HNHacker News
TopNewBestAskShowJobs

klapinat0r

528 karma · joined February 3, 2011

submissionscomments
klapinat0r··on Show HN: Passbox – Another password manager using Bash and GPG
You're right, and don't take this as a challenge, I'm honestly wondering:

How come you aren't bothered? I ask because I can't image apart from:

a. I use short or cryptically unsafe passphrases,

b. I use passphrases and type them easily,

c. I only need to log in a few times.

Am I forgetting others?

klapinat0r··on Show HN: Passbox – Another password manager using Bash and GPG
I've been using pass since mitro.co announced their shutdown.

The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases.

pass claims to have both, but doesn't:

https://github.com/jvenant/passff#readme does not work.

The iOS app has disappeared from github: https://github.com/rephorm/pass-ios#readme

It's solvable problems, I just find it a somewhat important part of a password manager.

klapinat0r··on OS X 10.10.5 kernel local privilege escalation
I'm sorry, where's the rant?

I didn't know there was a 10.10.3 patch - I never said there wasn't. OP said there wasn't, I said it remains to be shown. You're more than welcome to correct me on that.

I don't understand what my patch sentence has to do with whining - or how that is whining about the HN crowd?

It's still unclear what was unwanted about my original comment, so I can't really correct my behavior (which was what I wanted all along).

klapinat0r··on OS X 10.10.5 kernel local privilege escalation
Why the massive downvotes when contributing to the issue he raises?

> Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ...

As it was clearly stated, there is a fix. Whether or not they'll release a 10.10 patch remains to be shown, and "no rush" is speculation.

I'll never understand the HN crowd, but I guess providing additional information to clear up a false statement, while correcting OPs assumptions is against the rules.

klapinat0r··on OS X 10.10.5 kernel local privilege escalation
One of the vulns in this exploit is fixed, rendering the exploit "useless" in 10.11.

But start the mac hate train regardless - if facts don't count :)

klapinat0r··on OS X 10.10.5 kernel local privilege escalation
Just to clearify: that's just means you couldn't compile it. It doesn't imply your system is/isn't vulnerable.
klapinat0r··on Why the Facebook iOS Application is so large
I hope it's a mechanism to make it possible for new employees to actually work on this app.

Perhabs someone with experience on large complex applications can share some insights?

Otherwise, I pity the FB employees who gets assigned to this project. "Here you go, fix that button, here's 18k files to digest".

Surely they must've decoupled it into oblivion in order to have a class that manages "just that", so

1. new employee can work in an "isolated" context (although he really isn't)

2. can locate where to write and debug in this complex codebase.

klapinat0r··on Almost Everything We Do Will Be Open
Ah, thank you.
klapinat0r··on Almost Everything We Do Will Be Open
Git is widely available, even on github: https://github.com/git/git

  apt-get install git
  pacman -Sy git
  emerge --ask dev-vcs/git
  yum install git
klapinat0r··on Firefox exploit found in the wild
The only concern I share with the author is this:

The isolation provided by Docker is not as robust as the segregation established by hypervisors for virtual machines.

As seen with CVE-2015-3629[0] for instance.

The other points: patch level and docker management isn't understood, seem to be people problems which can easily be corrected.

[0]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3629

klapinat0r··on Firefox exploit found in the wild
Or just run it in a docker container with your X11 session mounted. That works great for me.
klapinat0r··on Almost Everything We Do Will Be Open
Which tools are you talking about?
klapinat0r··on Hulbee – A Safe, Smart, Innovative Search Engine
HTTPS Everywhere only forces HTTPS when it's possible.

Force-TLS and HTTP Nowhere does what you describe.

klapinat0r··on Trade secrets of the oldest family firm in the US (2012)
Care to elaborate, what is the "secret"?
klapinat0r··on Mitro is Shutting Down on August 31st
I've also used Mitro ever since I first saw it, and I'm really sad to see it go (had plans to implement the server in python, but at the risk of overseing a security flaw I opted not to)

Lately I've been looking at pass[0], do any of you have experience running this (with git)?

[0] http://www.passwordstore.org/

klapinat0r··on Go in Go
Ah, great. Thanks for the explanation :)
klapinat0r··on Go in Go
Sorry for the noob question, but could someone help me understand how this is (conceptual) possible?

I get that you can write a program which compiles language X to machine code, e.g. how python interpreting Go to write the assembly necessary would be technically possible.

My question is, how is the compiler generated? If it's written in c, gcc -o compiler, but what is the piece I'm missing when it comes to Go compiles a Go compiler -- or is this still done as "here's the machine code, now compile the Go runtime"?

I suppose my question is a similie to "the chicken or the egg?".

klapinat0r··on Elasticsearch node crashes can cause data loss
Suggested reading -- the link.

> by not fsync'ing each operation (though one can configure ES to do so).

It may not be default, but we've seen, again and again, how people are influenced by what they read about a database (e.g. MongoDB).

