS Attack Exposed in Our Network
is it? i would write a sentence like this on my own. i guess informed by the thousands (or hundreds, at least) of PMs I have read or contributed to. the same material LLMs would have trained on.
jiveturkey··on Three Days in August: What a DDoS Attack Exposed in Our Network
indeed, this (A vs CNAME) is nonsense. I applaud this provider's transparency but they missed a 4th gap: inadequate network security expertise. Two of the 3 gaps identified are perhaps not baseline but they are well understood hygiene. They shouldn't have had to learn these things as a result of an incident. (the 1st gap, not monitoring customer network blocks, is very understandable and i find no fault there.)

and then up the stack a bit, they are confused about DNS' role in attack mitigation, at least generally speaking. perhaps there is something specific to their own DNS setup where this made a difference. they should just strike that part of the PM entirely.

that said, their reaction time is amazing. this would have included live troubleshooting during an ongoing incident! criticism aside, i wouldn't hesitate to use them if I wanted EU service.

jiveturkey··on Real-time feedback: My closing move in every interview
seems quite stilted.

instead of "i'd like to give some feedback, may I?" at the end, the interviewer should just ask the damn question in real time. "that description is very high level. that is great for an external summary, when the decision is already made and you want to communicate, not discuss. so i appreciate that. can you go into more detail and justify your choices, as if for an audience of peers and for discussion?"

a good interview should be an interactive exercise, not a one way explanation from the candidate. even LC/DSA type rounds should always find the candidate asking for clarifications, asking if they are on the right track is this what you are looking for, should i be attacking this a different way, etc.

and i would never give unsolicited positive feedback. even when you are the final decision maker, other rounds may uncover weak spots and there may not be a consensus to hire. by giving the positive feedback you confuse the candidate and make a no-hire result even worse. leave it to the recuiter/HR to do that.

as an interviewer i always mention whether i will recommend them for hire (if it's a yes) and that's it. iff asked i provide critical feedback. as a candidate i always ask for critical feedback, which gives me the chance to sharpen any answer when the interviewer doesn't do a good job on asking for what they really wanted.

jiveturkey··on Obscura: VPN that can't log your activity
vp.net is far from first, and is hot garbage.
jiveturkey··on Samsung accidentally freezes its smart fridges with a software update
inkjet printers to not print the tracking dots. it's laser printers that do it.
jiveturkey··on Shutting down our public encrypted DNS
Even ECH isn't that helpful. ISP still sees the IP addresses you connect to. Even when non-dedicated IPs are used, I'd be surprised if a quite basic traffic analysis (say, bytes transferred on first visit) wouldn't identify the domain.

VPN providers at the tier of Mullvad should be precise about this stuff -- I think it's more than just a nitpick, considering the audience. oh god did I just use an emdash.

Note that you need some flavor of secure DNS to enforce ECH. The protocol is designed to be downgradable.

jiveturkey··on Apple caught off guard by AI demand for Mac Mini and Mac Studio
and there's a goddam ad at the start of every apple TV show, and macOS forces ads on you via the SETTINGS app! (both such ads are for other apple products ... still, it's an ad)
jiveturkey··on California lawmakers unanimously pass Linux exemption from age-verification law
What's to prevent Apple from making iOS and macOS free to "copy, redistribute, and modify"? The OS is free already, and the platform does cryptographic signature verification before allowing its installation. macOS already automatically finds local caching servers, which amounts to redistribution capability baked in.

They can just claim that the user is free to turn off SIP and "modify" the binary bits, or that kernel extensions amount to modification.

jiveturkey··on California lawmakers unanimously pass Linux exemption from age-verification law
I think you're misreading it. It doesn't ban Linux from providing age collection and verification. It makes it a choice, rather than mandatory.

I would expect that Linux users want access to age-verified apps just as much as other users, so such a signal will be available.

Also, you're being overly pedantic on the language used. It transfers liability away from the service, more easily allowing operation in about half of the states. "age verification" is a fine lay description.

jiveturkey··on New Mac Studio with M5 Max and M5 Ultra
https://www.youtube.com/watch?v=8okiCCZk7U8
jiveturkey··on iCloud+ Hide My Email addresses will remain on icloud.com
But all 3 of those use cases, plus privacy, can be addressed with word.salad@bigdomain.com. So you may as well get the privacy bit in there.
jiveturkey··on Wi-Fi 8 is the first wireless upgrade in years that isn't chasing speed
> all APs identify as the same BSSID, and decide between them who answers a client

That is decidedly not a solution. Neighboring APs necessarily need to be on different channels, to avoid Co-Channel Interference (CCI). An AP doesn't answer just on BSSID but also on a specific channel.

jiveturkey··on Georgia police officers fired after Flock camera misuse
> weren’t authorized

this is easily solved with current technology, if they had an incentive to do so.

besides firing folks that get caught, flock themselves should be brought to court.

jiveturkey··on _for-sale DNS records
I've recently bought many domains (1000+ over the last year). A few of them (the more valuable ones) all had TXT records for `@` (the root) that had for-sale info. This new record is just a TXT record anyway, proving the point that the interested buyer can quite easily learn of a domain for sale with existing mechanisms.

