Hacker News Reader

meinersburon Git 3.0's upcoming SHA-256 default will be a costly mistake

Linus Torvalds in 2007:

> but the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, Okay, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get. ... [1]

[1] https://www.youtube.com/watch?v=4XpnKHJAok8&t=56m20s

So Torvalds used SHA-1 purely because he needed a hash function with no other property than identifying content.

meinersburon Revealing the details of how OpenAI agents hacked Hugging Face

I am surprised that a CAPTCHA is still an effective means for blocking today's vision-capable AIs.

meinersburon The case against JPEG XL

> I believe Web codecs should be purpose-built, efficient, and narrowly scoped to the needs of the Web.

The post downplays the usefulness of versatility. I disagree. I'd prefer not to play the "which image format is best for this image and this use case" game and having to transcode between them. For instance, it would be great if I could have an HTML gallery showing pictures of my files as I store them on harddisk. Today these are JPEG, because it's the lowest common denominator. WEBP, AVIF are not supported photography tools (e.g. https://support.captureone.com/hc/en-us/articles/36000262921...) and I don't expect support to ever be added since it is not formats intended for photography.

meinersburon Expert Witness to ChatGPT: "Show how 3M is 0 percent at fault"

https://archive.is/zKgVp

> During discovery in the case, Will Moye, one of the plaintiffs’ attorneys, found a five-page document called “Citation Overlay,” which appeared to have been generated by AI. Moye recognized the Citation Overlay document as being from ChatGPT, and demanded all of the prompts Autenrieth used from 3M’s lawyers. The deposition was paused for three hours while they were gathered, and Moye was given 350 pages of ChatGPT conversations that Autenrieth had when creating the report.

meinersburon Dear Richard Dawkins

Since ELIZA, the more we try to apply the Turing Test, the more evidence we get that the Turing Test about human gullibility, rather than saying anything meaningful about the machine [1,2]. Surprisingly it turns out that even critical thinker Richard Dawkins is quite gullible.

[1] https://medium.com/@innovariart/the-turing-test-no-longer-me...

[2] https://arxiv.org/abs/2405.08007

meinersburon Stack Overflow moderator publicly leaks private flagger information

Moderators seem to have not enough to do. They closed my 16 year (!) old question and added comment:

> Do not include solution to question please (post a separate answer instead). -- user4157124

https://stackoverflow.com/q/2224373/102498

16 years ago, questions with intentionally open answers were common and providing a summary in the question was seen as a courtesy.

meinersburon Binary obfuscation that doesn't kill LTO

They get their own build. E.g.

* GeForce NOW SDK: https://developer.geforcenow.com/learn/guides/offerings-sdk

* Stadia SDK: developer.stadia.com (offline)

* Xbox Cloud Gaming: https://learn.microsoft.com/en-us/gaming/gdk/docs/features/c...

* ...

Just like every Game Store requires its own build: Steamworks SDK, even GOG: https://docs.gog.com/sdk/

Some games allow browsing files locally for savegames, music libray, ... . Imagine if you could do that on the cloud VM.

meinersburon Our commitment to Windows quality

It has nothing to so with NTFS, but all with the Win32 API. The Windows kernel supports this file model, proven by WSL1. There is a blog post somewhere (Old New Thing?) stating the engineers would like to e.g. allow deleting a file even if there is still a program with with a file handle to it, but are concerned deviation from current behavior would cause more problems than it solves.

The reason that they want a reboot is that they do not want to support a system using two versions of the same library at the same time, let's say ntdll. So they would have to close any program using that library before programs that use the new version can be started. That is equivalent to a reboot.

And I completely understand the reason. For a long time when Firefox would update on Linux, the browser windows still open were broken; it opened resources meant for the updated Firefox with the processes runnung the non-updated Firefox. The Chrome developers mentioned [2] that the "proper" solution would be to open every file at start and pass that file descriptor to the subprocesses so all of them are using the same version of the file. Needless to say, resource usage would go up.

