Hacker News Reader

littlecranky67on Who Is Planting Backdoors in Ledger Crypto Wallets?

They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.

littlecranky67on Who Is Planting Backdoors in Ledger Crypto Wallets?

Yet we trust our daily money system to be based on printed colorful paper that no one can reproduce.

littlecranky67on Ledger confirms spy chip implant behind wallet crypto thefts

You create your seedphrase - the famous 12/24 words, print them on a piece of paper and put it in the bank vault. Ideally some sort of fireproof container/envelope around it, and if you plan on long-term storage rather write them down manually with long lasting ink pen.

littlecranky67on Ledger confirms spy chip implant behind wallet crypto thefts

It always depends how much money you got in the wallet. People in the crypto space go super paranoid, 2-of-3 signing schemes with top-notch security, hardware legers, metal-plated keys that are burried in the woods etc, and in the end they hold less than 1000$ in the wallet... All safety measures should be chosen relative to the amount you are actually securing.

littlecranky67on Ledger confirms spy chip implant behind wallet crypto thefts

It depends what you do with your coins. Hardware wallets are meant to be used for people that frequently trade and need to sign transactions.

I always thought it is stupid to HODL using a hardware wallet. For HODLing, just get a random computer (no mailorder) and run debian13 with electrum (it is in the official repo, not an external package hence protected by standard debian safeties). Once you generated you keys, back them up and either wipe the machine, or at least airgap it.

Extra bonus: Raspberry pi 5 runs debian 13 out of the box.

littlecranky67on Intel D270 GPU AI Accelerator–Up to 480 GB LPDDR5X

the voodoo1 worked differently as you looped through the video input. The voodoo banshee i mentioned was a separate 2d/3d card (it actually was 3DFx first true, combined 2d/3d card - not an accelerator).

littlecranky67on Intel D270 GPU AI Accelerator–Up to 480 GB LPDDR5X

https://wiki.archlinux.org/title/PRIME

> We want to render applications on the more powerful card and send the result to the card which has display connected.

littlecranky67on Intel D270 GPU AI Accelerator–Up to 480 GB LPDDR5X

I remember back in the day of AGP cards around 2002, you could use a 3d card on linux to render the grafix but use a different GPU for the actual output. I used XFree86 on linux with a voodoo banshee (or maybe was a riva tnt2) and a matrox mga200 for its sync-on-green support with my monitor to play games.

I know modern card architecture doesn't support this out of the box, but what is the actuall problem of forwarding a once-rendered frame to another card for output? Sureley DMA transfers PCIe->RAM->PCIe nowaday are fast enough to saturate 60fps at 4K?

littlecranky67on Intel D270 GPU AI Accelerator–Up to 480 GB LPDDR5X

Wonder if there will be consumer video drivers for these GPUs once the AI hardware shortage is over. Hope to buy a gaming rig one day that doesn't cost a fortune.

littlecranky67on Ledger confirms spy chip implant behind wallet crypto thefts

get a brand new, cheap laptop or machine (even a raspberry pi works) that you randomly pickup at the store (no delivery order). Install debian 13, install electrum, airgap the device, reboot and generate 1-of-2 your wallet keys.

The wipe the device, use any non-debian other linux (or BSD) to generated the 2-of-2 wallet key.

littlecranky67on Fingerprints are the new cookies

My favorite cookie banner is on arstechnica.com:

> We Care About Your Privacy

> We, and our 228 partners use cookies and similar methods to recognize visitors [...]

228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.

littlecranky67on Fingerprints are the new cookies

I'm sure if they had to by some EU directive, they would. Organizations that big can't conceal that, as they risk discovery findings and whistleblower activities.

littlecranky67on Fingerprints are the new cookies

> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.

It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.

littlecranky67on Vibe coded browser ports of Halo, The Simpsons: Hit And Run, GTA work well

Honest question: Anybody has more details how to do this? I.e. I have my favorite game from the DOS/Win95 era I want to port plus a dev background - how to get started with AI reverse engineering?

littlecranky67on AnyPS5: Port PS5 binaries to PC without emulation (87% system libraries mapped)

It matters for anything multiplayer shooter and even single player games with quicktime events. Using WiFi, wireless controllers, TVs with frame pacing and bluetooth headsets adds latency already in your own house of around 10-50ms (although it is a combined latency, not network).

littlecranky67on AnyPS5: Port PS5 binaries to PC without emulation (87% system libraries mapped)

Cloud gaming is nice, I use GeforceNow regularly to play on my mac. However, there are several games that I couldn't complete/play due to the latency (around 60ms). Claire Obscures quicktime events were a pain (plus I used a PS5 controller which adds some latency), also Indiana Jones and the Great Circle had a bossfight mid-game with quicktime events that became so frustrating that I couldn't complete the game - halfway through. Same is true for Battlefield 6 - impossible to play, you just get continuesly fragged from player you didn't even see (remember the netcode does not consider you cloud gaming latency).

littlecranky67on Vibecoding isn't as fun as writing code by hand

Double edged sword. I started programming in the 90s as a teenager, it was always fun for me to code. Several toy projects on GitHub, later studied CS and became a professional dev of course.

