HNHacker News
TopNewBestAskShowJobs

jlokier

6,144 karma · joined October 23, 2018

Mail: jamie@jlokier.co.uk LinkedIn: https://linkedin.com/in/jlokier

Knowledgable & helpful person, available for hire :-)

I'm looking for more work, ideally on a consulting / freelance / part-time basis.

LinkedIn is better than email to make first contact if you'd like to talk, whether for work or just chat about something you liked here on HN! (I often miss interesting one-off mails among the deluge, and don't check it every day.)

I work 80% time at a funded stealth startup as hands-on tech lead, with zero-knowledge (ZK) cryptography, Bluetooth low energy (BLE), and peer-to-peer distributed systems, linking physical devices as well as the usual web stack. Can't say more, but it is intended to become open source. This a really fun and challenging project, with a great team! (It's not on my LinkedIn - stealth).

With my remaining 20% I am currently available and looking for software dev and/or tech leadership and/or business strategy consulting.

I'm versatile but develop mostly low-level or "system" software in C, C++, Go, Rust and Nim, with Linux as my main OS (but MacOS and Windows also). I have about 30 years professional dev experience over a wide range of systems, from embedded to supercomputers, Linux kernel, database engines, as well as GUIs, the web, and even games. Good at performance optimisation, debugging. Also good math & physics.

I've worked as an Ethereum core dev (EVM), so I know that environment well, especially improving EVM database speed, which is a critical factor! Currently my rabbit holes are ZK cryptography speed optimisation, and a novel fast database engine (neither B-tree nor LSM-tree, but with characteristics of both).

(ZK = zero-knowlege cryptography).

submissionscomments
jlokier··on V8 Garbage Collector
It stands for "Full Time Equivalent".

It's a measure of time spent working on something, to standardise comparisons of work capacity and acknowledge that it's not always full time, especially when aggregating the time from different people. One full time person = 1 FTE.

For example if you work 20 hours a week on project A and 20 hours on project B, then project A will count your contribution as 0.5 FTE while you're assigned to that project.

If you also have two other people working on it full timee, and a project manager working 1 day a week on it, then project A will count the contribution from all three of you as 2.7 FTE. (2.7 = 0.5 + 2 + 0.2).

jlokier··on Digital ID, a new way to create and present an ID in Apple Wallet
You make a good point.

In principle the police Wallet reader could have a function to virtually suspend the license, instead of physically confiscating your phone.

I wonder if they thought of that, and I wonder if police would use the option or confiscate the phone anyway.

jlokier··on Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
Unfortunately, while Asahi Linux runs fine on M1 and M2 with some missing capabilities, it doesn't run at all on M3, M4 or M5.

The M1 and M2 are still great laptops, so it's still a good experience if you're looking for a second-hand Linux laptop with Apple quality hardwre.

jlokier··on Android developer verification: Early access starts
> In most cases, F-Droid couldn't know either.

F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app.

Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open source requirements limit the damage the new developer can do.

https://f-droid.org/docs/Inclusion_Policy/

https://f-droid.org/docs/Anti-Features/

jlokier··on Time to start de-Appling
> UK citizens are largely ok with that, as evidenced by them keeping to elect such governments

I don't think that's true. I think plenty of UK citizens do want better privacy rights and data protection, as evidenced by the very large petition against national ID cards for example.

It doesn't win the vote because it's not the most important factor when it comes to voting, because there are bigger issues people care about more.

Many people are somewhat despondent, due to economic decline, ever-increasing pressures and poor prospects for so many people. There's no choice of party which simultaneously supports privacy rights at the same time as other things most UK citizens appear to care about more, which can also survive the intense tactical voting pressure under the FPTP voting system. Consider that most people who voted Labour in the "landslide" last election appear to have done it tactically to "get the Tories out".

So issues like privacy which aren't at the top of people's concerns, end up not having much influence over voting decisions.

The Lib Dems and Greens are the nearest to that, imho. Of the major parties, they seem the most aligned with privacy rights in their DNA, as far as I can tell.

Reform are getting some political benefit from talking up privacy at the moment, and they stand a real chance of winning next time. But I doubt very much if Reform would ever implement real privacy rights. I think it's just opportunistic dodgy politician talk in their case, and that real privacy isn't in their DNA at all, because they don't believe in universality of human rights. They are openly eager to remove the Human Rights Act and strip many people of those rights, after all. Strong online privacy also clashes with one of their core missions, to find and deport vastly more people than before; privacy clashes with that both on grounds of investigative capabilities, and on grounds of principles and rights. I could imagine Reform trying to offer strong privacy only for approved citizens, alongside mandatory reporting on other users, but the contradictions in that are too much.

jlokier··on Time to start de-Appling
From the article, I'm suprised at this unusual twist:

> What about that second TCN?

