lucgommans

You never use a calculator?

:D

What calculation did you use though? Like some formula or is there a web utility for this, for example?

A white dwarf's density is apparently around 1e9 kg/m³. Olympic swimming pools at 50m*25m*2m * 1e9kg/m³ would have a weight of 2.5e12 kg. As a sphere, the radius is (solving: volume_of_sphere = 4/3×π×radius³)

    $ qalc 50m*25m*2m = 4/3*pi*x^3
    (((50 * meter) * (25 * meter) * (2 * meter)) = ((4 / 3) * pi * (x^3))) =
    approx. (x = 8.4194515 m)

Gravitational acceleration (for a point mass) is: the gravitational constant, multiplied by the mass, divided by the radius squared, and we want the result in Earth gravities:

    $ qalc G * 2.5e12kg / 8.4194515² m² to gee
    (newtonian_constant * ((2.5 * (10^12)) * kilogram)) / ((8.4194515^2) * (meter^2)) =
    approx. 0.24 gee

You're only one order of magnitude off — if this is correct, which I am really not sure about!

Sources: https://en.wikipedia.org/wiki/White_dwarf · https://en.wikipedia.org/wiki/Olympic-size_swimming_pool · https://duckduckgo.com/?q=volume+of+a+sphere&ia=answer · https://www.wolframalpha.com/input?i=surface+gravity+calcula...

What I'm even less sure how to calculate is whether an 8-meter sphere can be that heavy. Uranium is ~2e4 kg/m³, but under its own gravity, things shrink until they reach black hole status (infinite smallness; perceived size coming from its event horizon). Basically I'd want to turn the above 1e9kg/m³ into an unknown, but what's the formula for mass given your specified radius and gravitational acceleration? TBD

I'm really curious if this was just a few words strung together and it happened to come out to within one order of magnitude by pure coincidence, or if (how) you calculated this!

Rather than teaching a separate utility, I would recommend qalc which has unit conversions built in :)

    $ qalc -t 100km/h / 0.956s to gee
    2.9629132 gees

(where -t is for terse mode; by default it expands unit abbreviations and adds parentheses so you see whether it did what you wanted)

The reason I recommend it is because it does so much more, I really love this utility since discovering it about a year ago. Example of using time notation combined with uncertainty and unit conversion:

    > (18:41 - 09:00+/-00:30) hours * 250 W to kWh
      (((1121 / 60) - (9±0.5)) * hour) * (250 * watt) =
      approx. (2.4208333±0.125) kW*h

Protip: no need for a dedicated unit conversions utility, this awesome calculator has it built in:

    $ apt install qalc
    $ qalc
    > 100 km/h / 0.956 s to gee
      (100 * (kilometer / hour)) / (0.956 * second) =
      approx. 2.9629132 gees

It is not mentioned on the project to-do list: https://www.wireguard.com/todo/

But I do seem to recall reading something about it when browsing the wireguard website a few days ago. Something to do with the underlying Noise framework not supporting it, and that being a blocker, I think. Looking through the repositories now, none of the recent activities (most recently active are wireguard-{freebsd,android}) are PQ-related

Edit: found it again on https://www.wireguard.com/known-limitations/

> Post-Quantum Secrecy

> WireGuard is not, by default, post-quantum secure. However, the pre-shared key parameter can be used to add a layer of post-quantum secrecy. It could be post-quantum secure were the public keys hashed instead of sent directly, but this is not part of the Noise Protocol Framework, on which WireGuard's handshake is based, and this hashing technique wouldn't enable forward-secure post-quantum secrecy either. The best bet for post-quantum security is to run a truly post-quantum handshake on top of WireGuard, and then insert that key into WireGuard's pre-shared key slot.

Oh I see! I know that from the Tor browser, didn't realise they all do it that way.

Very interesting website! I submitted it[1] because it's quite the eye-opener for me (e.g. blob tracking is new to me, and if you click on the cell, it shows you PoC test code!) and I had missed its previous submission two years ago.

Brave, Librewolf, Mullvad, and Tor hide the user's screen dimensions, whereas Firefox and Chrome don't. I'm curious, how often does that break things? I imagine that quite a few sites use this for choosing how to position things with JavaScript. Certainly not a majority, but with how many websites an average techy visits on an average day, it might still be somewhat frequent that you get ill-fitting content.