[2]: https://neugierig.org/software/chromium/notes/2011/08/zygote...

meinersburon WolfSSL sucks too, so now what?

This is the WolfSSL maintainer's response[1]

> This ticket is rather long and has a lot of irrelevant content regarding this new topic. If I need to bring in a colleague I do not want them to have to wade through all the irrelevant context. If you would like, please open a new issue with regards to how we support middlebox compatibility.

The author turns this into:

> The GitHub issue comment left at the end leads me to believe that they aren't really interested in RFC compliance. There isn't a middleground here or a "different way" of implementing middlebox compatibility. It's either RFC compliant or not. And they're not.

This is a bad-faith interpretation of the maintainer's response. They only asked to open a new, more specific issue report. The maintainer always answered within minutes, which I find quite impressive (even after the author ghosted for months). The author consumed the maintainer's time and shouldn't get the blame for the author's problems.

[1]: https://github.com/wolfSSL/wolfssl/issues/9156

meinersburon Do not put code diffs into Git commit messages

Reminds me of prompt injection: A tool that cannot distinguish between data and instructions.

meinersburon A case study in PDF forensics: The Epstein PDFs

The time advantage of faking a scan becomes better the more pages you have to scan.

https://xkcd.com/1205/

meinersburon France dumps Zoom and Teams as Europe seeks digital autonomy from the US

It doesn't matter whether OSS is American (in whatever sense) -- anything that is America-specific (e.g. server addresses) can be patched for a localized European version. The different commercial model does matter: American law does not apply (Cloud Act, National Security Letters, ...)

meinersburon Windows 8 Desktop Environment for Linux

Live tiles are nearly universally praised in retrospect, but it might be a case of hindsight bias [1]. The video [2] brings up some problems of the concept and why no other company copied the concept.

[1] https://en.wikipedia.org/wiki/Rosy_retrospection

[2] https://youtu.be/OgXlNaYXRu4

meinersburon Bricklink suspends Marketplace operations in 35 countries

The patent expired, but the minifigs is also a EU 3D trademark. This is not possible for the brick which (only) serves a technical function, namely to hold on each other. Trademarks do not expire while in use. Another example for a 3D trademark, also in this US, is the Coca Cola bottle.

[1] https://www.chaillot.com/ip-news/validity-of-3d-trademarks-f...

meinersburon US cities pay too much for buses

What is your alternative explanation for why people rent public storage space? Urban growth and growth in suburbs are not mutually exclusive.

meinersburon DXGI debugging: Microsoft put me on a list

Changing execution behaviour based on filename is common in Linux environments too. Some examples:

1. BusyBox is a single executable that executes different commands based on which symlink was used to call it

2. Bash puts itself into compatibility mode if invoked as "sh"

3. "ping" can be invoked as "ping4" or "ping6"

4. Some of git's subcommands are symlinks back to the main executable

5. Clang switches to C++ mode if invoked as "clang++"

6. AppArmor profiles activate on file paths

meinersburon YouTube addresses lower view counts which seem to be caused by ad blockers

From the GitHub issue it becomes clear that blocking happens by the EasyPrivacy blocklist. The blocked URL youtube.com/api/stats/atr is/can also be used for tracking users, this is why some are arguing that it legitimately on that blocklist.

The tracking not malicious. YouTube has a legitimate interest to verify views, e.g. to recommend popular videos to others. If a view counter was increased by just invoking an API, view counts could be manipulated easily. Also see the video [1] from ... 13 years ago ... so it might be slighly outdated. Just slightly.

[1] https://www.youtube.com/watch?v=oIkhgagvrjI

meinersburon It seems like the AI crawlers learned how to solve the Anubis challenges

Please don't downvote comments only because you don't like their opinion (reply to them instead). It cannot be that the same opinion is valueable when someone famous write it [1].

