HNHacker News
TopNewBestAskShowJobs

mdb31

484 karma · joined May 12, 2012

submissionscomments
mdb31··on VCR Virus Fake VHS Copy-Protection Warning Label (2016)
Reminds me of the "danger, radiation!" warning sign a local laundry put on its doors.

Probably pretty effective in dissuading intruders. But, they got shut down earlier this year with a "seized by the authorities" action typically reserved for drugs/arms dealers.

So, as with this copy protection label, I guess the effectiveness greatly depends on your target audience...

(Side-quest: would it have been possible to mount some kind of side-channel attack against VCRs? Over-driving the video/audio signals to blow up the CRT/speakers would be an obvious one, but would this also be possibly ONLY on copies and/or copier equipment?)

mdb31··on Celebrating 40 years of ZX Spectrum
The Spectrum was probably the last computer I truly understood. Not at a hardware level (too young for that, plus the Spectrum squeezes so much functionality out of the cheapest chips available at the time that it's not trivial to reverse-engineer what was going on even today), but just the software bit.

16 Kilobytes of ROM, which (with, I think, a whole KB to spare!) implemented a pretty functional BASIC environment. This was good, but still had significant limitations, especially when looking at all the cool stuff other people were doing.

At age 12 or so, I became absolute fascinated with a pretty simple thing: Spectrum programs included a 'loading screen' most of the time, which, while being loaded from tape at a leisurely 100bps or so, populated the screen top-to-bottom, left-to-right, pixels first, then (color) attributes, as per the layout of the video RAM. However, some games loaded the screen in reverse, or did not incrementally show the screen content while loading at all!

The latter problem was the easiest to solve: instead of loading directly from tape (the header of which included the base address) into video RAM, those programs would use an alternate base address, plus a small program to copy the contents afterwards. The former was way, way more tricky, and required the realization that you did not need to use the actual ROM code to load from tape, but you could disassemble/change that code, include it in your own program, and make it do whatever you want!

This realization enabled me to implement my own 'speed loader' (bumping tape I/O speeds from 100bps to, like, 111!), in addition to the usual fare of removing copy protection from programs and cheating at games by adding extra lives, removing barriers, or just fixing broken levels (waves at Jet Set Willy).

Is a Spectrum a useful computing device today? Absolutely not, and it hasn't been for over two decades or so. But that's not the point of all this nostalgia: it's the fact that it instilled a "Hackers mindset" in me and many, many others.

mdb31··on A day after he bought electric scooter, man killed in battery explosion
Yes, there really needs to be some form of certification for lithium-ion (and other...) batteries used in personal transportation devices.

The recipe is really simple: insufficient structural integrity of the entire product leading to flexing the battery pack, leading to a short-circuit in one or more cells, leading to a violent-and-very-smokey fire.

The previous scare was with "hoverboards", where kids burnt down their parents' houses after bumping into something. And now it's apparently e-scooters, which are a bit more difficult to dismiss as "just a fad toy"...

In any case: safety markings are not just rent-seeking behavior. In some cases, certification (and subsequent enforcement of the presence of authentic markings) are literal life-savers.

mdb31··on Embedding information in text documents using glyph perturbation (2018) [pdf]
"Provided a text document with specific fonts" is doing a lot of heavy lifting here.

Pretty much by definition, text documents don't supply fonts. So, reading text documents is still fine, unless your OS "helpfully" opens text documents using rich text viewers, in which case: please talk to your OS vendor.

For rich text documents, say PDF, the risk of personalized-and-or-remote embedded fonts is not exactly new. Maybe this variant is, but the general idea definitely isn't.

So, this, to me, is at best a possibly-novel "how to do DRM with PDF" technique. Which is interesting, but not exactly earth-shattering.

Or am I missing something here?

mdb31··on OpenBSD 7.1
Yup, there were some premature release announcements, but it seems it's really available now. (Note that OpenBSD releases come out twice a year, pretty much like clockwork, and that version numbers aren't indicative of the magnitude of the underlying changes: 7.0 was just the next release after 6.9).

Headline improvement for this version: it's fully supported on Apple Silicon. Not sure there is a huge market for that, but still pretty cool!

mdb31··on Cheat Engine contains GPL-licensed code but disallows commercial use
For anyone asking why enterprises disallow any code with the letters "GPL" anywhere near the license, here is your answer...

Is it GPL? GPLv2? GPLv2+? LGPL? AGPL? The majority will enjoy their absolute freedom... to stay far, far away from all that noise...

mdb31··on Taxonomy of In-the-Wild Exploitation
Interesting, and not just in the "memory safe languages will save the world" sense.

Most of my bugs are either in the category 'logic' or 'ux'. For the former, unit tests remain the best defense IMHO, but there's always that insidious class of data-driven logic bugs.

UX tends to be the most frustrating bug class. Like: there is a separate view in my app to allow users to do X. Yet, users insist on doing X by abusing feature Y, which gives a partial-but-sometimes-wildly-wrong result.

