Hacker News Reader

notherhackon OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

Looks like Debian and some other distros are still on the vulnerable 3.5.4. Why did Openssl publish before the distros rolled to the fixed version?

notherhackon BU-808: How to Prolong Lithium-based Batteries (2023)

Reminds me of “Chargie”, a gadget that goes inline with your USB charging cable and controlled by an app on the device to limit the charge level to whatever you choose. I think it was born via kickstarter.

  “The most Intelligent Battery Health Protection for Phones & Laptops”
  https://chargie.org/

notherhackon Wall Street braced for a private credit meltdown. The risk of one is rising

https://archive.is/lDnax

notherhackon Prediction: Microsoft will eventually ship a Windows-themed Linux distro

Clickbait spoiler: "I predict that within 15 years Microsoft will discontinue Windows in favor of a Windows themed Linux distribution."

notherhackon Postal Arbitrage

The lowest I found is two clip-on CAT5e cable termination jacks for $0.80 + 0.08 tax. Available in a rainbow of colors and shipped free to Seattle by Sunday if you order in the next 10 hours. https://www.amazon.com/dp/B08T63ST97

Or 3.5oz filet mignon flavor dog food for $0.84+tax with FREE two day delivery. https://www.amazon.com//dp/B07VBFLCKT

Beat that!

notherhackon Ask HN: Is it time for HN to implement a form of captcha?

That extension already exists and works well. “Comments Owl for Hacker News”

notherhackon Upcoming Changes to Let's Encrypt Certificates

That was a smart move but those days are over. Your existing 15 year certs will continue to be accepted until they expire but then you'll have to get a new cert and be in the same 45-day-churn boat the rest of us are.

notherhackon Upcoming Changes to Let's Encrypt Certificates

The other CAs with a free tier that I'm aware of (zerossl, ssl.com, actalis, google trust, cloudflare) require you to have an account (which means you're at their mercy), and most of them limit the number of free certs you can get to a very small number and don't offer free wildcard certs at all.

There really is no alternative to LE.

notherhackon Memories of .us

Cloudflare refuses to accept most locality based domains as delegated because they aren’t listed in the Public Suffix List[1]. So for example you can’t use Cloudflare DNS or get a TLS cert for it from them.

Fortunately they seem to be one of the few (only?) providers who does that. So use another DNS provider and Letsencrypt and you’re good to go.

[1] https://en.wikipedia.org/wiki/Public_Suffix_List

notherhackon Notes on the Troubleshooting and Repair of Computer and Video Monitors

(2009) And this is about CRT monitors. Is there something like this for the LCD monitors we all use today?

notherhackon Show HN: Wealthfolio 2.0- Open source investment tracker. Now Mobile and Docker

I gave the iOS app a spin. 1. It requires at least 2 characters to search for a symbol. What about Verizon (V) or AT&T (T)? 2. I entered a holding for a fund that doesn’t have public quotes by choosing not to look up the symbol and entering the price and purchase date, but then I couldn’t find a way to manually add price quotes for later dates to reflect the change in value.

notherhackon Firefox expands fingerprint protections

https://github.com/stoically/temporary-containers/wiki/Autom...

notherhackon A Lost IBM PC/at Model? Analyzing a Newfound Old Bios

The blog refuses connections from VPNs. https://archive.is/Ef75R

notherhackon An eBPF loophole: Using XDP for egress traffic

For NAT (Network Address Translation) or any other packet header modifications, you need to recalculate checksums manually

Why doesn’t checksum offload in the NIC take care of that?

notherhackon Türkiye will not sell rare earth elements to the USA

"Trusted with its best technology"

No. The US kicked NATO member Türkiye out of the F-35 program and denied them F-16 upgrades for a long time[1]. And the EU has denied Türkiye membership supposedly because they're not fully part of Europe (among other issues) while courting Georgia which is farther east. Türkiye is treated as a frenemy by the west. Good on them for making their own way.

