HNHacker News
TopNewBestAskShowJobs

lathiat

4,395 karma · joined November 23, 2015

e9d97d2d4a137fcf296c2fb30e80f4e5aa0af50b8197ac37a429e5fe35cf3611
submissionscomments
lathiat··on Cloudflare email routing is broken for all Google-hosted email recipients
I am kindof surprised that Cloudflare introduced e-mail forwarding as a product in 2021. The writing has been on the wall for this kind of thing for a long time. If anyone has a chance, you would think it was Cloudflare, because they are big and have some chance for special handling from the big providers like gmail and even they don't seem to be able to get it right.

I would highly recommend that you get rid of anything that does e-mail forwarding like this. It's really outdated at this point. It worked OK in the mid 2000s but as spam battle has grown it's gotten complicated.

Since you forward every email from provider A to provider B, provider B effectively sees a stream of e-mail from provider A that includes at least some amount of spam (anything that missed their filter). Very often these forwards are used for e-mail addresses that don't get a lot of real e-mail but are maybe used infrequently or old addresses you are maintaining and thus get a lot of spam but little legitimate e-mail and so the percentage of spam that makes it through can be quite high, relatively speaking.

That person is also not an authorised sender for legitimate e-mail under the various antispam solutions such as SPF - if you forward an e-mail from Paypal for example - you are violating their SPF policy of allowed senders. So then the e-mail has to be "rewritten" to pretend it's from an email on provider A, but your e-mail client still has to show it's really provider B.. so it's difficult to determine if that's spam or not.

DKIM helps here.. because the email is digitally signed instead of being recognised by the IP. Except to make SPF not fail, you have to do "SRS" or sender-rewriting as previously mentioned. But that changes the content of the e-mail which breaks DKIM. There are some mitigations for all of this (e.g. RFC7960) but the point is for the small fraction of real e-mail taking these "indirect"/forwarded email flows it usually erodes some ability of the final provider to do effecient spam prevention, or you get caught up in said spam prevention. There are no winners :)

It's then difficult for provider B to correctly spam filter with their own methods. Because the e-mail comes from provider A as far as they are concerned, and, while you can parse and guess based on the headers where it came from before that, it's error prone and not entirely standardised and bunches of that header trail can be forged.

Google offers the ability to pull e-mail into your account with POP or IMAP from a provider that receives the mail into a mailbox temporarily. Or you can setup the domain directly with your preferred provider - e.g. with google workspace, etc. Either of these is a much better method. But I guess you need a non-cloudflare provider currently.

lathiat··on Texas professor failed half of class after ChatGPT claimed it wrote their papers
I guess much like he asked of his students, the professor should not have used ChatGPT to do his own work of determining which students cheated using ChatGPT :)
lathiat··on Pigz: Parallel gzip for modern multi-processor, multi-core machines
bzip2 is much slower than gzip.
lathiat··on Some early praise for using drgn for poking into Linux kernel internals
You are looking for bpftrace

Drgn is closer solaris’ mdb debugger.

lathiat··on Ask HN: Paychecks from a failed startup?
This kind of thing is generally both country and state specific. It’s likely the relevant state regulator would have some info on this on their website.
lathiat··on Building the Pocket CO2 Project
Do you have a rangehood fan that vents outside?

You should never cook without one, even electric, but especially with gas.

If you do have one sounds like it isn’t working very well. Maybe not enough make up air coming in, it’s blocked? Not sure.

lathiat··on Bean leaves don’t let the bedbugs bite by using tiny, impaling spikes (2013)
You should watch: https://youtu.be/2JAOTJxYqh8
lathiat··on Bean leaves don’t let the bedbugs bite by using tiny, impaling spikes (2013)
Mark Rober. A really good watch: https://youtu.be/2JAOTJxYqh8
lathiat··on Parrots learn to make video calls to chat with other parrots: study
Formula 1 website (*on iOS/iPhone) has the same issue right now once you hit customise the literally 100s of options appear but the accept/reject/save appears for a microsecond and disappears as it loads. Hitting the X doesn’t save.
lathiat··on Faster LZ is not the answer to 150-250 GB video game downloads
Assassins creed odyssey was apparently 44-50GB at launch. That’s 3 hours @ 45 megabits/second.

