Hacker News Reader

kogepathicon Best Practices for Securing SSH

FWIW, Teleport are also the sponsor of Last Week in AWS Security (2022-01-06).

It seems someone was told to go market Teleport and posting to HN is free (unlike newsletter sponsorships).

kogepathicon Q&A with the developer of BetterDummy: from macOS secrets to his motivations

Not all external monitors are "hot garbage" and it was probably my mistake to use that term.

Apple could always choose to add some "innovation" to the external monitor market by manufacturing their own line of displays. [1] For example, they have a nice 4.5K display in the iMac, but they won't sell it as a monitor for some reason.

Instead, they offer exactly one external monitor that starts at $4999 USD.

[1] https://en.wikipedia.org/wiki/Apple_Cinema_Display

kogepathicon Q&A with the developer of BetterDummy: from macOS secrets to his motivations

> I think Apple is trying to force the hand of monitor manufacturers towards 4k or higher. The entire external monitor industry is such a no-innovation, customer-hostile dumpster fire.

Please stop apologizing for Apple's customer-hostile behaviour here. A $2 trillion company should be able to make an external monitor not look like blurry trash when connected to their hardware.

The fact that it takes someone to make a third-party app to fix what Apple can't speaks volumes to how much they care about/understand their customer base. Apple should have tested M1 hardware with hot garbage external monitors, realized the customer experience sucked, and fixed it.

kogepathicon Lead time for new Intel NIC orders is quoted around 52 weeks

I ordered an HP ProBook in April 2021 and I'm still waiting. The original delivery was scheduled for July, and that's been pushed back twice now.

A few weeks ago they emailed me saying the AX200 is unavailable and my choice was Realtek WiFi, or cancel my order.

I'm seriously wondering if they'll ever deliver. I might cancel my order if Ryzen 6000 is released before they manage to ship.

kogepathicon Silent changes to Western Digital’s budget SSD may lower speeds by up to 50%

I thought Western Digital had vertically integrated their SSDs after the purchase of SanDisk?

According to that Wikipedia list, Western Digital does manufacture their own flash, through a joint venture with Kioxia.

kogepathicon Wealthy people are renouncing American citizenship

> The IRS publishes a quarterly list of the names of people who have renounced their citizenship or given up their green cards, but it only includes people with global assets over $2 million

This claim is total crap. The list includes all US citizens who renounce their citizenship, regardless of their net worth. [1]

You also cannot renounce your citizenship for tax dodging [2]:

> Persons who wish to renounce U.S. citizenship should be aware of the fact that renunciation of U.S. citizenship may have no effect on their U.S. tax or military service obligations (contact the Internal Revenue Service or U.S. Selective Service for more information).

So plan to become rich after renouncing (and without the IRS noticing).

[1] https://www.federalregister.gov/quarterly-publication-of-ind...

[2] https://travel.state.gov/content/travel/en/legal/travel-lega...

kogepathicon Duolingo S-1 IPO

> You are limited in how long you can access their platform by how many hearts you have. Miss enough questions, your hearts run out. Run out of hearts, you're restricted from proceeding further in your studies. You must buy hearts to stay on their platform. This feels counter intuitive, as you are now kicking users off of your platform and lose the ability to sway them towards other things you have to offer.

Pro-tip: Hearts only exist in the app, not on the website.

As soon as they switched to the hearts system, I uninstalled the app and now exclusively use the mobile website. Considering their app is just a web view, the experience is essentially the same (you'll need connectivity at the start and end of a lesson), except no ads and no hearts!

As a plus, the website actually allows you to view the forum discussion on sentences, for example if your answer was wrong but you feel it should be correct, you can see what other people are saying about it. Why they don't offer this in the app is beyond me.

The decision to gate people's learning by restricting their number of attempts stupid. It's counter to the point of learning, but I guess they didn't feel they were getting enough revenue from just ads alone, so they have to kneecap the learning experience to force people into their over-priced monthly subscription.

kogepathicon Fewer young men are in the labor force, more are living at home

> You also have the problem of writing dozens and dozens of seemingly engaging and individualized messages only to get no response back.