[1] https://balkaneu.com/turkeys-f-16-deal-stalls-as-focus-shift...

notherhackon Rats filmed snatching bats from air

Snakes do it too. https://www.nationalgeographic.com/animals/article/kantemo-b...

notherhackon TurboTax’s 20-year fight to stop Americans from filing taxes for free (2019)

Refusing connections from VPNs is a baby step in the wrong direction.

  The connection has timed out
  An error occurred during a connection to freetofile.com.

notherhackon Map of Near and Middle East Oil 1965

"Verification failed. You cannot access this page."

notherhackon If you are harassed by lasers

Is there an effective anti-IR coating for eyeglasses like there is for UV? Seems like a good thing to have but a web search doesn't turn up much. It might interfere with facial recognition, but maybe that's a feature.

notherhackon Linux Ready to Upstream Support for Google's PSP Encryption for TCP Connections

For anyone else who's wondering what PSP is, from the Google spec[1]:

  The PSP Security Protocol (PSP) is a security protocol created by Google for encryption in
  transit. PSP uses several of the concepts from IPsec ESP to provide an encryption
  encapsulation layer on-top of IP that is streamlined and custom-built to address the
  requirements of large-scale data centers.

So "PSP" really is a recursive acronym for "PSP Security Protocol". eyeroll

[1] https://raw.githubusercontent.com/google/psp/main/doc/PSP_Ar...

notherhackon AMD Begins Plumbing APCI C4 Support in the Linux Kernel for Power Savings

s/APCI/ACPI/. How embarrassing for them.

notherhackon Gentoo AI Policy

Important point. A lot has changed in coding AIs since then.

notherhackon EU court rules nuclear energy is clean energy

Maybe there’s a deal to be made where France builds and operates nuke plants in the US and handles the spent fuel as well. They’ve gotten quite good at it, and that could bypass a lot of the regulatory quagmire tied to a new home grown design and the reprocessing hazard.

notherhackon Toxic "forever chemicals" found in 95% of beers tested in the U.S.

And by "95%" they mean 22 out of 23 beers tested.

notherhackon ICE is using fake cell towers to spy on people's phones

" So far Rayhunter has not turned up any evidence of cell-site simulators being used to spy on protests in the US — though we have found them in use elsewhere. ... But we’ve received reports from a lot of protests, including pro-Palestine protests, protests in Washington DC and Los Angeles, as well as the ‘No Kings’ and ‘50501’ protests all over the country. So far, we haven’t seen evidence of CSS use at any of them. "

notherhackon Harvey Mudd Miniature Machine

I was hoping for Harry Mudd's android-making machine from Star Trek OG. https://en.wikipedia.org/wiki/I%2C_Mudd

notherhackon ICE is using fake cell towers to spy on people's phones

SAN doesn't say where the unusual tower traffic originated. Does the Marlin system attempt to geolocate and identify the suspicious transmitters?

Could the regular mobile tower operators collect subscriber identities at will via their regular gear, with no stingray vans or warrants required, and save the information for later? That seems to be how it's done with the other subscriber location and communication contents that they collect.

notherhackon ICE is using fake cell towers to spy on people's phones

The Forbes article says ICE acquired mobile cellular surveillance equipment and services under the Biden administration, and there have been IMSI catchers detected at demonstrations for a long time, for example at the Dakota Access Pipeline demonstrations in November, 2016[1]. It's not a new thing.

[1] https://www.justsecurity.org/34449/investigating-surveillanc...

notherhackon Freeway guardrails are now a favorite target of thieves

Is that really how cat theft works- thief gets a couple hundred and it’s smuggled offshore and broken up for raw materials to make new cats? Why can’t the thief sell to a local shop for $1000, to repair maybe the very car it was stolen from? Are cats serialized and tracked?

When I was in Central America people would steal windshields from cars left outside at night. New replacements were very expensive because of import taxes but you could just go to the nearest shady shop and what do you know, they just happen to have a used one for your car in stock!