This is not an uncommon internet download speed even today (let alone 5 years ago when it launched) according to the steam download stats (it varies by country, check australia for example, US is a little over 100 average): https://store.steampowered.com/stats/content/

Even at 100Mb, 45GB is 1 hour. Witcher 3 looks to be about 30GB but Cyberpunk is apparently 70-100GB.

Do the math next time :)

lathiat··on Show HN: TxtNet Browser – Browse the Web over SMS, No Wi-Fi/Mobile Data Needed
I remember seeing a service that did this over email a couple decades ago.
lathiat··on Changes to Tailscale Pricing and Plans
I subnet advertise my entire home network, which I consume from my phone and laptop on the go. Primarily to access home assistant, plex and SSH without advertising any of those to the internet - people can and do get hacked both via plex and SSH :)

When travelling internationally, I use the exit node functionality to optionally switch on and off sending all my traffic back home to either work around geo-blocks for my home streaming services or as a pseudo-vpn replacement for particularly dodgy networks.

lathiat··on Netflix will end its DVD service after 25 years
I think Leo Laporte once said something along the lines of some people are tool people and other people are doing people. Some like to obsess over the tools, some just want to get work done.

I saw another similar quote about amassing knowledge is pointless if you don't actually do something with it.

lathiat··on Reddit will begin charging for access to its API
They're using multiple providers including Fastly, Akamai and Cloudflare: https://www.streamingmediablog.com/2021/06/apple-private-rel...
lathiat··on Ask HN: Self hosted email, Cloud storage and dovecot
Yes
lathiat··on Ask HN: Self hosted email, Cloud storage and dovecot
I would do this with LVM. You can grow LVM to expand onto a second volume and expand the file system with it. Or ZFS.

https://wiki.archlinux.org/title/LVM#Add_physical_volume_to_...

However note self hosting mail used to be super easy but these days most report you have a real hard time getting people to accept your mail. When your IP has no prior history and small volume you’ll get false flagged as spam a lot. Likely to be your larger challenge.

lathiat··on APT Browse: A web browser for the contents of Debian (and Ubuntu) packages
It’s also super handy to add -n to search the names only sometimes
lathiat··on Linus Tech Tips channel hacked
The videos are just unlisted. But even if deleted YouTube can and does restore these things in similar cases.
lathiat··on Qualcomm has open sourced its aptX and aptX HD encoders
You want to read: https://en.wikipedia.org/wiki/Clean_room_design
lathiat··on An Update on Dianna's Health (Physics Girl) [video]
Graphtreon suggests she gained ~7,000 of those after this video was released. She only had 1,000 patrons last month: https://graphtreon.com/creator/physicsgirl

So yeah maybe 8,000 is enough now but maybe 1,000 was not :)

lathiat··on There’s no such thing as a tree phylogenetically (2021)
My wife and I disagree quite strongly on the crossover point fairly consistently. I also saw some research showing a supposed gender gap in that observation. Whether or not the gender part is true it seems very much that different people crossover some of these at different points.
lathiat··on Ask HN: Science fiction movies that are appropriate for 12 year olds?
Can't speak to movies but at this age I loved Star Trek Voyager. Lots of episodic episodes facing real issues/moral decisions.. insightful.
lathiat··on AMD Zen2 ymm registers rolling back
The reality is most consumer motherboards rarely post updates especially after the first year or so. You'll tend to get updates to fix CPU compatability for newer CPUs if the motherboard is still on sale, but otherwise most long term BIOS updates seem largely to be from enterprise vendors (Dell, Lenovo, etc) and much less common on consumer or gaming type hardware.

I think most people rely on the operating system to (amazingly) hot patch it during boot. Intel and AMD both publish them and are integrated regularly into most distros (and the linux-firmware git tree). Surprising/weird that they haven't released the Renoir ones.