Also, for domains that are just "parked", not in current use, obviously the parking page can just have a for-sale banner. This is exceedingly common.

> Enquiries that would have been welcome never arrive, and the ones that do arrive are indistinguishable from spam.

Laughable misrepresentation.

jiveturkey··on Celld: Self-hosted, distributed Durable Objects
claim is that very many things are not needed, but they are. they are just provided by the layer beneath (S3). so isn't correctness highly dependent on s3 correctness? was s3 built for that, vs just plain durability? for example, would it be just as reliable with minio?

i would prefer a thing that was more self-contained, not dependent on a black box service layer underneath.

much apologies if i just have a poor understanding.

jiveturkey··on Discovery Loop
It's too bad they would follow the letter of the law, and not state the salary anyway. I see that as a negative indicator, regardless of offer size.
jiveturkey··on Oxide Computer raises $445M (SEC Form D)
Well that isn't that much. $1M / month feels more like it.
jiveturkey··on Oxide Computer raises $445M (SEC Form D)
I think the idea is that, in fact, you do.

Not one-time cost, but rather TCO.

jiveturkey··on Online ad giant Adform was hacked, proving once again why ad blockers are needed
indeed. the post may as well be, javascript must be disabled.
jiveturkey··on Worse on Purpose
How is Snap-On approved and Proto is on the watchlist?

Proto >> Snap-On IMHO. Both in raw quality and in value.

And while Craftsman may have changed significantly even before Sears' demise, there are still some excellent tool lines within the brand.

jiveturkey··on Politician reads AI prompt during assembly
That is the video title, but I think it should be paraphrased here to be more correct given our highly technical audience. The politician is actually reading an unedited AI response, which includes "editors notes" or maybe you could call it meta-content.
jiveturkey··on A shell colon does nothing. Use it anyway
the truncation is a poor example.

- it creates the file if it does not exist, not merely truncate. as a tutorial kind of blog post this incomplete description matters IMO.

- it would work the same without the colon (similar for default variable assignment examples). we generally strive not to have "extra" things, like useless use of cat.

- educationally it's useful to demonstrate that redirection, like parameter expansion, works before the command executes (the null command in this case), but the article doesn't explain that at all!

otherwise i <3 this article. some uses of colon i had never thought of or seen before. like file truncation, not sure i'd use them but it was cool to see them.

jiveturkey··on Don't verify email addresses by sending spam to them
looks like a response to https://news.ycombinator.com/item?id=48445834
jiveturkey··on 10Gb/s Ethernet: switching to a Broadcom SFP+ module
> DACs are copper, and they're happy.

Well come on. GP really means category cable (twisted pair copper) is not happy at 10Gb distribution lengths (so-called horizontal cabling, although in a home it may span multiple floors without IDFs). That's kind of obvious context.

DACs are not category cable; they are twinax, short, and bulky.

jiveturkey··on Stop Using JWTs
JWTs can do that (delegate) and such capability is already well defined.
jiveturkey··on Lies we tell ourselves about email addresses
entropy check, for one
jiveturkey··on Lies we tell ourselves about email addresses
> TL;DR: Don't overthink it, just send a verification email.

pretty bad advice, if taken only as written, without adding more flavor on top.

the major email providers will penalize you if you generate too many undeliverable emails. thus, if you just send a verification email without any pre-validation, it's pretty easy to get into a DoS situation where current/valid users don't get important email sent to them, or that email is significantly delayed, plus incur huge operating cost to resolve the problem.

some form of rate limiting is needed, plus IMHO it's better to use a verifier service or your own heuristic or ML model to test for email validity including valid but fake/spammy/disposable addresses.

sorry, but we are way past the point of being able to have nice things, esp. when we're talking about email.

the "lies" part of the content is great. people do assume all those wrong things. however the TLDR is just wrong, and potentially harmful.

jiveturkey··on HP re-releases classic computer science calculator: The HP-16C
oooh. i have an original. it doesn't have the 'Collector's Edition' etching. Does that make it a fake?
Page 1 of 34Next →