Do you use Librewolf, or does someone else use it who can tell?

[1] https://news.ycombinator.com/item?id=37433207

There are two styles of public key, both with Base64 between the boundaries:

    -----BEGIN RSA PUBLIC KEY-----
    -----END RSA PUBLIC KEY-----
    and
    -----BEGIN PUBLIC KEY-----
    -----END PUBLIC KEY-----

The top answer gives a stellar explanation of internals in response to OP asking how to convert between them.

For the former (older) format, there is this overview in the middle of the post:

> [This is an] PEM DER ASN.1 PKCS#1 RSA Public key

> - PEM: synonym for base64

> - DER: a flavor of ASN.1 encoding

> - ASN.1: the binary encoding scheme used

> - PKCS#1: The formal specification that dictates representing a public key as structure that consists of modulus followed by an exponent

> - RSA public key: the public key algorithm being used

Trivial!

I really appreciated the explanation of all these terms in one place, even if I question that PEM really just means Base64 it is likely a useful simplification.

Omg, it works! Why does this work? It doesn't work on Firefox ~4 on Windows XP with a real Flash player installed, nor does it work on MSIE8 on that system. I tried on the original site as well as on a custom file that embeds just that flash file, but no dice.

I suppose it's worth uploading the swf to archive.org and seeing if it will work there as well. Edit: https://archive.org/details/newyorktimes-2010-interactive-ro... says "failed to download game data" but I'm not seeing a failed request in the developer console. Not sure if that's a problem with my upload or if IA hasn't finished processing it or something. /edit

It's not fully functional by the way: the computer is not being animated at all, the text areas are too small, the score counter doesn't update... but it runs! Thank you :)

Did that work on the NYT site for you? Because for me it doesn't seem to, but then I figure you're just replying in general and not about this rock-paper-scissors AI

That would be nice. I was recently trying to play https://archive.nytimes.com/www.nytimes.com/interactive/scie... via archive.org, but it doesn't work. Also the swf file itself does not load in an old virtual machine. I don't know where to view error output besides the JavaScript console; it simply does nothing.

(Previous discussion: https://news.ycombinator.com/item?id=2290936)

I still occasionally think back to this engine when the topic of human randomness comes up (I do computer security for a living, so that's not infrequent)

They link to a collection called "Software Library: Flash". How do I add something there? I've uploaded gravityrunner years ago and recently (45 days ago, the site tells me) figured out how to activate the emulator for this swf file (not sure why not offer to emulate any .swf file but ok), but it's also not showing up¹ in things like Flash game collections. Is there any documentation on this?

Edit: wait, I think I found it. Below the About text, there is a filter for "AND primary_collection:softwarelibrary_flash". Probably I need to add that tag to my item. Now I wonder how I'm supposed to know of the relevant collections to put things in? Is there a list of all software categories?

¹ https://archive.org/details/softwarelibrary_flash?query=grav... whereas it is on the site-wide search: https://archive.org/search?query=gravityrunner

Announcement: https://blog.archive.org/2020/11/19/flash-animations-live-fo...

> Utilizing an in-development Flash emulator called Ruffle, we have added Flash support to the Internet Archive’s Emularity system, letting a subset of Flash items play in the browser as if you had a Flash plugin installed

I had trouble when adding e.g. https://archive.org/details/gravityrunner-nolimit because there's literally zero documentation on this system that I could find, but the way that it works is that you edit metadata tags (key-value list) and there is some magic/special tags that have an effect on how the item is displayed on the site, like whether to show you the emulator. What you need to set is:

    emulator = ruffle-swf
    emulator_ext = swf

You can find out what others have set by clicking on 'show all' at the download options and choosing the <itemname>_meta.xml file.

You mean in like meters?

> Each observatory has two light storage arms that are 4 kilometers in length. [...] A passing gravitational wave will slightly stretch one arm as it shortens the other. [...] Even with such long arms, the strongest gravitational waves will only change the distance between the ends of the arms by at most roughly 10⁻¹⁸ m.