> On the 1st of October, the Home Office issued a second TCN against Apple for the same as before, but only for _British citizens’_ data. World-leading!

> Those who follow my work know that this phrase made me spew a double barrel of Glaswegian swearing. British citizens’ data, as opposed to British users’ data? The dividing line here is not e.g. being located in the UK or having registered an account here, but what it says on your passport? How is Apple going to know that, much less roll it out? (/s)

> Did Apple just publicly state that they’re going to be removing a security layer and adding a nationality check layer?

> We don’t know.

> We don’t know because as with the first TCN, that information only became available in the public domain due to someone leaking it to the media. That’s all there is to know. Everything else is confidential and NCND. There is nothing else to say because nothing else is known. If someone who did know something was sitting across from me right now, and they told me, they would be committing a crime.

Does that mean my non-UK citizen friends who are resident in the UK now have better privacy rights than UK citizens in the UK? Does it mean it's better to remain only a resident, than to attempt to obtain citizenship in the long run?

jlokier··on Tongyi DeepResearch – open-source 30B MoE Model that rivals OpenAI DeepResearch
Currently I don't use vibe coding or even code assistants, so I can't speak to how the battery fares when doing that sort of thing. I don't know how much or how intensively they need to run the underlying LLMs.

For chatting with LLMs via ollama, I've seen total power usage go to about 50W (on an M3 Max) while the LLM is active, which is about 3x-4x power usage compared to just idling with browsers and editors open.

So I'd estimate about 2-3 hours of continuous LLM use on battery. Because I have enough RAM spare, at least there's no need to keep shutting down and reloading models.

I haven't really pushed it to find out how long they run on battery, as I haven't used LLMs all that much.

I'm more interested in the underlying operations of how they work, investigating novel model architectures and techniques, and optimising performance, than actually using them as an end user :-) Similar to how I enjoyed writing game engines more than playing games :-) Maybe I'll get into using them more in future.

jlokier··on X.org Security Advisory: multiple security issues X.Org X server and Xwayland
Obviously not, Fil-C doesn't prevent or claim to prevent all security issues in modern code either.

But the issues Fil-C prevents, it prevents in very old programs compiled with it , if they compile, just as much as current programs.

At compile time, certain patterns that are accepted in standard C are rejected by Fil-C, and the source code has to be changed if you still want to compile the program. At run time, Fil-C prevents memory-related security issues by reliably detecting invalid memory reads and writes that are usually part of an attack and producing deterministic behaviour, sometimes terminating the program, instead of letting the attacker take advantage of undefined behaviour that happens to compile to something the attacker can use. Both of those features work just as well with very old C programs as current ones.

jlokier··on Simple trick to increase coverage: Lying to users about signal strength
With Three UK, I have not 1 bar but 5 bars!

Until about March this year, it was excellent and I used it as my home broadband. 60MB/s down, 20MB/s up on a good day. Much better than any ADSL I'm able to get.

Since March, from about 10:30am until 5pm some days, and late evening other days, there is no working data, and occasionally no working voice, despite the 5 bars.

It's working fine until then, and then it just stops completely, fading over the course of maybe 10 minutes. This happens all 7 days of the week.

The working theory is congestion at the base station. That's consistent with the occasional 6 minute ping times that I've measured, and more usual 20-30 second ping times, when anything gets through at all.

Still shows 5 bars. Three's coverage map says it's good here. Just can't use it.

jlokier··on X.org Security Advisory: multiple security issues X.Org X server and Xwayland
One of the use-cases of Fil-C is to prevent security issues in old C code that's much older than Fil-C itself.
jlokier··on Tongyi DeepResearch – open-source 30B MoE Model that rivals OpenAI DeepResearch
I use a Macbook Pro with 128GB RAM "unified memory" that's available to both CPU and GPU.

It's slower than a rented Nvidia GPU, but usable for all the models I've tried (even gpt-oss-120b), and works well in a coffee shop on battery and with no internet connection.

