HNHacker News
TopNewBestAskShowJobs

jorams

4,053 karma · joined August 1, 2014

You can reach me at hn at joram dot io
submissionscomments
jorams··on Mullvad VPN: Banned TV Ad in the Streets of London [video]
> I think the American First Amendment would obliterate this government body and probably the whole institution if it was ever tried.

This is not a government body, Ofcom is the relevant government body, like the US has the FCC, which you are aware of. The FCC has broadcasting rules. Your supreme court upheld their ability to issue sanctions for violations. This has lead to broad self-censorship by US broadcasters in much the same way the UK has Clearcast, to the point that censorship of stuff like swearwords is a recognizable trait of quite a few TV shows exported from the US. In the past year there have been multiple cases of censorship in response to threats from the FCC and other government bodies, much worse situations than banning an ad. The first amendment has done nothing to stop this.

I'm not here to defend the UK, they have some extremely scary laws on the books, but the US is really not notably different on this front.

jorams··on Moldova broke our data pipeline
I'd go so far as to say any implementation that doesn't conform to RFC 4180[1] is broken and should be fixed. The vast majority of implementations get this right, it's just that some that don't are so high profile it causes people to throw up their hands and give up.

[1]: https://datatracker.ietf.org/doc/html/rfc4180

jorams··on Ghostty – Terminal Emulator
It helps a bit that it's written in Zig, but its primary differentiating feature in the sea of terminal emulators is that it's created by mitchellh, who is kind of a celebrity in some circles.
jorams··on Ghostty – Terminal Emulator
That's a bold claim not backed up by your source.

You can turn on a feature documented as allowing the terminal to be controlled by escape sequences, but then output of programs can control the terminal! Whoop-de-do.

jorams··on WolfSSL sucks too, so now what?
BearSSL is really cool, but it claims beta quality with the latest release in 2018, doesn't support TLS 1.3, and hasn't seen meaningful development in years. It's averaging about 1 commit per year recently, and they're not big ones.
jorams··on Bunny Database
This documentation page[1] seems pretty clear. One primary at a time, any number of read replicas that automatically proxy writes to the primary, when compute scales to zero the data is in object storage and a new primary can spin up elsewhere.

[1]: https://docs.bunny.net/database/replication

jorams··on Netbird – Open Source Zero Trust Networking
According to their ToS all customer accounts registered on or after September 3, 2024 are signed on to a US company, so no they're not doing what's necessary to keep US hands off the data.
jorams··on The history of C# and TypeScript with Anders Hejlsberg [video]
There are plenty of languages in that niche you could be using. OCaml, Haskell, F#...
jorams··on A macOS app that blurs your screen when you slouch
After a different company detected it, figured out what it did, and reported it to Apple. The app was notarized on November 17, screenshots in the researchers' post are from December 16. That's a month of fully notarized distribution.
jorams··on Tell HN: Bending Spoons laid off almost everybody at Vimeo yesterday
That lists 6 products, Wikipedia lists 13. I can only guess at the reason for deciding what to put there, but it does say

> Some of our most popular products

jorams··on Cloudflare zero-day: Accessing any host globally
What a frustrating article. There was an interesting bug here. It's trivial to explain. It's not a zero-day, this was fixed months before disclosure. Most of the article is basically: "Imagine you were running software with horrific security holes behind this WAF. We even made some examples. It had a flaw. If your entire security posture depended on this WAF, imagine how much damage could have been done. Imagine if AI were involved!"
jorams··on Linux boxes via SSH: suspended when disconected
> So if the web app went a month with no visitors it would cost nothing (except for the file storage fees)?

Yes that's the idea. The public URL for a sprite is served by a (free) load balancer. The sprite is normally suspended, gets resumed when a request comes in, then suspended again. Not sure on the exact timeouts, they probably don't suspend immediately after a response is sent.

jorams··on Linux boxes via SSH: suspended when disconected
> and more when used.

Sprites pricing is based on usage, not reserved capacity, so depending on what you're doing I think it can actually be cheaper than Shellbox. You'll have to stay below 1GB of memory and have the CPU be mostly idle, which I'm not sure common workloads will.

jorams··on Remails: A European Mail Transfer Agent
An alternative is Lettermint[1] which has much more gradual (and slightly lower, but with a less generous free plan) pricing. It's also pretty new (I think it launched last year) but more fully featured. I haven't used it but it seems good.

[1]: https://lettermint.co/

jorams··on We rolled our own documentation site
Basically every Elixir package's docs include search based on Lunr, as it's included by default by ExDoc[1]. It's quite good.

[1]: https://hexdocs.pm/ex_doc/

jorams··on Why is the Gmail app 700 MB?
> I had no idea common apps used to be just 10-30 MB. But are now hundreds of MB.

This is Android, but: 13+ years ago I had an HTC Desire. I was really struggling with internal storage space, regularly uninstalling and replacing apps just to be able to update others. Eventually I moved to custom ROMs just because they allowed some apps to be moved to the SD card.

I remember the biggest problem was WhatsApp, which was somehow over 7MB while the average was closer to 1MB.

On my current phone WhatsApp is 231MB. It's still pretty high up in the rankings, but doesn't stand out, and barely any apps are below that then-huge 7MB.

jorams··on I can't upgrade to Windows 11, now leave me alone
> I'm self-employed and my entire suite of software is either windows or apple only

Sounds like we're back to self-inflicted then? If you're self-employed supposedly that software suite was your decision.

jorams··on Perl articles are being memory wiped from Wikipedia
The relevant part is before that:

> This article is exclusively sourced on primary sources.