My solution to that is to obsessively monitor user action logs, and to modify the abused view to still give the right results (through an annotation) in case it detects the 'wrong' use case.

One day, I will figure out how to properly talk to customers...

mdb31··on Show HN: Stacktape – Full power of AWS with Heroku-like experience
Not sure what to make of this. Given the active security incident, is "Heroku-like" really a recommendation?

But even past that, what does this give me beyond AWS CodePipelines? All comparisons on the site seem to be against "raw" AWS ("weeks to months" from code to deployment, really?).

But, hey, maybe I'm misunderstanding both this product and CodePipelines. Myself, I'm on Azure DevOps (which I guess is the same as "MS Azure" as opposed to "Google Azure"?), and there I can deploy my aspnetcore app to production in, like, 30s. Today.

So, what can I look forward to in 2023 with this product?

mdb31··on Virginia police routinely use secret GPS pings to track people’s cell phones
"We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time."

Oooh, wait until they hear about CCPA... (but anyway, I'm sure the 'secret GPS pings' are just plain-old stealth SMS, and we're all better off not reading TFA in any case)

mdb31··on List Of Adhesive Tapes
Tangentially related point: the names of certain kinds of sticky tape are, similar to vegetables, pretty much inscrutable between English and other languages.

I've been looked at (and treated by) staff at Home Depot et al as a complete idiot for asking for 'repair tape' (which, of course, in US-English is 'duct tape', or, 'duck tape' if you really want).

One good thing about the Internet (yeah!) is that US-English terms for such items are now more or less commonplace. So, at least, if I ask for 'duck tape' (in English, in my native language it would still lead to much confusion...), I get the repair tape I need. Progress!

mdb31··on Twitter Should Open Up the Algorithm
I'm pretty sure the "algorithm" is "we count the number of end-user flags/reports, and if > X we remove it"?

Public knowledge of what "X" is doesn't really help, I think, other than to aid spammers? And a requirement to "talk to a human" upon hitting X would surely immediately degrade into "Google has reviewed your appeal and has determined that the infinite block of your account remains in effect. There is no further appeal"?

mdb31··on Monitoring the kernel.org Transparency Log for a year
So, I'm not entirely sure what this post is describing. It doesn't seem like there is a "kernel.org transparency log" in general, but it's something that the blog author is maintaining?

However, a "Git transparency log" does sound like a good idea at several levels. Is anyone else looking into this?

mdb31··on Twitter Should Open Up the Algorithm
Except that's not what's happening here. When doing anything on the internet "how are you going to control spam and obvious trolls" is question #1. Twitter has an answer to that: we mechanically and/or personally identify spam/troll content, and ban their creators.

Now, many people want them to stop doing that. Which they decline, since they KNOW what will be happening in that case.

So, if you think you can do a better platform, while disregarding the (minimal) lessons learned from Twitter (or Reddit, or...), go ahead! You will fail, not because "criticism of the original platform is off-limits", but because it's a well-known anti-pattern.

mdb31··on Twitter Should Open Up the Algorithm
Yes, like the lobste.rs moderation log. It's cute because, like, nobody cares.
mdb31··on Twitter Should Open Up the Algorithm
Oh my. Twitter, or any other platform, is not your megaphone that will amplify your opinion without restrictions. Don't like that? Start your own platform, and see how that turns out.

Related: yes, I do support interoperability requirements between platforms. No, that still doesn't mean you get to blast your opinion all over the internet without hitting a roadbump every now and then.

mdb31··on Self-calibrating USB Paper Tape Reader
Cool! Now I can finally get rid of some of the paper tapes holding my priceless PDP-11 BASIC programs. Not sure yet if I dare look at the results (not, mind you, because I think the reader may have failed, just that 11-year-old-me probably wasn't that great a coder as I assumed at the time...).

My only reservation is that I'm apparently supposed to feed the tapes (at a leisurely maximum pace of 2.2 miles per hour) by hand, like some kind of animal...

mdb31··on Human genes renamed to stop Microsoft Excel from misreading them as dates (2020)
Yes, but without inventing a time machine to go back to 1985 or so (at which time the safe option did not exist, so better invent temporal code backporting as well), that's not a viable option.

Any change to Excel's 'open a worksheet' logic would break so many workflows it's just not funny anymore. I'm not kidding if I say I suspect it would significantly impact several countries' GDP for a while.

Even the (sometimes comically inadequate) heuristics that Excel uses to auto-determine field types can't be updated, for very similar reasons. Backwards-compatibility is... interesting...

mdb31··on Human genes renamed to stop Microsoft Excel from misreading them as dates (2020)
PSA: if you use Excel as intended, you would just go File/New/Blank Worksheet, switch to the Data tab, then use the 'From Text/CSV' wizard to specify the data types for each column in your data source, neatly bypassing this entire issue.

But yes, just double-clicking the CSV from Explorer, using the legacy 'open this as a sheet' functionality, experiencing data loss and then complaining about it (and the state of Excel, MSFT and The World in general) on social media is much, much more fun...

mdb31··on Singleton Is a Bad Idea
Sure, as I said "a single static class: don't do that" -- however, the definition of a singleton, as per the GoF, is just "something that restricts the instantiation of a class to one instance".