To use a property analogy: if I am not the highest offer on a house, I probably won't get it. Doesn't matter if I have a trust fund or work for minimum wage (effort put into the offer) my offer wasn't accepted.

Similarly if I'm the seller, I can decide "No, actually I don't want to sell my house to BlackRock, I'd rather sell it to this young family" and that's entirely my choice. This choice might leave money on the table, but at least I get the warm fuzzy feels inside for doing what I think is best.

What you describe sounds like you want some kind of "thank you for putting in some effort" but you decide the amount of effort to invest, the other party owes you nothing.

kogepathicon Fewer young men are in the labor force, more are living at home

> another friend of mine basically refuses to date anymore because he thinks the sort of culture of Tinder dating is a waste of time that favors women disproportionately.

My female friends (I'm male) with online dating profiles have shown me their matches and conversations, and it's bleak. They all mostly have an average profile and still receive thousands of likes/hearts/swipes and messages, but the mean amount of effort from men messaging them is zero to none.

Maybe your friend considers the situation of having fewer women on dating apps as somehow "favoring" their gender, but from what I've seen and heard, sorting through an inbox of unsolicited genital photos and copy pasta pickup artist lines is not something most women would say they enjoy spending their time doing.

If instead he's referring to apps like Bumble where the woman has to make the first move, see above for why some apps choose to operate with that model.

kogepathicon Old-school computing: when your lab PC is ancient

> I wish modern hacker laptops had an easy non-proprietary way to get a serial port.

Dell docking stations like the PR02X provide serial/parallel ports directly from the laptop, and Dell Latitude laptops with the E-Port docking connector were made until ~2016.

Both the PR02X and Latitude laptops with an E-Port are readily available on eBay for reasonable prices.

I've successfully used an E6220 with the PR02X to bitbang out the parallel port for a project.

kogepathicon Valve is making a Switch-like portable gaming PC

Valve's track record with non-VR hardware is, to put it politely, not good.

Seven years after launching the Steam machine (2014) initiative, there are no Steam machines available for sale. [1]

Both the Steam Controller (2015-2019) and Steam Link (2015-2018) are discontinued and cannot be purchased, despite consistently positive reviews from users. [2]

As other commenters have noted there are already numerous "Switch-like, but x86" products that exist, and it's unclear to me what innovation Valve can bring to the space.

IMHO if Valve wants to be taken seriously in the hardware market, they need to stop pulling a Google and actually support/iterate/not discontinue their existing hardware products (before someone adds that they did support these through firmware updates, I mean updating the hardware to keep up with the times, Steam Link with apps or 4K, etc).

[1] https://store.steampowered.com/sale/steam_machines

[2] https://store.steampowered.com/search/?category1=993

kogepathicon France is testing free public transport

In the mean time, perhaps France would consider adopting the approach used in many German cities whereby monthly pass holders are permitted to take another adult and 3 children for free during evenings, weekends, and holidays. [1] Many German cities also offer cheaper subscriptions if you only use public transit after 09:00.

This is great if you have a visiting friend, or a partner/family who do not have monthly passes but want to go somewhere outside of business hours.

The RATP still considers weekly passes valid from Monday to Sunday and monthly passes valid from the 1st to the end of the month. They do not sell passes pro rata (e.g. if you buy a monthly pass on the 10th, you pay the same as someone who bought on the 1st), nor do they offer 7d/10d passes. They recently introduced Navigo Easy to replace tickets, but this is limited to trips in zones 1-2. [2]

The fact that RATP are still this inflexible in 2021 does not give me confidence they can become more progressive.