The lesson by now should be: always know your DB.

klapinat0r··on Existential crisis at Railsconf
Monorail? Do you mean monolithic? or do you mean "doing only one thing" (one track)?
klapinat0r··on Using Go's interfaces at Clever – more than just easy collaboration
Right, and this is a presentation at GoSF about Go's interfaces, and how they work with Go's testing packages.
klapinat0r··on Scaleway: Bare metal SSD ARM servers
Not sure it qualifies, but http://raspberrycolocation.com/ has been around since 2013.

But, you know, salestext is useless :)

klapinat0r··on IRC History by Jarkko Oikarinen
https://botbot.me/
klapinat0r··on Show HN: Your private Reddit, best topic messenger
Agreed. IRC fits better
klapinat0r··on Git-Stats – A local GitHub-like contributions calendar
Ah, I see. A bit annoying when using more than one user.email across projects. But git-cal works okay :)

Thanks for the info.

klapinat0r··on Git-Stats – A local GitHub-like contributions calendar
Still doesn't work (for me, osx)

  user@host ~/tmp # npm install -g git-stats
  /usr/local/bin/git-stats -> /usr/local/lib/node_modules/git-stats/bin/git-stats
  git-stats@1.1.0 /usr/local/lib/node_modules/git-stats                                                                                                                                                       ├── ul@1.1.0
  ├── ansi-parser@1.4.0                                                                                                                                                                                       ├── cli-box@2.1.1 (ansi-parser@1.3.0)
  ├── moment@2.9.0                                                                                                                                                                                            ├── git-stats-colors@1.0.0 (couleurs@3.0.0)
  └── bug-killer@1.0.0 (couleurs@1.1.0)                                                                                                                                                                       user@host ~/tmp # npm install -g git-stats-importer                                                                                                                                                         /usr/local/bin/git-stats-importer -> /usr/local/lib/node_modules/git-stats-importer/bin/git-stats-importer
  git-stats-importer@1.3.0 /usr/local/lib/node_modules/git-stats-importer                                                                                                                                     ├── gry@1.0.0
  ├── async@0.9.0                                                                                                                                                                                             ├── oargv@1.2.0 (ul@1.1.0)
  ├── bug-killer@1.0.0 (couleurs@1.1.0)                                                                                                                                                                       └── git-stats@1.1.0 (ul@1.1.0, ansi-parser@1.4.0, git-stats-colors@1.0.0, cli-box@2.1.1, moment@2.9.0)
  user@host ~/tmp # git clone https://github.com/IonicaBizau/git-stats
  Cloning into 'git-stats'...                                                                                                                                                                                 remote: Counting objects: 414, done.
  remote: Total 414 (delta 0), reused 0 (delta 0)                                                                                                                                                             Receiving objects: 100% (414/414), 47.08 KiB | 0 bytes/s, done.
  Resolving deltas: 100% (189/189), done.                                                                                                                                                                     Checking connectivity... done.
  user@host ~/tmp : cd git-stats
  user@host ~/tmp/git-stats # git-stats-importer
  info  Done.
  user@host ~/tmp/git-stats # git stats
  ╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
  ║   Mar      Apr      May      Jun      Jul      Aug      Sep      Oct      Nov      Dec      Jan      Feb       ║
  ║Sun   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ║
  ║Mon   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ║
  ║Tue   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■   ║
  ║Wed   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■   ║
  ║Thu   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■   ║
  ║Fri   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■   ║
  ║Sat   ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■   ║
  ║--------------------------------------------------------------------------------------------------------------  ║
  ║Contributions in the last year: 0 | Longest Streak: 0 days | Current Streak: 0 days | Max a day: 0              ║
  ╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
  user@host ~/tmp/git-stats # cat $HOME/.git-stats
  {}
klapinat0r··on Hello HTTP/2, Goodbye SPDY
Sorry I didn't make it clear: that's my sentiment aswel. I'm glad it survived, so to speak.
klapinat0r··on Hello HTTP/2, Goodbye SPDY
SPDY came and went before I had to implement it. Phew.

On a serious note: it's nice to see ALNP being used in HTTP/2

klapinat0r··on Aurelius has been acquired by DataStax
That's sad. I was a big fan of Titan DB and we use it extensively.

Really sad to see it go. Now we'll have to find another solution, e.g. migrate to Neo4j, although we rely heavily on the scalability of Titan DB.

I guess now is the time to test Neo4j's cluster performance.

Any other alternatives out there?

klapinat0r··on Proper is Shutting Down
While the post mortem is valid in itself, I bet any snoozing customers would've loved to see this posted a while back ;)
klapinat0r··on How and why we defeated DirCrypt
Great look into the reversing techniques.

Albeit "defeated" is a strong word considering the RSA encryption is still intact - and thus only able to decrypt files larger than, and in range starting from, 1024 bytes.

It recovers potentially large portions, but if your file format can not function without a working header, you're out of luck.

← PreviousPage 2 of 8Next →