With the nominal hair value being 75 µm, `apt install qalc` tells me that's

   > 75 µm / 10^-18 m
   (75 * micrometer) / ((10^-18) * meter) = 7.5E13

so a change in length 7'500'000'000'000 times smaller than the width of a hair

https://en.wikipedia.org/wiki/Gravitational_wave , https://en.wikipedia.org/wiki/Hair%27s_breadth

Not for me at least (though I think loloquwowndueo was mostly joking)

Sort of. KSP teaches you rocket building and how precious fuel is. You need to invest a lot of time to get to the stage where you transfer between planets. You also can't just pick up the resident star, give it a whack, and see what happens to the solar system (because it's all two-body mechanics).

That's what I wanted to learn about: orbital mechanics, but as a game. I could not find anything online so I built it myself. The UX is bad, I've been meaning to improve it but you know how it goes. Apologies in advance if the interface is beyond comprehension: it's not you, it's me.

Default 3-body demo: https://lucgommans.nl/p/badgravity/

Earth orbit: https://lucgommans.nl/p/badgravity/#b64params=eyJ0aW1lcGVyc3...

Use arrow keys to control the space craft that looks oddly similar to the letter "A". You're orbiting Earth (denoted with E) and there is also the international space station roaming around, as well as the moon if you scroll to zoom out.

Try getting near the ISS or even the moon! It's tricky if you're doing this for the first time.

For me, this really helped to get a feel for orbital mechanics. I never played KSP more than a few minutes on a friend's PC, but based on Juno:NewOrigins (simplerockets2) being rather similar, I don't really enjoy the engine building aspect or the aspect of constantly being out of fuel. It's more realistic obviously, but spacecraft design wasn't my goal. I wanted to understand how things in orbits affect each other and this lets you do that.

You can also take control of the earth in the "bodies" menu. Set engine thrust to some giganewtons or whatever and fly the earth to a new place :). Or try some of the scenarios in the menu. Also note the simulation speed on the top left, otherwise getting to e.g. the moon takes a while.

> once the pixels become larger it might be required to cycle through entire words.

That's a clever idea for speeding up this process actually. Instead of guessing a-z for every position, only guess valid word completions. If it doesn't end up giving a good score or the human judges it to be nonsensical, it can fall back to a-z guessing for that word.

A bit similar to my hangman solver (https://lucgommans.nl/p/hangman-solver/), which looks for the only words still possible with the given letters already known, but simpler because you only need prefix matching.

I know you meant it for very strong blurs, and there it is not actually an advantage because you need to go through thousands of words before guessing one (instead of 26×5≃130 guesses, assuming an average word length of ~5), but yeah there you'd have no other choice.

Recently at an OSM meetup with the local government in Aachen (Germany), they mentioned that some imagery they shot was deemed too invasive and only used internally. I thought that was 10cm, but now checking what is available, looks like I was wrong! Probably it was 5-7cm then? Or maybe this was rather about the imagery available from different angles, so you can see into gardens from different directions?

In iD I see that indeed the PDOK imagery is now labeled 7.5cm, but checking that against the Belgian and German 10cm:

PDOK 7.5cm: https://snipboard.io/fbWqYM.jpg

AIV Flanders 10cm: https://snipboard.io/Ahn4lJ.jpg

NRW (Germany) 10cm: https://snipboard.io/RpT3vA.jpg

PDOK's looks awful, much worse than 10. Maybe some regions are available in a higher resolution?

Indeed, something like 25cm or better is typically shot from airplanes. I don't remember what the physical limit is for image quality given a reasonably sized spy satellite (iirc it's around the 20cm mark), but commercially at least, the high quality imagery is all airplanes. Governments often commission such planes to fly ~yearly at something like 10 cm, as well as commissioning height maps[1], but the very good stuff is not released to the public for privacy reasons. I think the best I've ever seen is 15cm.

The point clouds from those height maps alone, though, I already find to be quite interesting/revealing. You can see the contours of e.g. a tree exactly, even without having any imagery laid onto them: https://snipboard.io/tPsRBo.jpg

[1] For those that can read Dutch, how the Actueel Hoogtebestand Nederland is made: https://www.ahn.nl/ahn-the-making-of

Impression for those that don't want to wait for the application to load: https://lucgommans.nl/tmp/prague3d.html (5MB, 10s mp4 of a square in Prague)

A bit choppy because of the basically nonexistent GPU, and I just made it with xdotool (moving the mouse straight/consistently) while recording the screen, but I'm quite impressed with the level of detail of this 3d map!

