Hacker News Reader

orblivionon Ask HN: What are you working on? (October 2025)

Running OpenStreetMap off the grid (self-hosted to say the least) on a Raspberry Pi 500 (and maybe a Pi Zero 2W) for Internet In a Box:

https://www.linkedin.com/posts/danielkrol_openstreetmap-acti...

All of the street and satellite tiles are thanks to maps.black. The search uses Nominatim's sqlite3 mode. I was told that it's experimental only because it hasn't been tried in production yet, so I'm sort of testing it in the process. So far I'm only doing administrative boundaries and natural features, but so far so good! I'm going to slowly add a few more types of POIs, I just don't want the database file to get too big.

Note that Internet in a Box has an OSM offering already, but the data is five years old and the tech makes it harder to update. As of today, there are much easier options on the table, and we get cool stuff like 3d buildings. Also, the search was much more limited.

* https://internet-in-a-box.org/

* https://maps.black/

* https://nominatim.org/release-docs/latest/customize/SQLite/

orblivionon Everything that's wrong with Google Search in one image

The problem is, some of us do have a habit of asking our search engine for the weather. And we ruin it for the rest of you.

orblivionon Ask HN: Has anyone else been unemployed for over two years?

> Kicking around on a piece of ground in your hometown / Waiting for someone or something to show you the way

If it makes you feel any better, this song about the fleeting nature of time is fifty years old and Roger Waters is still touring.

orblivionon Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

For python I use Debian packages wherever possible. What I need is in there usually. I might even say almost always.

orblivionon A cryptography expert on how Web3 started, and how it’s going

Terrible compared to what? Mastodon is just fine for me. I'm an oblivious nerd here I guess. But I sometimes use Twitter too, can't say I find the UX refreshing by comparison.

orblivionon Malicious versions of Nx and some supporting plugins were published

I keep hearing different things about how well containers can isolate. I guess the "on their own" caveat is the important one. I don't really know how they work.

Hearing not to rely on it from the developer of secureblue is pretty strong case. Thanks.

orblivionon Malicious versions of Nx and some supporting plugins were published

As for setting things up multiple times - you can install stuff in the "Template VM" which is where the OS goes. Every "App VM" mostly just has files in their own ~/. Any changes an App VM makes to its system files won't affect other VMs, or even survive a restart. There are "playbooks" with Salt but I never figured that stuff out. If you pass around some setup scripts instead, that's an attack vector, but I don't think drive-by attacks like the OP would target something sophisticated like that yet.

orblivionon Malicious versions of Nx and some supporting plugins were published

The "Admin" of QubesOS (dom0) is in its own VM, and it doesn't have Internet access. Nothing you download from a browser in another VM can touch dom0 without a VM break. Each VM has its own file system. Even if you wanted to copy a downloaded file to dom0, Qubes makes you jump through hoops to do it.

orblivionon Malicious versions of Nx and some supporting plugins were published

Yeah I use Qubes for my "serious" computing these days. It comes with performance headaches, though my laptop isn't the best.

I wonder about something like https://secureblue.dev/ though. I'm not comfortable with Fedora and last I heard it wasn't out of Beta or whatever yet. But it uses containers rather than VMs. I'm not a targeted person so I may be happy to have "good enough" security for some performance back.

orblivionon Show HN: Game demo made with my homemade game engine

Firefox 128.14.0esr (64-bit) on Debian via QubesOS (i.e. it's in a VM)

orblivionon Show HN: Game demo made with my homemade game engine

I'm on a slow system, but it seems to freeze when I pick up items sometimes. Sound continues though. If I reload the page and play again it shows up in my inventory.

orblivionon Show HN: Game demo made with my homemade game engine

It's suddenly the 90s again, this is awesome.

orblivionon Nginx introduces native support for ACME protocol

That doesn't sound right to me. It's been in Debian and Ubuntu for a while:

* https://packages.debian.org/bullseye/certbot

* https://packages.ubuntu.com/jammy/certbot

orblivionon Nginx introduces native support for ACME protocol

I guess I should compare to this new Nginx feature rather than Caddy. It seems like the benefit of this feature is that you don't have a tool to run, you have a config to put into place. So it's easier to deploy again if you move servers, and you don't have to think about making sure certbot is doing renewals.

orblivionon Nginx introduces native support for ACME protocol

From a quick look it seems like a command you use to reconfigure nginx? And that's separate from auto-renewing the cert, right?