Also seems Tavis had a bug where Debian wasn't applying them on boot for one reason but didn't give details. Wonder what it was.

lathiat··on Indirect Prompt Injection on Bing Chat
Agree with this. It's a much better argument that your bag of groceries or backpack on the seat is setting of the occupancy sensor. Except that happens in my 2008 Mitsubishi - a far from modern car.

I have heard maybe some modern cars have better occupancy sensors based on something better than weight but I'd expect a dog to set of most sensors designed to detect a human :)

I also wonder if the radio is disabled primarily because a lot of modern cars seem to use the radio speakers as the chime - not sure if the F150 does this - but also even if the chime was separate I guess if the radio was too loud you wouldn't be able to hear it.

lathiat··on LastPass says DevOps engineer’s hacked computer led to security breach in 2022
They had code execution on the persons computer, the encrypted vault is downloaded and stored/cached on the computer - you only need the master password at that point to decrypt it. Or to read the decrypted version out of the process (e.g. your web browsers memory)

The 2FA part in the password managers (and least in the major players currently) is to get a copy of the encrypted vault from the server. The user did that part, and the encrypted vault was not easily accessible locally.

lathiat··on A reason why Mac speakers sound better and louder than most
You can use 'gcore' (from gdb) to dump the process memory (on Linux) - it tries to create a core file as if it crashed, without crashing it. It's not 100% reliable it sometimes fails - not entirely sure why - but often works.

Then as above you dont really need to understand the memory or variables with debug symbols (though on Linux they generally are available.. and increasingly on the newest distros will automatically be downloaded by debuginfod). You can jsut grep for the text you are looking for and likely it's roughly together in memory.

lathiat··on PayPal Fees Are Insane
In Australia the Reserve Bank publishes the average cost of acceptance by card type.

As of 2019 the published rates are 0.5-1% for Visa and Mastercard (lower end for debit, higher for credit) and 1.4% for American Express. They are basically all dropping over time, not going up. This includes terminal rental, monthly fees, etc.

PayPal charges 2.6% plus a fixed $0.30 fee for domestic + another 1% for international. Stripe by comparison charges 1.75% domestic and 2.9% international. PayPal still charges this fee even if someone funds it from a much cheaper bank account or their PayPal balance. BrainTree, a subsiduary of PayPal for many years.. charges 1.75% + $0.30. Go figure :)

PayPal also has a fairly good anti-fraud measure that many others lose out on in that it does not let you submit a payment with a credit card associated with a PayPal account, without actually logging into said PayPal account.

PayPal has historically always had quite a high percentage, operating off brand I think and owing to easy integration options.

I'm sure there is some more complexity here I'm missing but in general, PayPal fees have always been significantly higher than the competition in Australia.

Also worth noting unlike the US, in Australia we have totally free transfers between all australian bank accounts - same system, every bank, 0 fee. So Paypal here is really only used primarily as a merchant facility for your website. The inter-person payment part has a much lower use rate than the USA.

lathiat··on Apple reveals iOS 16 and iPadOS 16 usage stats for the first time
It seems to be a more recent change in the last couple of years but yes now you do. It will show both options on the upgrade screen.

iOS12 got patched because they dropped a whole bunch of devices such as the original iPad mini then. They only patch had issues but gets one every few months or so.

lathiat··on Frame pointers vs. DWARF – my verdict
I would expect them to be there but debuginfod for Ubuntu is very new and did not (at least currently) import older releases (including the current LTS) or older package versions. Which is maybe what you’re seeing. Should work better with the most recent release only.

Do you have a specific example of which executables are missing?

There are also other ways to get all the debug symbols but it’s much fiddlier and not nearly as nice as debuginfod. Data’s all there, finding it is harder. You can query the apt index for buildids but only for the currently released package version and not superseded ones.

There were discussions about importing all the history and a way to do it was determined but not sure where the implementation of that has gotten too.

lathiat··on Frame pointers vs. DWARF – my verdict
Parca also have done work to unwind DWARF in kernel with eBPF: https://www.polarsignals.com/blog/posts/2022/11/29/profiling...

Edit: refer to another comment in this thread: https://news.ycombinator.com/item?id=34809265

← PreviousPage 11 of 34Next →