HNHacker News
TopNewBestAskShowJobs

oogali

971 karma · joined March 29, 2010

meet.hn/city/40.3496953,-74.6597376/Princeton
submissionscomments
oogali··on RubyGems is not vulnerable to the xz/liblzma backdoor
The flip side is companies that are not active participants in the open source community (but know they use open source), are pinging all their engineering managers and asking "are we exposed to this!? how do you know!?".

So while it's useless noise to you, it's likely triggered by being on the receiving end of communications like "Hey, my boss is asking if $PROJECT is vulnerable because of a terrible article he read in $MAINSTREAM_MEDIA_PROPERTY?" times however many bosses are harassing their reports.

"I don't want to craft an email reply to every single person, just put up the no-op blog post and be done with it."

oogali··on M 4.7 earthquake 7 km NNE of Whitehouse Station, New Jersey
I felt it in Central NJ, and my wife in NYC felt it as well.

The submitted reports show it stretched from Fairfield County, Connecticut to New Castle County, Delaware.

https://earthquake.usgs.gov/earthquakes/eventpage/at00sbh3yv...

oogali··on Xz/liblzma: Bash-stage Obfuscation Explained
I've generally seen this with Unix installers from commercial software vendors.

You get a giant .sh file that displays a license, asks you to accept, then upon acceptance, cats itself, pipes through head/tail, into cpio to extract the actual assets.

oogali··on Xz/liblzma: Bash-stage Obfuscation Explained
Furthermore, the attacker covered their tracks on the initial payload with an innocuous paragraph in the README. ("Nothing to see here!")

    bad-3-corrupt_lzma2.xz has three Streams in it. The first and third
    streams are valid xz Streams. The middle Stream has a correct Stream
    Header, Block Header, Index and Stream Footer. Only the LZMA2 data
    is corrupt. This file should decompress if --single-stream is used.
The strings of `####Hello####` and `####World####` are there so that if you actually follow the instructions in the README, you get a seemingly valid result.

    $ cat tests/files/bad-3-corrupt_lzma2.xz | xz -d --single-stream
    ####Hello####
They're shell comments so it won't interfere with payload execution.

And lastly, they act as a marker that can be used by a later regex to locate the file _without_ referencing it by name directly nor using the actual Hello and World strings.

    $ gl_am_configmake=`grep -aErls "#{4}[[:alnum:]]{5}#{4}$" $srcdir/ 2>/dev/null`
    $ echo $gl_am_configmake
    ./tests/files/bad-3-corrupt_lzma2.xz
oogali··on Apple announces ability to download apps directly from websites in EU
The AT&T you see today is a completely different company. For all intents and purposes, it is SBC (Southwestern Bell Communications).

In 1996, Bell Labs, Western Electric, and AT&T Technologies were spun out to create Lucent.

Lucent merged with Alcatel to form Alcatel-Lucent in 2006.

Alcatel-Lucent was purchased by Nokia in 2016.

AT&T Wireless was purchased by Cingular in 2004 (joint venture between BellSouth and SBC).

The original AT&T was purchased by SBC in 2005.

The new AT&T (SBC) bought BellSouth in 2006.

oogali··on Rolldown: Rollup compatible bundler written in Rust
A friend once explained this concept to me as “strong opinions, weakly held”.
oogali··on US prescription market hamstrung for 9 days (so far) by ransomware attack
Change Healthcare is a transaction clearinghouse, or effectively an API, translation, and routing gateway.

Think of it as a private SWIFT vendor.

They were acquired by UHC, which is why you see the Optum name. But this is not specific to UHC/Optum patients.

Providers (hospitals, doctors, software vendors) interface with CH’s REST+JSON APIs and in turn CH emits EDI records to the insurance company backends (and translate the responses from EDI to JSON/XML/etc).

This affects general healthcare EDI messages (claims, benefits eligibility verification, ACH notices, etc).

The people impacted do not have direct EDI implementations with the insurance companies. If they did, they could side step this.

Or even a different clearinghouse.

Edit: clarified some ambiguous terms

oogali··on Testing the F-35C Tailhook
I think if you want endless war you would increase the numbers of your armed forces by several orders of magnitude.

Not spend very large sums of money on things piloted by 1-2 people that can end wars relatively quickly.

oogali··on U.S. opens UnitedHealth antitrust probe
I’ve been getting exposure to this space and the backend systems that drive it. It is mind-bogglingly dysfunctional.

Aphyr recently provided a limited window[1] into the level of dysfunction that happens with one of these behemoths that are the result of 100+ mergers, acquisitions, spinoffs, and joint ventures.

I feel terrible for the providers who have to try to navigate these antics.