[1] https://www.bvg.de/de/abo-online

[2] https://parisbytrain.com/navigo-easy/

kogepathicon Nvidia cripples cryptocurrency mining on RTX 3080 and 3070 cards

> moving to subscription based licensing network switches

Moving to? Cisco owns Meraki, subscription based licensing is Meraki's entire business model.

kogepathicon How M1 Macs feel faster than Intel models: it’s about QoS

> With the majority of other, even comparably priced laptops, that is the exception.

Consumer grade PC hardware has terrible build quality, and regardless of the price of your unit, the consumer build spec is just inferior to the business/professional lines. Asus, MSI, Sony, Acer, etc laptops all have consumer grade build quality and they just aren't designed to last a decade.

> They’ll usually be ThinkPads or some XPS models from dell.

Precision/XPS and Thinkpad models (with the exception of the L and E series) are almost always in the same price range as a MacBook. Any business-class machine (Thinkpad, Precision/Latitude, Elitebook) should easily last >5 years. These are vendors which will sell you 3-5 year on-site warranties for their laptops.

This is why you can find so many off-lease corporate laptops on eBay from any model year in the last 10 years or so. The hardware doesn't break, it just becomes obsolete.

kogepathicon Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

> IMO, it's not just the importance of backups, but of having third party, redundant, off-site backups.

If your backups do not already include the above, then it is not a viable backup strategy.

kogepathicon Surface Laptop 4

Come on Microsoft, Apple offers the choice of keyboard layout in the EU so why is there no option to configure the keyboard layout during checkout in your store?

At the very minimum, tell the customer the keyboard layout during checkout, because I'm not going to bother ordering it only to find out after receiving it what the layout is (my default assumption is the national layout; e.g. QWERTZ for Germany, AZERTY for France).

Lenovo, HP, and Dell are all guilty of this as well. The laptops are all assembled in SE Asia in the first place, so it's inexcusable that vendors cannot offer different keyboard options on their own web store.

kogepathicon LG is getting out of the mobile phone business

Just pick and choose from the list of bloatware: https://github.com/khlam/debloat-samsung-android

kogepathicon Focalboard – a self-hosted alternative to Trello, Notion, and Asana

The installation instructions for the server install don't seem to work.

> wget https://releases.mattermost.com/focalboard/0.5.0/focalboard-...

> tar -xvzf focalboard-server-linux-amd64.tar.gz

The file is actually a zip with the tar.gz inside:

focalboard-server-linux-amd64.tar.gz: Zip archive data, at least v2.0 to extract

$ unzip -l focalboard-server-linux-amd64.tar.gz

Archive: focalboard-server-linux-amd64.tar.gz

Length Date Time Name

--------- ---------- ----- ----

12461347 02-02-2021 00:38 focalboard-server-linux-amd64.tar.gz

-------- -------

12461347 1 files

Running tar directly (as written in the instructions) will fail with:

$ tar -tzvf focalboard-server-linux-amd64.tar.gz

tar: invalid magic

tar: short read

It seems like there's something unintentionally producing a zip at the end of the build process.

kogepathicon Barcode scanner app on Google Play infects 10M users with one update

> Big Canadian bank too. US$65b mkt cap.

Well then, let me tell you about Toronto Dominion bank (TD, market cap ~$105B)

The app allows you to photograph a cheque to deposit from the app. This option is displayed for their TD USD chequing account.

I scanned a cheque from a US bank in the app (to deposit into my USD chequing account), only to be informed that cheques from US banks cannot be deposited using the app and that I'd have to go to a branch.

The same app is missing transactions and does not correctly display the current balance of some accounts (which are correctly shown in EasyWeb) The app has also blocked screenshots, so I was unable to provide their customer support with proof of the missing transactions.

Call me entitled, but I would expect all transactions and current account balances visible in the web interface to be accurately reflected in the bank's official app.