I use Ollama to run the models, so can't run the latest until they are ported to the Ollama library. But I don't have much time for tinkering anyway, so I don't mind the publishing delay.

jlokier··on The Impossible Optimization, and the Metaprogramming to Achieve It
The original is 'lex', written in 1975 by Mike Lesk and Eric Schmidt.

Yes, that Eric Schmidt, CEO of Google.

1987 was the clone, 'flex' :-)

It did "compiling the regex into regular code, which can then be optimized by the compiler" before the C programming language as we know it was created. I think 'lex' was compiling regex to C before the C language even had 'struct' types, 'printf' or 'malloc'.

jlokier··on Programming with Less Than Nothing
Having written a small amount of SKI, long ago, I think you can avoid having to visualise the entire graph by reasonably modular approach: naming functions and then using those as building blocks.

Names are very helpful. You get to design your own high-level world, but then you get to use it. Since you can replace any name by its definition in SKI, it's easy to expand, just very tedious.

jlokier··on FSF announces Librephone project
I agree, and I've done similar to this for mobile banking successfully. This is the way :)

However, I expect at some point they'll insist on biometric authentication.

That'd exclude people who can't use the biometrics. But one bank (Revolut) told me that they're dropping customers who don't have a passport or driving license in the UK, for KYC reasons that they said they were required to follow, despite there being a large number of people without either.

So I expect banks to have no problem excluding <x% of people in a discriminatory way, if they can find an excuse, eventually.

jlokier··on FSF announces Librephone project
No, with some banks you can't.

I tried calling Starling Bank in the UK when my phone screen stopped working. I assumed they would have basic phone banking service.

They told me no. The only service they could provide over the phone was registering a new device to resume access to bank services via their mobile app.

Although they have a web banking service, which can he used on a desktop, that requires authentication via the mobile app too. It's not TOTP, it's their own thing.

As I needed to make a transaction, I had no choice but to buy a new phone in a hurry.to do it.

Several people suggest switching banks and credit card services, but I've found that not so easy. I have accounts with several banks (some for business), and 3 of them require use of their mobile app. Most credit card services I use also require use of their app. Some have websites that hand you over to the app at some point in the flow.

jlokier··on FSF announces Librephone project
> You check your banking apps multiple times each day with the frequency and unpredictability expected from messaging apps?

I almost do, yes. Life's complicated, I use several bank and credit card services a day. I'm not at home at suitable times for my banking needs. And payments for purchases sometimes require confirmation in real time via phone app.

> If not that frequently or unpredictably then you could just plan to use your laptop for banking some time during the day.

I used to do that years ago back when it was an option.. But these days, 3 banks I use (two for business) require using their mobile app to authenticate login on a laptop browser. There's no other option.

One of the card apps I have to use often won't even run when Android developer mode is enabled, which is quite annoying.

jlokier··on Software update bricks some Jeep 4xe hybrids over the weekend
I agree with you, and I can also easily imagine how this comes about with the software teams or contracted companies that do the infotainment system being completely different people from those who design the rest of the car.

But it was still a surprise to see this a lack of attention to detail in the infotainment system, in a car where the brand itself is all about giving a lot of attention to detail in everything else that's visible, the comfortable mouldings, pleasant interior lighting, different kinds of cup holders, nice place to wirelessly charge your phones, seat controls and sensors, etc.

jlokier··on Software update bricks some Jeep 4xe hybrids over the weekend
I recently did some testing of Bluetooth connecting an Android phone to a reasonably new Mercedes. Being a "luxury" brand, you'd think the Mercedes would have good infotainment software, but I found at least 5 bugs in the GUI in about 1 hour of testing, and I wasn't particularly looking for bugs, just testing what I thought would be the happy paths for Bluetooth connection. The Android phone, on the other hand, did its job flawlessly.

I know software and embedded systems well enough to know all of the issues I found were preventable, if anyone cared.

The car seems well built in many other respects. It doesn't look like the problem is engineering ability.

(See also: Set-top box GUIs that are painfully slow to render menus, scroll, search etc. on hardware that I know can render 10-100x faster when programmed to.)

jlokier··on Software update bricks some Jeep 4xe hybrids over the weekend
Wikipedia has a section about this. They call it soft bricked vs hard bricked, according to the difficulty of restoring device function and how the broken state presents. Even hard bricked is usually recoverable with appropriate tools, so it is a spectrum.

https://en.wikipedia.org/wiki/Brick_(electronics)#Soft_brick

jlokier··on Software update bricks some Jeep 4xe hybrids over the weekend
> - You're basically at risk of your Jeep going limp (power loss, unable to safely make it to the shoulder) and being stranded on the highway, even as I write this.