In my opinion, all of this contributes to two primary “bad” things: 1) increased rates of retirement from older physicians who don’t want to deal with this anymore (despite wanting to continue practicing for 5-10 more years), and 2) consolidation of physician practices into larger entities as a way of coping which inevitably leads to the entity being acquired by a hospital and absorbed into another behemoth of an organization.

Both make it hard for individuals to receive consistent, quality care.

1: https://aphyr.com/posts/368-how-to-replace-your-cpap-in-only...

oogali··on U.S. opens UnitedHealth antitrust probe
Wait until people catch on to the behemoth that is CVS Health…
oogali··on A peek at Intel's future foundry tech
A Stuxnet redux.
oogali··on Wi-Fi jamming to knock out cameras suspected in nine Minnesota burglaries
You can remove the “data” qualifier — they yank hard on any and all cable.
oogali··on US Employers Brace for 16M Super Bowl Sick Days
Or move it to Saturday.

Give us the weekend to get it largely out of our systems.

oogali··on Saving Electricity (1998 – 2023)
> And... they don't smell bad?

If you do not regularly clean the rubber gasket _and_ leave the door open to dry out the rubber completely, you end up with a smelly, slimy mixture of clothing lint-infused mildew.

> Frankly the most important difference to me is this central axis in American top-loaders and which clothes wrap themselves and which always ends up destroying elastics.

You can buy modern top loaders do not have an agitator that destroys clothes.

https://www.bhg.com/impeller-vs-agitator-washing-machine-748...

oogali··on How I write HTTP services in Go after 13 years
I agree that too many arguments to the constructor may have the smell of too much coupling.

But if I really feel I can't avoid the need to pass a good amount of external context, I create a dedicated "options" struct and pass that into the constructor as a pointer. The purpose of the pointer (rather than pass by value) is if I want default arguments, I can pass nil.

    type ServerOptions struct {
        logger    *magic.Logger
        secretKey string
    }

    func NewServer(options *ServerOptions) (*Server, error) {
        ...
    }
oogali··on Ofsted inspectors 'make up evidence' about a school's performance when IT fails
https://en.wikipedia.org/wiki/Goodhart%27s_law#Generalizatio...
oogali··on Ofsted inspectors 'make up evidence' about a school's performance when IT fails
The scapegoating happens because the software is the one "tangible" thing in the chain of blame. It's the one thing that can't be queried and reply with "if I had known...".

I do agree with you that Ofsted will likely use the same deflection tactics.

It is a failure of all of the humans involved. Whether it is inadequate acceptance testing, prematurely closed bug reports, optimizing for [unreasonable] timelines, or lack of oversight (and to be clear, I am not advocating for micromanagement).

I feel both of these statements are true: 1) certain people bear more fault than others and 2) developers aren't blameless.

I would like us to reduce our "blame surface area" with a reasonable amount of effort over what we _can_ control.

oogali··on Ofsted inspectors 'make up evidence' about a school's performance when IT fails
I hope people think more about cases like this and the Post Office when they go to say “it’s not like we’re curing cancer” or “my bad code isn’t a matter of life or death”.

You might be far removed from the implications of doing a poor job but that doesn’t mean everyone else is.

oogali··on Cloudflare lays off new hires
It's the first full work week of the new year.
oogali··on New data shows walking down 36% in USA since 2019
I could totally be off base here but the more frequently you need to make a trip, the less likely you want to drive to complete it, and therefore pine for something in close distance, regardless if you have access to an automobile or not.

Specifically, in the context of retail, what a retailer stocks (e.g. in a supermarket) or produces (e.g. a sandwich shop) is a function of how much space they have to pay for and how many customers they can get through the door.

For example, our expectation of a supermarket is one that carries everything we may possibly want on our grocery list. Whereas our expectation of a regular market, is the limited selection that covers most of what we need. Apologies for the contrived example but the point I’m trying to make is those of us who live in denser areas are used to walking to one of these locations, or making more frequent trips, or both, but it’s not the same feeling for the other.

Putting a bike lane next to a supermarket isn’t going to dramatically increase the number of cyclists nor customer foot traffic in relation to what the store already receives. The people coming to a large supermarket are potentially buying a large weight of items across different categories.

Even if there was a targeted approach that was marketed towards cyclists (“50% off your entire order if you show up in a helmet and racing attire”, or something extreme of that nature), I don’t think that would move the needle meaningfully because the resulting transactions wouldn’t achieve a hypothetical ideal kg-per-customer ratio (or even a repeat customer multiplier).

This would create a situation in which the store has too much product or if you go in the opposite direction of purchasing less product: unappealing empty shelves.

So as long as retail density remains low due to limits on how small a landlord is willing to subdivide available space for a tenant, the retailers will continue to engage in business activity that potentially encourages driving via loading up bulk/heavy items, or casting a very large advertising net to attract people outside of walking/biking distance to pack a place. Both of which the end goal is to at least cover their overhead.