Right now? For broad applicability it is the computational overhead. There are some applications that are doable now, such as reading data anonymously from a small-ish dataset (or a low-volume service where you can afford to wait a minute for an answer, or using really expensive hosting).

An example of that was a Wikipedia server that someone made which would serve you pages without the server knowing which page your client was actually after (https://news.ycombinator.com/item?id=31668814 4 months ago, 119 comments). It's still not really efficient; you can't simply swap out the real Wikipedia for this system and expect it to simply work.

> the server [needs] to scan through the entire encrypted dataset [for every request] (this is unavoidable, otherwise its I/O patterns would leak information)

Imagine Wikipedia servers needs to read every byte written on Wikipedia and operate on it before being able to formulate an answer to a random pageload. Additionally, if I remember correctly, things like autocomplete worked by just downloading the entire list of articles and doing that locally. It's all not impossible, but not a drop-in solution.

And then when you have a situation where you can practically apply it, there aren't popular/trusted/already-audited software packages out there for you to just use with confidence.

Ah, another one for my list, and this one from a big vendor like Cloudflare!

On my to-do list is a little project that takes many password "managers" like these, which are really just hash functions with an interface (called "vaultless" here), takes as second input a dump of password hashes that nobody has cracked yet, and goes to down the hashes list trying the usual password list but running it through these "managers"' algorithms first. I wonder how many people turn out to use weak passwords as their master key for this sort of thing. Maybe this is more clear:

    foreach linkedin_hashlist as hash do
      foreach brainpwdmgr_algorithms as algo do
        foreach wordlist as word do
          c = algo(pwd=word, site='linkedin.com')
          if c == hash then
            print(c, word)
          fi
        end
      end
    end

If the --password input for these tools is guessable, an attacker can use this to retrieve the key that this tool will generate for any website. I can then go on and try likely usernames (I've already got one, presumably) on various sites with what I know is probably the correct password. A handful of failed logins per website don't attract attention, and I'm already virtually certain of the login credentials.

This "gokey" does have the option to add a seed file, which would make such an attack impossible if generated securely. How many people use that option is the question. In the readme the seed-file-less mode is labeled as the "simple mode", perhaps that sounds attractive to some readers that don't realize the danger of the simple mode (kind of sounds like "default mode", when you don't want fancy options, just a standard password vault?).

(If someone wants to steal this idea, feel free to pick it up of course; the actual work is in the execution as always.)

(If I would guess at the meaning behind your question given the examples mentioned, the short answer would be: I'm not so fanatical about privacy that I prefer complex glitchy software with missing features over software that has proper encryption but uses a central set of servers.)

Element is a world of UI glitches. At least encrypted chats are functional now (until ~last year, decryption errors made it close to useless without a fallback channel (e.g. Signal) for the person you're trying to chat with). Still, no search in the Android or web client (only on iOS for some reason)....that is, unless you just don't turn on encryption! So it's not a serious option for me. I use it with one person, who has it on iOS and so occasionally gets requests from me "hey what was this thing again we talked about regarding xyz". We also both have Signal to fall back to on occasion. I don't remember if calls work or if those are encrypted nowadays, weren't they partnering with Jitsi here, and Jitsi's e2ee is still in the works last I heard/checked?

Briar is this Tor or mesh thing right? That's very feature-limited since Tor cannot reasonably support calls (the experience would be like trading voicemails). Mesh is very, very cool tech (I love self-supporting things) but there are no nerds close enough (that I know of) that I could actually talk with them practically using the mesh, even if I was willing to break the law on transmission power (and both phones would support that... like, even theoretically I can't generally use this). I think I did try Briar because sometimes you want to chat with someone in wifi range but outside of network coverage. Since I don't have Briar installed, even that must not have worked between me and my girlfriend's phone. I vaguely recall some device discovery issues but I've tried all the available mesh apps on f-droid so I may be mixing things up.

Threema is pretty crappy as well, but by the Telegram standard I've been used to (back when I believed the missing encryption was just growing pains and they'd get around to it any day now), there's nothing remotely close to feature parity anyway. Threema does fail at basic usage for me, though, which is any kind of functional notifications and a functional desktop client.