This seems extraordinary.

I was going to ask: Are you really saying they kill the vehicle's power system, effictively the engine, while the vehicle is being driven on the highway?

But no need to ask, the article says yes, that's what is reported:

> Instead, the failure appears to occur while driving—a far more serious problem. For some, this happened close to home and at low speed, but others claim to have experienced a powertrain failure at highway speeds.

Wow.

jlokier··on Smartphones and being present
For perspective, I pay USD $17.33 a month for unlimited 5G data - in the UK, in GBP, so really £13. Low quality home broadband costs more than that, and is slower, but with better latency.

I've tested the unlimited claim, and they really do let you download terabytes. All my local LLMs are downloaded over mobile data.

So yes, in my experience it's inverted over here. Mobile bandwidth is the cheapest if you can get a good deal and you're in an uncongested area with a good signal. Unfortunately that's not a combination I've found to be reliable anywhere I go, especially over the last 6 months. But the price is good!

jlokier··on Ask HN: Abandoned/dead projects you think died before their time and why?
For me the progression was Slashdot -> Kuro5hin -> HN.
jlokier··on OpenGL: Mesh shaders in the current year
Recent versions of macOS will provide either an OpenGL 2.1 context or OpenGL 4.1 context, depending on how you request the context. You have to request a 3.2+ core profile, and not use X11 or the glX* functions.

From macOS 10.7 to 10.9, you'd get an OpenGL 3.2 context. As OpenGL 4.1 is backward compatible to OpenGL 3.2, it's fine that the same code gets OpenGL 4.1 now.

Basically, macOS will provide an "old" API to programs that need it, which is fixed at 2.1, and a "modern" API to programs that know how to ask for it, which has settled at 4.1 and is unlikely to change.

OpenGL 4.1 is harmonised with OpenGL ES 2.0. Almost the same rendering model, features, extensions, etc. On iOS, iPadOS etc you can use OpenGL ES 2.0, and no version of OpenGL (non-ES), so my guess is that's why macOS settled on OpenGL 4.1. Both platforms offer the same OpenGL rendering features, but through slightly different APIs.

But if you request 4.1 over GLX (which uses X11/Xorg/XQuartz), the X11 code only supports OpenGL 2.1. For example, if you're porting some Linux code or other GLX examples over.

Unfortunately, the GLX limitation is probably just due to the Xorg-based XQuartz being open source but only minimally maintained since before OpenGL 3.2 was added to macOS. XQuartz uses Xorg and Mesa, which have all the bindings for 4.1, but some of them are not quite wired up.

jlokier··on QUIC and the end of TCP sockets
Their point is that's a sad design choice, caused by firewalls forcing QUIC to take a first-class TCP-like internet protocol and wrap it with encrypted headers inside UDP for the sole purpose of preventing firewalls from blocking it or making it break in myriad subtle ways. Even QUICs unencrypted header parts are designed to be difficult for intermediate network equipment to track and modify, because of their history of making other protocols over TCP unreliable by doing this.

SCTP is another high-performance protocol that provides many of the same network and performance features as QUIC, but it has been around for ~25 years. It was widely implemented. It was even in Linux 2.4 and available for Windows XP and MacOS. WebRTC in browsers can use SCTP, which makes sense (it predates QUIC) but is actually a bit of a problem if you want wide interoperability with WebRTC.

But despite SCTP being around and widely implemented, and doing many of the good things QUIC does, SCTP was never widely adopted, nor seriously considered for HTTP, mainly because of the problem of firewalls. (And to be fair, some operating system API limitations).

Basically, if TCP were invented today, it could not be deployed succesfully over much of the internet unless it was wrapped in UDP and encrypted.

UDP-with-encryption is now playing the role that the IP protocol is supposed to play, just because too many firewalls block nearly every IP packet that doesn't have type TCP or UDP. If UDP is used but without encryption for a popular protocol, eventually too many firewalls deep-packet-inspect that UDP protocol too, and do the same kinds of blocking, tampering or making protocols break.

