HNHacker News
TopNewBestAskShowJobs

kayfox

1,398 karma · joined July 29, 2013

submissionscomments
kayfox··on ICEBlock handled my vulnerability report in the worst possible way
> While I think an update to the Apache version is a good idea, this is a very low quality report.

It's still a report, which should be handled with seriousness and professionalism. What that app developer did was neither.

kayfox··on American Airlines flying empty Airbus A321neo across the Atlantic 20 times
American Airlines already has around 450 Airbus aircraft, its not news that they are training their Airbus trainers on a new route.
kayfox··on Man found dead at Burning Man
>> There is a lot of police bodycam footage on YouTube

As far as I know there is only police bodycam footage from one incident in 2022 involving Hannah Hoekstra and participant the police were insisting on interviewing even though they did not want to be interviewed.

Can you link to bodycam footage from other incidents?

kayfox··on Chicago has the most lead pipes in the nation
There are lead free primers, they are slightly less reliable, but they are out there and a lot of the "eco" ammunition has them.
kayfox··on Chicago has the most lead pipes in the nation
In addition to Federal Syntech there is Speer Lawman, which is a bullet type called TMJ or Total Metal Jacket. Lawman has lead free primers. There is a green box variant called RHT that does not use lead in the bullets.
kayfox··on Airbus A320 Poised to Overtake Boeing 737 as Most-Delivered Commercial Airliner
> That was the whole point of MCAS, to make the plane fly as-if it were an older model, despite the significantly different aerodynamics.

MCAS was implemented to make sure the control forces increase going into a stall, this is a requirement in the regulations. Without MCAS the control forces would drop on the way into a stall, which is an issue that would prevent certification of the aircraft.

kayfox··on Final report on Alaska Airlines Flight 1282 in-flight exit door plug separation
As with all but the first few 737s, it was assembled at Renton. The door plug was installed in Wichita by Spirit Aerosystems and there were issues with rivets in the surrounding structure that Spirit removed the plug to correct in Renton.

As a result of this Boeing is now refusing to sign off on fuselages with defects found at Spirit to be transported to Renton. And also Boeing will be buying back Spirit, which had been spun out of Boeing by the McDonall-Douglass management that took over Boeing when McDonall-Douglass bought Boeing with Boeings own money.

kayfox··on National Airspace System Status
https://www.fly.faa.gov/ois/?legacy=true
kayfox··on The Pyrex Glass Controversy That Just Won't Die (2019)
This is ancedata, but the article says all pyrex cookware made after 1998 used soda-lime glass, but I do have an amount of pyrex cookware that appears to be made of borosilicate that I purchased between 2005 and 2013ish. I base this on the older pyrex having a clear and un-colored consistency that matches my Corning PYREX labware (also used in the kitchen) and the newer stuff having a green tint to it that matches other soda-lime glass.

Personally I suspect that they phased out borosilicate glass in pyrex cookware between 2006 and 2009 and the lag in my ancedata is from slow stock turnover at the local supermarket. This would line up with the exploding glass incidents cited in the article.

What may be a more plausible explanation to the exploding pyrex mystery is the proliferation of marble and other cut rock countertops. These countertops have a very high thermal mass and placing a just out of the oven casserole dish on them, even if completely empty, will most likely cause it to shatter from the rapid cooling of the base.

So, as a kitchen safety tip, don't put hot glassware directly on countertops, use a trivet, dry kitchen towel or potholder.

kayfox··on The Practical Limitations of End-to-End Encryption
What he means by "I do not foresee any smartphone app ever being approved for this purpose." is that a commodity smart phone is an insecure platform, so the military will not be approving any app designed for a commodity smart phone.

And by insecure here, he and I mean that its not a platform designed and manufactured to meet the large number of requirements for handing classified information. It may be secure in the sense of industry standards or conventions, but its not secure in the sense of military information security.

kayfox··on Have you ever seen soldering this close? [video]
This is true for most surface mount packages, the surface tension of the solder will usually center the parts in their pads during reflow.
kayfox··on Did your car witness a crime? Bay Area police may be coming for your Tesla
> To be honest, it seems unlikely they'd easily be able to contact the owner,

California DMV does collect the telephone or email address for each owner.

kayfox··on Disney seeks dismissal of wrongful death lawsuit citing waiver in Disney+ terms
> In settings such as this, at a company as large as Disney,

Except in this case Disney is just the landlord. The pub in question is in a mall Disney operates and is run by a different company unrelated to Disney.

kayfox··on Disney seeks dismissal of wrongful death lawsuit citing waiver in Disney+ terms
Lawyers are ethically obligated to put every argument that could work in their filings.
kayfox··on Disney claims streaming arbitration clause binding in resort wrongful death suit
I think something people miss in these motions is that a good lawyer will argue every point they can, thats their job.
kayfox··on The rich history of ham radio culture
> Encryption is illegal on those bands though.