Nothing about global visibility, and again, any decent dependency-injection framework should manage that well enough.

So, still mystified about all the singleton-hate here!

mdb31··on Singleton Is a Bad Idea
As a simple C# (and previously VB.NET, sorry not sorry) wageslave, I've never understood the disdain towards singletons. A single static class that is referenced all over the place (or, alternatively, some huge state object): sure, don't do that.

But given a semi-decent dependency injection framework, and a choice of lifetimes like 'singleton' (only one per container), 'transient' (as many per container as required per type) and 'scoped' (as many per container as required for transactions), do I really need to feel bad about the first choice?

My app only has a single task scheduler: that's sort-of important, as otherwise there is just chaos. So that's a singleton. Maybe not the same singleton depending on whether I'm running a test or the actual production app, but a singleton nonetheless. So what, exactly, is the big issue with that?

mdb31··on Re: Zlib memory corruption on deflate
Thank you very much! Sort-of surprising there is so much discussion about a long-fixed bug, yet, there we are...
mdb31··on No news is good news
I'm not sure we disagree? If you read The Economist weekly, you should be fine (although you can still be caught out not knowing about, say, today's Oscar's <tm, now go away> scandal.

But completely disconnecting from 'The News'? That won't work at all these days, I'm afraid. I quite vividly experienced this a while ago when I returned from living in the US to my native Netherlands: I was completely unaware of some extremely-popular local hit songs. So, when people quoted these to me, I just didn't get the reference, like, at all. This caused quite some awkward moments.

Now, magnify that experience to the world stage...

mdb31··on The ZedRipper
I love pretty much everything about this. From emulating a bunch of Z80s (a processor I know and love from my ZX81/Spectrum times...), to building it into an enclosure suitable for on-train use (in other words: how to tell me you're British without telling me you're British), to writing a modern hypervisor in Turbo Pascal.
mdb31··on No news is good news
Yeah, well, no. You can't really function in society these days without following 'The News' to at least some extent.

That doesn't mean you should buy into the '24h News Cycle' or the 'Extremism-inducing-filter-bubble', though. Myself, I don't pay any attention to 'The News', except as delivered on paper once-a-week via The Economist(1), and daily via their 'The World in Brief' email.

So, this morning, I learned that 'At one point an actor slapped a comedian, sending the internet into a frenzy' -- which is, like, all I needed to know, right?

Footnotes: (1) Yes, which is a relatively right-wing, centrist if you will, publication. I love it, especially disagreeing with it...

mdb31··on Re: Zlib memory corruption on deflate
This seems to be a minor bug, in that it is only triggered using unusual (and rather unlikely) deflate parameters.

But, looking into this bug, I was sort-of interested to see how it was handled. The change log for 1.2.12 (2022-03-27) indicates the issue was resolved ("Fix a bug that can crash deflate on some input when using Z_FIXED"). Yet, in what seems to be the canonical Zlib repository (https://github.com/madler/zlib), I was unable to find a corresponding commit.

None of commits this year (7, so not too hard to review) seem to be particularity meaningful changes, and in particular yesterday's 'zlib 1.2.12' commit seems to only consist of version/copyright updates.

So, does anyone have any idea where to find the commits related to the change log entry? (Note that I'm not disputing the issue is actually fixed, I'm just trying to improve my Github reading skills...)

mdb31··on Chrome 0day is being exploited now for CVE-2022-1096; update immediately
Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE
mdb31··on VoWiFi
Well, it is related to LTE, in the sense that VoLTE calls are treated as 'data' (and thus backhauled to your 'home' provider, as per your (e)SIM), whereas 'voice' calls are handled by whichever provider you happen to be connected to.

But the advice to always dial calls in 'international' format is helpful.

mdb31··on Dragonfire Internet Services: A Retrospective
If anyone wonders what it was like to operate 'an ISP' in the 1900s, this is pretty accurate for most small-time operations. Extremely limited bandwidth (because T1s and E1s were just too expensive: I remember paying 25,000 Dutch Guilders [at least US$ 8K at the time] for a 2Mb/s connection spanning just about 80Km), operators realizing this is not what they want to do with the rest of their lives, ultimately selling out to bigger parties.
mdb31··on VoWiFi
Yes, when roaming, VoWiFi or VoLTE can have quite unexpected results due to your 'data' being backhauled to your 'home' provider, for both billing and dialing. Former you can't do much about, except complain when things go wrong, but as for numbers: always store (and dial) these in +countrycode-subscribernumber (minus the leading 0, unless it's an Italian number, +39) format, and you'll be mostly* fine.

*Unless visiting countries that have providers with woefully misconfigured dial plans, say, Nigeria...

mdb31··on Show HN: Throw – The new space for asking and answering questions anonymously
Same here, failed with Firefox 98 and uBlock. But, worked OK with Edge 99 and no plugins, so...
← PreviousPage 2 of 4Next →