I started a small one-man SaaS in 2022 that I coded by hand, and have gradually adopted AI usage. I don't write a single line of code anymore today, and my speed/performance has supercharged in the last 6-12months. The fun of coding is completely gone, but replaced with me being able to deliver what I need to grow the product (from dev, to design and marketing work).

littlecranky67on ChatGPT is adding real cartoonists' signatures to fake New Yorker cartoons

That lingo is always only used if you are on the side of being copied from, then you call it stealing as it benefits your narrative.

littlecranky67on ChatGPT is adding real cartoonists' signatures to fake New Yorker cartoons

Nothing got stolen as everything is still in its original place. You mean copied. It got copied.

littlecranky67on Friendship ended with Deno, now Node is my best friend

The hot shit is still typescript, eslint. I have been using those for more than a decade in node. For me, (deno lint) sounds like the new hot shit.

littlecranky67on Why don't more developers “use the platform”?

Maybe I'm too old, but remember position sticky is relatively "new" and I was around when browsers didn't support it, yet everybody demanded for "affix" solution [0] (the buzzword you would search to find a jquery plugin). Internet Explorer never had position: sticky, and FF only introduced it in 2014. And I dealt with projects until around at least 2017/2018 where enterprise clients would make any webdev required to run on IE12 too.

[0]: https://www.w3schools.com/bootstrap/bootstrap_affix.asp

littlecranky67on Updates to Full Disk Access in macOS

Pointless comment as the same holds true for macOS. Yes, you can load unsigned kext still, and yes, you can modify the userland. Not as easily, but I would argue it is also not harder as on an immutable linux distro.

littlecranky67on Why don't more developers “use the platform”?

The answer is UX designers and marketing people. I will yet have to work in a web project where any UX designer will be happy with what the native browser has to offer. Notable examples are date/time pickers. Look at any of the Top100 websites and you will find custom date/time picker designs. And I would also say, with standard browser built-in dialogs you could not rebuild/model those pickers to match what the Top100 websites use.

littlecranky67on Updates to Full Disk Access in macOS

root access is also no longer true root access on a lot of linux distros that are immutable, and container-esque like interfaces such as namespaces + cgroups also limit roots power.

littlecranky67on Fuck Android Developer Verification Program

Because the App is not open source - F-Droid requires OSS software. And yes, there is private repositories that users could manually add, but users won't find you by browsing the F-Droid appstore. F-Droid alone is a tiny fraction of users of Android, and F-Droid users that deal with private repos is a fraction of that fraction. Not worth to bother with that, no one is going to use your app then.

littlecranky67on Fuck Android Developer Verification Program

What you doubt doesn't matter, google clearly even requires you to fill out details about the testing process, how you recreuited your testers, etc. [0]. This is mandatory. Good luck trying to fill in "I used Fiverr to recruit some chinese clickworkers". Any if you are lying about the process - well If Google doesn't like your App or anything about you in the future, they can just delete whatever your App is citing false claims on your side.

[0]: https://support.google.com/googleplay/android-developer/answ...

littlecranky67on Fuck Android Developer Verification Program

> so you're pretty much guaranteed to pass after 14 days

Then why have it in the first place?

I don't complain about the money because my time to organize and go through this is worth more than the price difference. I'd rather pay 100€/year, same as on the Apple Appstore. Now I have to coordinate some fake weird closed-testing groups and hope I don't get banned for using unauthentic testers.

littlecranky67on Fuck Android Developer Verification Program

With the changes they did recently, unless you find 12 people opting-in to google groups for your beta test and downloading a private build from a beta-tester link, keeping the app installed and engage with it for 14 conescutive days, your game is NEVER published on Play Store at all. And that is AFTER you submit government ID and paid the 25 bucks.

Only companies can now have instant publishes on the Play Store without that 12-tester limit.

littlecranky67on Fuck Android Developer Verification Program

PWA support got worse on the latest android. They removed the clear "Install" button and copied iOS, that is you have to scroll down a long list and select "Add shortcut" / "Add to home screen". IIRC they removed the "install" wording.

littlecranky67on Fuck Android Developer Verification Program

I don't know why Google Play Store/Android in general has a good reputation - in my opinion they got worse than Apple. I recently created apps for both stores, and the Google experience is so bad. Because I am an individual (sole trader) I cannot go down the business route - but need to go through the 12 testers route. That is, I need to find 12 people willing to join a google group, opt-in to beta testing, and have my app installed for 14 days at the same time before I can publish the app on the Play Store. This is ridiculous. I'd rather pay a lump sum as I did for the Apple Store: 99€/year, go through App review, publish.

I had to submit my id, private bank statements (we often don't have monthly utility bills in europe, so I had to submit bank statements) and click through a ton of wizards for compliance, and of course pay 25€. Still no publishing rights. Now I would just pay some clickworkers on Fiverr to fulfill the testing criteria, but that risks getting my account (and app) banned forever. Needless to say that google now has all my private data associated with my google account.

People always say walled garden to the Appstore, but at least the entry ticket has a clear price label.