Depends on the band, for VHF, UHF and higher bands a country may make different decisions on what is not permitted. Canada has allowed encryption with published keys to be used for repeater access control in the past.

kayfox··on The rich history of ham radio culture
> pay for membership

Not in every country or even always in the US. In Canada there is no government fees for ham radio, if the test giver wants to charge a fee, they can, but most do not.

In the US there are clubs that pay for new hams fees out of a fund for that purpose.

kayfox··on Electric Giraffe (2016)
Followup, in this photo you can see a plate on the back of the Giraffe that has white and blue stickers on it, those are day and night BRC DMV permits: https://electricgiraffe.com/gallery3/index.php/2005/burning-...
kayfox··on Electric Giraffe (2016)
Last time I saw it, it had DMV stickers on it, so I think yes.
kayfox··on Boeing sold just three passenger jets in the past month
The other problem with that chart is that its from the NTSB and not normalized to relative fleet size. Boeing aircraft are more common in the NTSB's jurisdiction.
kayfox··on Solar Storm Knocks Out Farmers' Tractor GPS Systems During Peak Planting Season
The GPS data is needed to log the planting, modern farmers use a lot of statistics and data analysis to increase yield. In the case of planting, the position of planting is stored so the machinery wont run it over or double plant. Later seed quantity and distribution is analyzed against yield when harvesting to hone down on the best parameters for the crop and field.
kayfox··on How to fix America's aviation system (2023)
> The one airport in my region that I know is privatized has a horrible reputation among pilots and DPEs alike.

KSQL?

kayfox··on I can't use my number pad for 2FA codes
I think the only thing I have found really missing from HTML forms (for me) is the combo box, which is a combination dropdown and input field.
kayfox··on Southwest Boeing 737-800 flight from Denver loses engine cover
This issue is the failure to latch the three latches on the bottom of the engine nacelle, each of which is capable of holding the cowling closed for an entire flight. These latches are supposed to be inspected each time they are used and if they are not latched they will not be flush with the nacelle and should be caught by whichever pilot does the walk-around.

So no, the most plausible conclusion is not a structural failure but that maintenance opened the cowling and then failed to properly latch it and that was not caught by the pilot who did the walk-around.

kayfox··on Oregon OKs right-to-repair bill that bans the blocking of aftermarket parts
IIRC you have to be licensed to purchase most refrigerants in Oregon. Your typical HVAC refrigerant R134a has a global warming potential 1430 times CO2.
kayfox··on FAA gives Boeing 90 days to come up with a plan to address quality issues
I'm pretty sure if the FAA revoked the type certificates the airlines would take out a hit contract on all administrators involved. (joking) That would burn more money than the GDP of most countries.
kayfox··on Linux Is a CVE Numbering Authority (CNA)
> The policy now will be that each kernel bug will get assigned a CVE.

Do you have a citation for this?

For a CNA to submit CVEs they need to submit a CVSS score, initially 100% of their scores will be audited, if the score is 0, it would be considered an invalidly assigned CVE. Issues assigned a CVE must be exploitable by someone who does not already have access to do the thing described, they also must have documented impact to the confidentiality, integrity or availability of the impacted system. All of this means Linux being a CNA should not result in an increase of CVEs in unless they are already not getting CVEs for those vulnerabilties.

kayfox··on Freenginx: Core Nginx developer announces fork
Docs say its compiled into the Linux binaries by default:

http://nginx.org/en/docs/quic.html

"Also, since 1.25.0, the QUIC and HTTP/3 support is available in Linux binary packages."

kayfox··on 525 Private jets departed Las Vegas after the Super Bowl ended
Amtrak does not have rail service to Las Vegas, only a (slow) bus.
kayfox··on Freenginx: Core Nginx developer announces fork
Personally, I think its more honest if the parent org does not try to contest a CVE being assigned to a legitimate issue. If a CNA gets a report of a vulnerability in code, even if its an uncommon configuration, they should be assigning a CVE to it and disclosing it. The entire point of the CVE program is to identify with a precise identifier, the CVE, each vulnerability that was shipped in code that is generally available.

Based on my observation of various NGINX forums and mailing lists, the HTTP/3 feature, while experimental, is seeing adoption by the leading edge of web applications, so I don't think it could be argued that its not being slowly rolled into production in places.

← PreviousPage 2 of 21Next →