[1] https://news.ycombinator.com/item?id=44962529

meinersburon Sqlite3 will also read and write ZIP archives

Sounds like feature creep. Zip is not a database, at best its just slow. Use a archive utility to handle archives.

meinersburon Python performance myths and fairy tales

Is it just me or does the talk actually confirm all its Python "myths and fairy tales"?

meinersburon Mastercard deflects blame for NSFW games being taken down

They absolutely do have that infrastructure. They implemented every country's content rating system, such as PEGI, ESRB, ... . Games are regionally banned, such as in Germany [1]. Games can also have regionally censored games, typically for violence/gore in Germany [2]. With the strange effect that if you change your account's region, it re-downloads some of the games.

The legal situation with VPNs and traveling between regions is the same as with any internet service.

[1] https://steamcommunity.com/groups/foruncut/discussions/17/41... [2] https://steamcommunity.com/groups/foruncut/discussions/17/39...

meinersburon Tell HN: Gmail tampers with incoming email body content

https://help.zapier.com/hc/en-us/articles/8496101927181-What...

I don't think there is an official list. It is security-related and changes over time

meinersburon Tell HN: Gmail tampers with incoming email body content

GMail (and Fastmail) are rendering the email. It just happens that the email and we webbrowser are both HTML. In no case should they just literally forward the email HTML to the browser. They scrub JavaScript, non-whitelisted HTML elements, rewrite links/external resources including tracking pixels.

You can see the raw email with "show original" in the options

meinersburon Seriously, Why Do Some AI Chatbot Subscriptions Cost More Than $200?

There is also market separation in play: For the base service you only charge cost+small margin. For higher service levels you charge higher profit margins even though the additional service does not cost that much more to provide.

Best example: flight seats. Economy class fills the plane, but business and first class are the money makers [1].

[1] https://www.youtube.com/watch?v=BzB5xtGGsTc

meinersburon Games Look Bad: HDR and Tone Mapping (2017)

Researchers trained a deep learning network on photos to make GTA5 more realistic-looking: https://www.youtube.com/watch?v=P1IcaBn3ej0

I was surprised that most of it is is just tone mapping. It looks too green-ish to me, needing some white balancing, but realistic.

I think Video games are intentionally over-saturated and contrasty to make them look better, just as paintings are[1]. I took many screenshots in Horizon Zero Dawn that would be look bland if it was realistic like the modfified GTA5 footage above[2]. You also don't want animation movies[3] with realistic tone mapping. But for a horror game you would do exactly that, it's about immersion (or you would never be frightened), not beauty.

[1] https://www.reddit.com/r/horizon/comments/1ix7ms2/my_hzd_oil...

[2] https://www.reddit.com/r/horizon/comments/x97gi1/this_game_i...

[3] https://www.imdb.com/de/title/tt0892769/mediaviewer/rm284102...

meinersburon A valid HTML zip bomb

It will also compress worse, making it less like a zip bomb and more like a huge document. Nothing against that, but the article's trick is just to stop a parser to bail early.

meinersburon Fstrings.wtf

Just learned about the ellipsis statement and the !a modifier (I already knew !r and !s).

meinersburon The "Geometry" of Colours [video]

Result from game discussed at https://news.ycombinator.com/item?id=43745868

meinersburon Why email startups fail

> Email works perfectly

OMG. How can someone say this in the age of AI spam. Legitimate emails categorized a spam. Impossibility to run independent email servers because getting blocked by the big players. Forced subscriptions to mailing lists. Tracking through images....

meinersburon XSLT – Native, zero-config build system for the Web

There is a classic DailyWTF about this technique: https://thedailywtf.com/articles/Sketchy-Skecherscom

> [...] the idea of building a website like this in XML and then transforming it using XSL is absurd in and of itself [...]

In the comments the creators comment on it, like that it was a mess to debug. But I could not find anything wrong with the technique itself, assuming that it is working.