Hacker News Reader

pepveon Post Mortem: axios NPM supply chain compromise

Someone in the linked Github thread describes an attack where the attackers waited for the victim to use their Yubikey for an AWS login, giving the attackers access to AWS as well. I don't think hardware 2FA is safe against a RAT.

pepveon How Kerala got rich

https://en.wikipedia.org/wiki/Head_bobble

pepveon ICC issues warrants for Netanyahu, Gallant, and Hamas officials

I'm not sure you are right. Take a look at this map: https://en.wikipedia.org/wiki/International_Criminal_Court . I don't think "overwhelmingly reliant on the US" is an accurate description of the green countries on that map. Partially reliant sure. But not overwhelmingly.

pepveon Thunderbird for Android Now Available

> Fastmail also has different actions for marking as spam and reporting phishing; I'm not sure how effective the latter is, but of course Thunderbird doesn't support it, as presumably that's a Fastmail-proprietary thing.

I don't think there's anything proprietary going on, so I did a quick search. Fastmail supports JMAP [0], and JMAP [1] supports setting special keywords [2] for a message to mark it as spam of phishing. It may be possible to get this to work.

[0] https://www.fastmail.com/dev/

[1] https://www.rfc-editor.org/rfc/rfc8621.html

[2] https://www.iana.org/assignments/imap-jmap-keywords/imap-jma...

pepveon DeskPad – A virtual monitor for screen sharing

I use `xrandr --setmonitor` to create a fake monitor that only covers part of my screen. And I have some window manager setup to easily move my windows there (with awesomewm).

pepveon An adult fruit fly brain has been mapped

Did a rough calculation, it would be more like Edinburgh.

There's easily a century between the earliest accurate map of Edinburgh and the earliest accurate map of the world. And even at present, the accuracy of maps of Edinburgh is much greater than the accuracy of maps of the world.

So yeah, the whole world could be next. But the person you're replying to has a point when they say significant improvements are needed.

pepveon Is My Blue Your Blue?

I'm not gonna fight you on that.

pepveon How to Start Google

> You don't need to be upset that this isn't for you.

The person you're responding to does not seem upset to me.

You add an interesting perspective that some people want to find encouragement in these types of essays. And the personal jab just isn't necessary.

pepveon How to be a good listener

I was trying to compliment you! When you talk about your friend, about what you might ask him, and what he might answer, I think you have insight there. I think that's valuable.

And I should have stopped there. But I went on to try to make a point about the quick mental model you proposed about "talking at" vs "talking with". Which I think leads to arguing about semantics (with others or yourself).

What you're saying about the difference between the distribution of behaviors and utterances sounds reasonable to me (if a bit abstract). I just think the specific insight into your friend's behavior is a lot more valuable.

pepveon How to be a good listener

> When I imagine asking him, "What don't you ask questions about my life?" I assume I'd get a response something like, "You can tell me anything," or "I'm open to hearing what you want to talk about," or "You're free to talk about anything."

I think this is the insight!

> If I had to devise a quick mental model, it might seem like the difference between talking at someone vs talking with someone?

(And I think this is semantics.)

pepveon Moreutils – Unix tools that nobody thought to write (2012)

sponge buffers the whole input before writing the output. Its utility would be in reading from a file, working on it with other tools, and writing the result back to the original file, all in one line.

pepveon 82nd Airborne unit told to use Signal or Wickr on government cell phones

"[...] where adversaries can exploit American communications systems, cell phones and the electromagnetic spectrum." (emphasis mine)

Wait, what?

pepveon Go master Lee Se-dol says he quits, unable to win over AI Go players

Another example of unique human intelligence: drown in existential dread.

I can do that, you can do that, but will a computer be able to do it?

pepveon Go master Lee Se-dol says he quits, unable to win over AI Go players

Re: "all of humanness"

https://xkcd.com/1875/

(If you don't want to click the link, there's a joke there that machines may have a hard time "being to cool to care about stuff.")

pepveon People with Depression Use Language Differently

EQ isn't a real thing. https://news.ycombinator.com/item?id=14940184

And you by the way seem very apt in considering other people's emotions. This dilemma you're posing would be hard on anyone to navigate.

pepveon Linux kernel: multiple vulnerabilities in the USB subsystem

Consider the bugs a workaround for laptops with a fixed battery. ;-)

pepveon Redis 4.0

"outside the US cultural influence"

Where is this magical place you speak of?

pepveon How to make a friend fast

Both "extrovert" and "extravert" are correct. Contemporary language use does not always care about latin, however sorry I am for that.

But the author of this post goes even further, and uses both spellings in the same sentence!

In extravert-introvert pairs, extroverts report on greater closeness than introverts

That can't be right...

pepveon Why is cycling so popular in the Netherlands?

Have you seen this one: https://www.youtube.com/watch?v=9xjTJUCMTZg

Video is in The Hague, I've seen it in Amsterdam though, a couple of times.

pepveon Europe is living under Microsoft’s digital killswitch

Ahem, the next president?

pepveon Keybase is out for iPhone, Android

I'm so glad this arrived. Thanks Keybase! Finally we have proper identity backed secure chat! (Which is going to be my main use case.)

pepveon How Your Phone Is Designed to Control Your Life [video]

Sure, you're totally right. Except where you started your post with "This makes no sense." We all have different social requirements. For some people and in some situations it's awesome to be able to change things ad hoc, for other people and for other situations that just causes stress and discomfort.

pepveon Escalation of Privilege Advisory

Well, if there is a vulnerability for Nginx on Linux, you wouldn't say Linux had a vulnerability right? I think this situation might be similar.

pepveon On emotional authenticity and masking as an autistic person

I think you mean gender instead of sexuality. Gender is who you are, sexuality is who you like. (I'm replying to try to help, not to nitpick.)

pepveon Caterpillar found to eat shopping bags, suggesting solution to plastic pollution

To be fair, this thread started with someone describing the killing of maggots as "disturbing". It was never going to be a productive argument.

pepveon Keeping track of technical debt in source code

I think you're both right. It's okay to have them locally or on feature branches for communication and note taking purposes. But they should never live for any prolonged time in your production code.

pepveon Machine learning without centralized training data

In the secure aggregation paper (linked in the post: http://eprint.iacr.org/2017/281 ) they indeed hint at the possibility of extracting information from the diffs. So the protocol they propose cryptographically ensures that the individual diffs can not be learned. They do this by having each pair of clients generate a secret the size of the diff, and have one add it to their diff and the other subtract it. The clients then send that result to the server where they are summed, which cancels out all the secrets. The bulk of the protocol then deals with setting up the secrets and dealing with client drop outs, which appears to be the real challenge.

Well, that's my fallible summary anyway, go read the paper. :-)

pepveon Machine learning without centralized training data

I just skimmed their secure aggregation paper (linked in the post), and while I'm no expert, I believe they can actually guarantee privacy. At least for the strong version they describe (there's also a weak one which requires trust in the server).

Edit, link to the paper: http://eprint.iacr.org/2017/281

pepveon Twitter refuses US order to disclose owner of anti-Trump account

So what you're saying is that the Streisand Effect is not a myth, it's just a rare occurence.

pepveon Spotify is gaining leverage over record labels

So make a service that emails people their saved albums. Send monthly incremental updates. Their backup storage will be their inbox, and restoring the data to a new service will be a couple hours manual clicking and typing.

The hard part is explaining to our mothers that their music app might become unavailable, that they should care about this, and that they should take action to mitigate the effects.

But on the other hand, consumers get locked in all the time, and civilization hasn't collapsed yet.