Yet I think it's important to have more than one option out there (the "one option" around me is facebook's whatsapp) and I'm happy to accommodate anyone that uses some open source chat system. I'm less okay with people that request I install some proprietary messaging solution just to talk with them. (If we wanted to chat and you've got Briar, sure yes I'm totally installing that, even if it has issues that make me not use it as my primary system.) I've got Threema out of curiosity, initially I wanted to see if I could avoid Signal's connection bugs and Wire's glitches, though today I only still use it for one contact whose Signal does not receive my messages at all.

What Threema has going for it, is that it's not using USA infrastructure, which is quite unique for centralized chat software (for better or worse, at least now you have a choice), and nearly as stable as Telegram: things generally just work as designed (major exception being notifications). Features are fairly extensive so that would almost make it a serious option for my primary messaging system, though the two missing essentials are what kill it for me.

The only usable systems, when I last checked ~2 years ago, were Wire and Signal, each with unique but surmountable downsides (Wire is sluggish and more glitchy and much less of a network effect; Signal misses features like message editing and silently suffers regular connection issues). Everything else I know of is not usable for my family (bad UX and/or glitches that'll throw them off), not encrypted (Telegram), missing features (e.g. video calls, search, desktop client), or unusable due to instability (Matrix until recently, though still not a great experience on my friend's home server).

Screenshot: https://snipboard.io/my8dLf.jpg because the page is huge and takes a while to load.

Just noticed this while scrolling through the diff. Apparently info about an f-droid variant was already committed to the repository readme two months ago. There is no blog from Threema yet, though the most recent post[1] about a push service is relevant since that was a prerequisite for making an f-droid version work.

The f-droid version will not depend on Google and uses your system's emojis rather than bundled graphics. Of course it will also not have(/need) the self-updater.

For me, notifications have not been working so I am very excited for this new push service that will be coming in the f-droid release :)

[1] https://threema.ch/en/blog/posts/threema-push

Most certainly, too many to count. A few are on github, e.g. https://github.com/lgommans/mountall.sh, various others are on https://lucgommans.nl/p/

If you're just having a look around, I might recommend to start with

- the hangman solver as a funny random example https://lucgommans.nl/p/hangman-solver/ (for a game to try it on: apt install bsdgames && hangman)

- https://dro.pm

I use 'cau' a lot myself for 'inline' footnotes in chats, e.g. https://lgms.nl/p/cau/?Look+at+how+much+data+I+can+fit+in+th.... but I could see how most people would not use my server for that. Feel free to steal the code! https://lgms.nl/p/cau/?source

I'd be curious to know how many people haven't made the equivalent of https://lgms.nl/p/ip/, at least if you're from before when icanhazip became popular

If you've ever ctrl+c'd restic, you'll know the message

> signal interrupt received, cleaning up

Makes perfect sense. Restic kind-of supports this because you can just kill the client after an hour and, tomorrow, it'll see which objects are there already.

I'm not deep enough into the project to know whether this is like an officially supported use-case, but restic was of course made with the idea that interruptions can happen (your computer can crash) and should be handled safely, and for the deduplication it'll cut files up in a deterministic way and thus (as I understand it) store those chunks in a deterministic place.

Depends which back-end you use and which configuration. (Assuming "node" here means a backup client and not a backup-hosting server.)

If you just put stuff on some standard storage (FTP, B2, etc.) without any permissions set up, then no backup client could stop the attacker from using the credentials you've deployed to the backup client to login to your storage and delete your backup files. This is not really specific to restic.

Accessing old files from a backup client is a weakness. Though, personally, I don't store things on a system that this system is not supposed to know, so if someone compromises this system and they see data from the past year... that's nearly the same as just seeing the data that is on this system today. Nevertheless, this could be solved by using public keys, so the backup clients has an encryption but no decryption key (of course it's not as trivial as this sounds, e.g. how could it still do deduplication etc.), but restic does not do this.

There is also https://github.com/restic/others which has some keywords (e.g. is it encrypted, does it do compression) for most FOSS backup solutions. It can be outdated or incomplete for some entries, though.