When you examine dense European cities, I’m not sure you find retail shops that have the same square footage compared to American retail shops. They’re sized (and configured) to cover their overhead by servicing a small amount of customers at a time. If you were to offer an American-sized lease to a European retailer, my guess is they would turn it down unless they were already a very, very popular spot with lines out of the door.

In these conversations, I think the general focus should be on what’s occupying the physical destination (and its size) rather than availability/quality of public transit. Since in some places, the transit exists but the impetus to actually use it is minimal.

oogali··on Jeff Lawson steps down as CEO of Twilio
This is likely because of industry regulations around A2P (application-to-person ) messaging that had a due date of August 31, 2023.

It's not just Twilio, you would have experienced this with nearly every SMS API provider. Across the different vendors I work with, I received numerous emails from each one advising me to come into compliance or risk my messages being rejected.

https://help.salesmessage.com/en/articles/6650461-changes-to...

https://www.telgorithm.com/news/10dlc-registration-required/

https://support.referrizer.com/support/solutions/articles/10...

oogali··on IDEs we had 30 years ago
Apologies for not clarifying -- the last release of Netbeans prior to the Oracle acquisition of Sun.
oogali··on IDEs we had 30 years ago
Netbeans was my absolute favorite IDE for Java development. After its last release, I honestly felt lost.

I’ve gotten back up to speed via IntelliJ but it still doesn’t feel as effortless as it did in Netbeans. And way less care and feeding than Eclipse.

Sorry, there’s a lot of “feels” in this post but for me, Netbeans was the one Java IDE that I didn’t have to fight with.

oogali··on Telecom Industry Is Mad Because the FCC Might Examine High Broadband Prices
Not necessarily defending them, but taxes vary depending on state, county, city, and/or taxing district, against a matrix of what type of service is being sold and what revenue limits, if any.

Then add another level as you're not being sold service by Spectrum but Spectrum of New York, and variable tax/fee contributions depend on total revenue of that subsidiary (e.g. Universal Service Fund[1]).

It can be fairly complicated in a static state, but then add in new/pending legislature and it's something that needs to be updated monthly.

Yes, they already do that work internally (and if they get it wrong, the government taxing entities tell them they are miscalculating the amount and assesses penalties and fees) but publishing it adds a new dimension.

1: https://sourceadvisors.com/blogs/salt/what-is-the-federal-un....

oogali··on Telecom Industry Is Mad Because the FCC Might Examine High Broadband Prices
It varies city-to-city, ISP-to-ISP.

When I lived in NYC, I paid $65/month for 200Mbps down, 20Mbps up (Spectrum).

I moved 50 miles south into NJ and I now pay $99/month for 1Gbps down, 1Gbps up (Verizon).

An acquaintance lives in Houston, TX and pays ~$300/month for 5 Gbps down, 5 Gbps up (Comcast).

That said, you will find people who have happy stories about Spectrum/Charter/Cox, and terrible stories about Verizon/Comcast all across the US.

oogali··on The next power plant is on the roof and in the basement
In the US, the national electrical code (NEC) has been updated to mandate an externally available power shutoff at all new construction (or extensive renovation) regardless if solar is present or not.

This is not the source document, but a summary and it includes the relevant passage: https://kbelectricpa.com/emergency-disconnect-requirements-f...

oogali··on Should I replace my 56k modem with a 28.8K Modem? (2001)
My guess is the telecom vendor your school selected told your school’s IT and purchasing teams that their new phone lines cannot handle modem connections, so they would be obligated to buy a separate IP connectivity service from the same vendor.

Being the early 90s, technical expertise about Internet connectivity was sparse and they most likely entered into a contract with this vendor on the strength of their statement.

They were now surprised to find out the truth: that they could’ve kept using their existing paid-for modems instead of upgrading to a new, expensive, high-speed Internet, access circuit tied to a multi-year contract and all the requisite equipment that came along with that.

oogali··on The FTC sues to break up Amazon over an economy-wide “hidden tax”
To shine a little more light, what you're referring to is called a minimum advertised price policy, or MAPP.

And as you've stated, it's done by anyone who publishes a MSRP.

https://www.deltafaucet.com/for-professionals/product-resour...

https://assets.ctfassets.net/zlhl2y58oyef/3wENIXr7qvqyOoVD6R...

https://www.pricespider.com/Blog/map-policy-faqs/

oogali··on Everyday uses for PVC water pipe
If you have a water dispenser (through a refrigerator), do you fill and dump two glasses before getting yourself a glass of water to consume?
oogali··on 40 Years of Koyaanisqatsi
I didn't realize that was the source video for this other video I periodically watch (https://www.youtube.com/watch?v=uY8ENJK0hvM).

TIL.

← PreviousPage 2 of 8Next →