Maybe not hard, but Caddy seems like even less to think about.

orblivionon F-Droid build servers can't build modern Android apps due to outdated CPUs

With how strict F-Droid is I would have expected them to build from source all the way down. Though that sounds like a daunting task so I don't blame them.

orblivionon Disney 1985 film The Black Cauldron was an experiment that failed

It's the first I'd ever heard of this story. Played it with my friend at the public library. Never watched the Disney movie but ended up reading the series.

orblivionon Vector Tiles are deployed on OpenStreetMap.org

I guess you're right. I see the same on my desktop Firefox on Linux. But on my Android phone it's pretty smooth.

orblivionon Vector Tiles are deployed on OpenStreetMap.org

Make sure it's set to the "Shortbread" layer. Look for the "Layers" menu on the right.

orblivionon Vector Tiles are deployed on OpenStreetMap.org

Someone please correct me if I'm wrong here, but I think there's an additional benefit.

Traditional process is:

OSM Database -> PNGs -> Your screen

The first arrow decides what data to pull out and how to draw it.

The new process is:

OSM Database -> Vector Tiles -> Your Screen

The first arrow decides what data to pull out. The second arrow decides how to draw it. So given your vector tiles, you can choose and tweak the style that it's drawn as, deciding how (and if) to display certain things. And you can tweak that in your browser. That's useful for devs and users. "Night Mode", "Show bike lanes" (maybe?), etc.

Also relevant is that the vector tile is not only in a couple formats (pmtiles, mbtiles) but conforms to a couple different schemas (Shortbread, OpenMapTiles) which determines what kinds of data shows up. For instance (I'm just making up this example) one schema might have "big" "medium" and "small" roads. Another schema might just have "big" and "small". The transformation process will decide which kinds of roads in the OSM database map on to which type of road in the schema. (I think it turns out that you can't realistically just pull out all of the OSM database data, you have to pare it down). And then certain styles (Americana, etc) work for specific schemas, deciding things like "big roads are black", etc.

orblivionon The United States withdraws from UNESCO

Occam's Razor based on your priors.

orblivionon The United States withdraws from UNESCO

I'm willing to throw a hail Mary. At this point yeah I'm not too impressed with their work.

orblivionon The United States withdraws from UNESCO

I deliberately did not answer your question. I refuse to get into the weeds because I reject your premise. I don't know anything about the inner workings of these organizations. (It's really not a "simple question" at all!) It's not my job, I'm just a voter. I have other things to do.

You seem to want me to assume that because of this, I have to default to YOUR position. I'm saying, that doesn't match my broad view of the world. I have the opposite default position.

I guess what I can say, broadly, is that the US Government has a MASSIVE budget. The cruft is in there somewhere. If there's one guy who says he's gonna try to slash it, I'll take that guy and hope for the best.

orblivionon The United States withdraws from UNESCO

I'm responding to the general point that the administration just wants to destroy and not build. I'm saying that there's actually a good argument for that. Whether that's what's actually happening is ... now questionable.

I don't know anything about UNESCO, but Palestine is a plausible answer to this administration's actual motivations here. But then that would be different from the simple "just wants to destroy" angle.

orblivionon The United States withdraws from UNESCO

I think cruft is the natural state of things in large organizations. There are plenty of views of the world (right or wrong) that take this shape (painting with broad strokes) that I wouldn't call blind faith or dogma.

orblivionon The United States withdraws from UNESCO

I used to say that HN was a place where very controversial opinions were respectfully discussed. Granted with some bias, but still a lot of tolerance for unpopular views. Even climate change skepticism or 2020 election skepticism. What got voted down was unwanted tone, essentially.

Now it seems that the current administration is too much for people here to handle. I wonder if the mods have noticed the same thing, or maybe they support it at this point.

orblivionon Breaking Git with a carriage return and cloning RCE

Am I reading this wrong? As of this writing it all says "vulnerable".

https://security-tracker.debian.org/tracker/CVE-2025-48384

orblivionon Ask HN: Who wants to be hired? (July 2025)

  Location: New Hampshire - Portsmouth Area
  Remote: If outside of the area of Manchester NH, Portland ME, Boston MA
  Willing to relocate: No
  Technologies: Python, Go, Haskell, OpenStreetMap, Blockchain, Linux, Open Source
  Résumé/CV: https://danielkrol.com/resume/
  Email: See resume

orblivionon Breaking Git with a carriage return and cloning RCE

So this was disclosed before patching? With all of the alarming "here's how we can pwn your machine" posts turning out to be months after the fact, I figured by now that these blog posts all happen after all the distros have long patched it.

It seems like it would be appropriate to make it clear "this is important now" vs "don't worry you probably already patched this" in the headline to save our time for those who aren't just reading these posts out of interest.

orblivionon Opening up ‘Zero-Knowledge Proof’ technology

The explanation that one person gave me was basically that you use an RNG to generate the challenges. Not sure if this is quite "proper", but it makes sense to me so long as you can't game the system. Perhaps make the RNG slow to prevent picking a convenient sequence?