The Google search is the nominator looking for an alternative source that could make it notable, something earlier editors failed to establish.

jorams··on Carolina Cloud – One third the cost of AWS for data science workloads
Approximately nobody charges for basic incoming traffic to a server. If it's not mentioned it's free.
jorams··on Google de-indexed Bear Blog and I don't know why
That's a different situation. The browser decides what to do depending on the situation and what was communicated about caching. Sometimes it sends a request to the server along with information about what it already has. Then it can get back a 304. Other times it already knows the cached data is fine, so it doesn't send a request to the server in the first place. The developer tools show this as a cached 200.
jorams··on Google de-indexed Bear Blog and I don't know why
You get a 304 because your browser tells the server what it has cached, and the server says "nothing changed, use that". In browsers you can bypass the cache by using Ctrl-F5, or in the developer tools you can usually disable caching while they're open. Doing so shows that the server is doing the right thing.

Your LLM prompt and response are worthless.

jorams··on KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support
> idk how we can blame some JavaScript and html inside Firefox causing a Wayland crash as Discord’s fault

I don't see anyone talking about a Wayland crash, it's about Discord crashing.

jorams··on Show HN: A WordPress plugin that rewrites image URLs for near-zero-cost delivery
> It mentions CDN77, BytePlus, CacheFly, CloudFront, and Fastly. Is what Cloudflare provides in a different market segment?

Cloudflare's pricing is "free until you get a message from the sales team that it's time to pay up". That's impossible to compare to anything else, so yes effectively a different market segment.

jorams··on Fifteen Years
> Maybe I missed something but I don’t know what you’re quoting or paraphrasing.

They're quoting the image's title text. Every xkcd comic has one. On desktop you can see it by hovering over the image. On mobile you generally can't see it. You can go to the mobile subdomain (https://m.xkcd.com/3172// and tap on the image, then it pops up underneath.

jorams··on Verifying your Matrix devices is becoming mandatory
Discord does not do any sort of end-to-end encryption. All messages are fully readable and writable by Discord. Discord decides whether you are who you say you are, and all clients trust whatever Discord says to be trustworthy.
jorams··on I finally understand Cloudflare Zero Trust tunnels
> after frustration with Tailscale in environments where it couldn’t properly penetrate NAT/firewall and get a p2p connection, I decided to invest some time into learning something new: Cloudflare Zero Trust + Warp

...which doesn't even try to get a p2p connection. Instead you always get the thing you didn't want. If you're okay with that you could've just ignored how Tailscale connected those devices, that's kind of the point. You've also in the process converted your entire security model to Cloudflare's idea of "Zero Trust" which involves 100% trusting Cloudflare.

The rest of the blog post is fine, but the motivation is honestly baffling.

jorams··on FFmpeg to Google: Fund us or stop sending bugs
> this does possibly have a chilling effect if the vendor's CNA refuses valid vulns

The Linux kernel went in the opposite direction: Every bugfix that looks like it could be relevant to security gets a CVE[1]. The number of CVEs has increased significantly since it became a CNA.

[1]: https://lwn.net/Articles/978711/

jorams··on Time Immemorial turns 750: The Medieval law that froze history at 1189
I found this article rather... unsatisfactory. So the statute introduced the concept of "time immemorial". Except it sort of didn't, it just introduced a limit that later came to be referred to as "time immemorial". It also doesn't call it anything like "the barrier between that which we know and that which we don’t.", but indeed it does mark a point after which oral history is no longer enough. On page 100 in the linked translation:

> That in conveighing a Descent in a Writ of Right, none shall presume to declare of the Seisin of his Ancestor further, or beyond the Time of King Richard, Uncle to King Hentry, Father to the King that now is;

It then says the term "time immemorial" was actually introduced by the Prescription Act 1832 (and links to a different page than it is talking about) but that actually says:

> Whereas the expression “time immemorial, or time whereof the memory of man runneth not to the contrary,” is now by the Law of England in many cases considered to include and denote the whole period of time from the Reign of King Richard the First, whereby the title to matters that have been long enjoyed is sometimes defeated by shewing the commencement of such enjoyment, which is in many cases productive of inconvenience and injustice;

Perhaps I'm misunderstanding this since it was written almost 200 years ago, but this reads like it is describing an existing term in use in the Law of England. A term supposedly introduced at some point between 1275 and 1831 to describe the limit introduced by the Statute of Westminster 1275.

The included history is interesting, but how this date turned into the concept of "time immemorial" remains unknown.

jorams··on FBI tries to unmask owner of archive.is
Yeah I just read through it and it presents absolutely no useful evidence. They establish that there's a developer in the US called Denis Petrov. They establish that someone involved with archive.today is often referred to as Denis Petrov. Then they make some weird leaps to conclude that they must be the same person.

A quick web search suggests Denis Petrov is not at all a unique name. Just because on of them wrote a somewhat feminist thought on a blog in 2004 and another forked a... let's call it "satirically feminist" project on GitHub does not in any way suggest they are the same person.

jorams··on Two billion email addresses were exposed
This seems to include details from a Spotify data breach in or before early 2020 that, to my knowledge, was never reported on. They did have other, similar issues that year.

Reporting from the time seems to all be about one or multiple leaks/attacks involving:

- Credential stuffing with data from other breaches

- A leak of data (including email addresses) to "certain business partners" between April 9, 2020 and November 12, 2020.

On April 2, 2020 somebody logged in to my Spotify account (which had a very weak password) from a US IP address. This account used an email address only ever used to sign up to Spotify years earlier, and the account had been unused for years by that point. I changed the password minutes later. A few hours after that Spotify also sent an automatic password reset because of "suspicious activity". At no point have I ever been notified by Spotify that my data had been leaked, though it obviously had, and now said email finally shows up on HIBP.

← PreviousPage 3 of 28Next →