This sad problem is called protocol ossification. As Google's AI puts it: "QUIC is the first IETF transport protocol to deliberately minimise its wire image to avoid ossification.". See also https://en.wikipedia.org/wiki/Protocol_ossification and https://http3-explained.haxx.se/en/why-quic/why-ossification

There are some downsides to QUIC's ossification resistance. I did some work for a mobile equipment manufacter who adaptively manage the queues for multiple TCP streams from different users and different applications from the same user, to help ensure a better, fairer and lower-latency experience. QUICs properties made it difficult to measure what's going on at the protocol level, forcing the queue management to use crude statistical estimators instead, which don't work well on bursty protocols.

jlokier··on Ask HN: What's your experience with using graph databases for agentic use-cases?
Among other things, some graph DBs are designed to perform the equivalent of "with recursive", filtering by attributes as you chase links and/or calculating statistics over subgraphs, more efficiently than SQL databases.

If you're just pulling up a tree of comments on an article using parent-child relations, SQL will be fine, though for query latency you might be better off with a "flat list" article-comment relation instead and recovering the tree structure after fetching the comments.

jlokier··on Ask HN: What is nowadays (opensource) way of converting HTML to PDF?
Last time I explored this, Firefox rendered thin lines in subtly bordered tables as thick lines, so I had to use Chromium. But back then Chrome did worse at pagination than Firefox.

So I used Firefox for multi-page documents and Chromium for single-page invoices.

I spent a lot of time with different versions of both browsers, and numerous quirks made a very unpleasant experience.

Eventually I settled on Chromium (Ungoogled), which I use nowadays for invoices.

jlokier··on SSH3: Faster and rich secure shell using HTTP/3
I've just looked at the OpenSSH source, and I agree it should be configurable. That seems like an easy patch if you wanted to do it.

Or, better but more difficult, it should track the dynamic TCP window size, from the OS when possible, combined with end-to-end measurements, and ensure the SSH mux channel windows grow to accomodate the TCP window, without growing so much they starve other channels.

To your second point, you can't do data dropping and retransmission for mux'd channels over a single TCP connection. After data is sent from the application to the kernel socket, it can't be removed from the TCP transmission queue, will be retransmitted by the kernel socket as often as needed, and will reach the destination eventually, provided the TCP connection as a whole survives.

You can do mux'd data dropping and retransmission over a single UDP connection, but that's basically what QUIC is.

jlokier··on SSH3: Faster and rich secure shell using HTTP/3
> I think it's silly that this exists. They should just let TCP handle this.

No, unfortunately it'snecessary so that the SSH proocol can multiplex streams independently over a single established connection.

If one of the multiplexed streams stalls because its receiver is blocked or slow, and the receive buffer (for that stream) fills up, then without window-based flow control, that causes head-of-line blocking of all the other streams.

That's fine if you don't mind streams blocking each other, but it's a problem if they should flow independently. It's pretty much a requirement for opportunistic connection sharing by independent processes, as SSH does.

In some situations, this type of multiplexed stream blockiing can even result in a deadlock, depending on what's sent over the streams.

Solutions to the problem are to either use window-based flow control, separate from TCP,, or to require all stream receive buffers to expand without limit, which is normally unacceptable.

HTTP/2 does something like this.

I once designed a protocol without this, thinking multipexing was enough by itself, and found out the hard way when processes got stuck for no apparent reason.

jlokier··on Yt-dlp: Upcoming new requirements for YouTube downloads
> How on earth can it be that terrible [>20 minutes] compared to Deno?

QuickJS uses a bytecode interpreter (like Python, famously slow), and is optimised for simplicity and correctness. Whereas Deno uses a JIT compiler (like Java, .NET and WASM). Deno uses the same JIT compiler as Chrome, one of the most heavily-optimised in the world.

That doesn't normally lead to such a large factor in time difference, but it explains most of it, and depending on the type of code being run, it could explain all of it in this case.

QuickJIT (a fork of QuickJS that uses TCC for JIT) might yield better results, but still slower than Deno.

jlokier··on Restrictions on house sharing by unrelated roommates
> Voters, in aggregate, want rents to fall and prices to rise, roughly divided by renters vs owners

I assure you, a lot of people in the UK want house prices to fall too. There are too many renters who don't want to be renting, and the proportion is increasing. They wish they could buy instead, but can't either because of price, inability to save enough for a down-payment as fast as prices rise (while large rent rises impede their saving or even drain it, and incomes rise more slowly than prices), or inability to obtain a mortgage despite a history of consistently paying more than a mortgage in rent. For the latter category, who can afford a mortgage but can't get one, and are already paying more in rent, their main problem isn't income or price, it's the tighter restrictions on mortgage availability since the 2008 financial crises. But they would still like lower prices.

← PreviousPage 4 of 34Next →