If you have ever experienced N26, Revolut, or any number of European "FinTech" banks, you will understand that Canadian banks are busy banging rocks together while telling you they're hot shit.

kogepathicon Can't uninstall Adobe apps without an account (2018)

Have you tried Photopea? Photopea can also open PSD files, and it runs entirely in a browser so it's suitable for using on a Chromebook.

https://www.photopea.com/

kogepathicon TP-Link Archer VR1600V V2 Super User Password Cracked

The ISP provides a Fiber 10G-EPON ONU which plugs into their all-in-one. [1]

It is my understanding that subscribers with a Freebox Delta only receive this, since the Delta is SFP+ capable. Since I have the older Freebox Revolution the ISP provided me a media converter which accepts the ONU and provides a normal SFP port which can be plugged into a normal device with an SFP port. [2] Then, you just have to configure the ipip tunnel on your device and you're online.

[1] https://lafibre.info/images/pon/201012_SFP_Free_FTTH_10G-EPO...

[2] https://lafibre.info/gpon/olt-sfp-possible-revolution/msg433...

kogepathicon TP-Link Archer VR1600V V2 Super User Password Cracked

My ISP uses GPON FTTH and anticipates you to use their all-in-one box they provide.

You can "easily" replace the Freebox, provided you can:

A) find the necessary ipip6 configuration for your region

B) you don't mind losing VOIP and IPTV

It should even be possible to retain IPTV if you route the correct VLAN to their set-top box, but I didn't care enough to go through that.

The amazing part to me is that (IMO) they are selling you a more expensive monthly subscription to get an all-in-one box with a less terrible WiFi implementation. [1]

The standard WiFi experience with their lower-tier all-in-one is terribad, which could easily be solved by buying a WiFi AP and plugging it into their box via Ethernet.

German ISPs do the same thing, by offering you the choice of a basic router or a Fritz!Box for a higher fee. In every instance I have seen, you're better off selecting the cheapest device your ISP will provide, putting it into bridge mode, and using your own router/AP via Ethernet.

[1] https://www.free.fr/freebox/

kogepathicon Watercooling a Canon R5 to enable unlimited 8K recording

I too wish for more smartphone makers to get into the discrete camera business.

Unfortunately, it is not a growing market segment. [1] Sales are down 54% YoY in 2020 (and were well in decline before COVID). [2]

Samsung used to have their own line of discrete cameras, with quite a unique feature set for their time, but these were discontinued in 2015. [3]

15 million units a year is not a large enough market for any new entrant to bother investing the R&D. They would then have to license an existing lens mount or design their own, and photographers with thousands of dollars in lenses are very conservative about moving to a new system. Third party lens makers are also slow to redesign their products to support a new system.

[1] https://www.statista.com/chart/5782/digital-camera-shipments...

[2] https://petapixel.com/2020/11/06/camera-sales-in-2020-have-p...

[3] https://en.wikipedia.org/wiki/Samsung_NX_series

kogepathicon Asus Release Raspberry Pi Competitor Tinkerboard 2 and 2S

The Tinkerboard has USB3, just use any one of the Linux supported USB3 to Ethernet adapters for sale out there and you can have multiple Ethernet interfaces.

You can even get N-BaseT USB3 adapters these days, and USB3 has the bandwidth. You may quibble about connecting Ethernet over USB3, but it works quite well in my experience.

kogepathicon Apple’s dongle problem isn’t getting any better

> Apple has a dongle problem.

It is not a problem, it's a feature.

Apple replaced ports that used to cost them pennies in components for dongles which they can sell to customers for upwards of $50, which can be lost, or which you buy multiples of so you can have one at home, in the office, etc.

Unlike previous times in Apple history where they went all-in on a new and not yet widely adopted bus (USB1, FireWire) IMHO this is purely about improving their margins. Remove existing functionality and charge customers more to return to the status quo.

kogepathicon Netgear Firmware Requires Online Registration

I have serious doubts. Having worked with switch ASIC vendors before (Marvell, Broadcom), they require you to sign a mile long NDA before you can even access datasheets.

If you can get the switch vendor to release a GPL archive (which is often a struggle in of itself) I have never seen them release the source code to manage the switch ASIC. That's always built as an out-of-tree module which is not released as part of the GPL archive.

Many switches are not even running Linux, it's quite typical to see eCos, VxWorks, or an RTOS (e.g. ThreadX) on a switch.

tl;dr - even if the switch runs Linux (many don't), it is very unlikely you will have the datasheet and/or reference implementation for managing the switch ASIC

kogepathicon Reverse engineering a camera protocol for fun and profit

I found someone selling them on AliExpress, though at a high price point: https://www.aliexpress.com/item/4000990317952.html

If you don't mind a different style (clam shell), you can get them for significantly less: https://www.aliexpress.com/item/33025755888.html

I suspect both AliExpress listings are an order of magnitude more expensive than they can be purchased on Taobao, but then you have to A) find it on Taobao, and B) use a shipping agent in China to export it.

Found a US-based seller who has them for $3/each (min quantity 10): http://siliconkit.com/ocart/index.php?route=product/product&...

Ah, the model number is listed on the flashrom wiki: https://www.flashrom.org/Technology#SO8.2FSOIC8:_Small-Outli...

Edit: Here's the Taobao link: https://item.taobao.com/item.htm?id=576521466919

kogepathicon Apple Silicon: The Passing of Wintel

> If you want to "bring manufacturing back" (whatever that means) you need significant tax raises to build and subsidise significant amounts of infrastructure and subsidise education and training in the relevant skills.

IMHO large investments in infrastructure and education are the playbook China has followed for the last 40 years to become the world's biggest factory.

In China's case, they didn't fund it by raising taxes on an already-wealthy populace, but rather by going "lol, workers' rights?" and forcing an entire generation (or two) work 12 hours a day for 6 days a week (996) making pennies per hour. [1]

The PPP of Chinese citizens has gone from ~$1000/year in 1990 to ~$17,000/year today. [2] That's a 17 fold increase, compared to just ~2.7 for the US over the same period. [3] I highly doubt any employee in a country like the US, UK, or Germany is going to accept a 996-style work schedule (in fact it would be illegal in many, if not all, of these jurisdictions) and especially not for the current PPP of a Chinese citizen.

> Automation explains almost all loss of manufacturing jobs.

This is also applying to China now. You can't have labour costs increase 17x over 30 years and not consider automation to reduce your costs. However, since China has historically been the destination of outsourced manufacturing, they have built up supply chains that the US used to have back when the US did "manufacturing."

Why would a profit-driven corporation spend money to bring the supply chain back to the US when there is no economic reason to do so? To me, this is a very large issue, separate from "infrastructure" that the US government has yet to seriously discuss. Raising taxes is a politically toxic move in many political systems, and it's incredibly unlikely a corporate entity would voluntarily choose to forego profit to help an OECD country re-develop its lost supply chains.

[1] https://en.wikipedia.org/wiki/996_working_hour_system

[2] https://data.worldbank.org/indicator/NY.GDP.PCAP.PP.CD?locat...

[3] https://data.worldbank.org/indicator/NY.GDP.PCAP.PP.CD?locat...

kogepathicon New Mac ransomware spreading through piracy

> 2) disable protection alongside with A/V and proceed as usual

How would the malware do that? I've looked into this and with Windows 10 1903 onward, Tamper Protection is enabled by default. [1]

I have yet to find a programmatic method to disable Tamper Protection (which is a prerequisite to disable Defender). I've tried regedit (permission denied), GPO, and all other manner of PowerShell thuggery, but I have not succeeded. In the end, I scripted extracting and editing the registry hive offline (outside the VM) to disable Tamper Protection.

Unless the malware has a way to open the Settings app and toggle Tamper Protection in the UI as if they were a user, I can't think of any way they could disable it unless they exploit a known weakness in Defender or a third-party anti-virus program (entirely possible).

[1] https://docs.microsoft.com/en-us/windows/security/threat-pro...