HNHacker News
TopNewBestAskShowJobs

pja

6,077 karma · joined April 24, 2011

Occasional computer wrangler
submissionscomments
pja··on UK's hardware talent is being wasted
Finance jobs in London / New York (partially) can afford those pay rates because they extract wealth from the rest of the world.

Whether they do so in return for services rendered or are extracting rents by acting as gatekeepers is a question that never quite gets resolved. A little of each I suspect, depending on the context.

pja··on Missiles are now the biggest killer of airline passengers
The IL-2 that was hit by a Ukrainian SAM system & managed to land afterwards had a very similar damage pattern to this aircraft. You absolutely can fly for hours after an AD hit, if you get lucky.

A proximity fused AD missile with a fragmentation charge will explode to the rear of a large airliner if it’s tail-chasing, resulting in exactly the kind of damage we see in both that IL-2 and this case.

pja··on Mozilla fixes Firefox zero-day actively exploited in attacks
> It references "Bug 1923344" but when I click the link I get "You are not authorized to access bug 1923344."

They usually make the bug reports public eventually.

pja··on How I got my laser eye injury
“Do not let salesweasels anywhere near the bright shiny things” hopefully.
pja··on Open source AI is the path forward
“Commoditise your complement” in action!
pja··on RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems
Use tailscale instead? It’s user friendly enough that you’re unlikely to mess it up.
pja··on RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems
OpenBSD refactored their system to use async signal safe re-entrent syslog functions, so it’s possible that the author of this code simply assumed that it was safe to make this change, forgetting (or completely unaware) that other platforms (which the openBSD ssh devs don’t actually claim to support) were still using async unsafe functions.
pja··on What You Get After Running an SSH Honeypot for 30 Days
> Is this still possible? Are your emails getting delivered?

Mine are. Although it probably helps to have a static IP with a 25 year long clean history.

Are there very occasional glitches? Sure. But I've seen ISPs drop everything from GMail on the floor for no obvious reason. I've seen GMail drop GMail email before. Same for every other large email provider.

To date I haven't seen any reason strong enough to push me to switch to a centralised email host. That day may yet come of course.

pja··on Sharing details on a recent incident impacting one of our customers
Google Private Cloud I think.
pja··on The curious case of the missing period
> No, it's not reductionist and pedantic. It's a reminder that there is no magic.

Exactly! This is an even better phrasing of my point.

pja··on The curious case of the missing period
If your metadata about the data is in the same channel as the data then you’re doing in-band signalling.
pja··on The curious case of the missing period
That’s still in-band signalling: The metadata is in the same channel as the data.
pja··on The curious case of the missing period
At some point, all protocols include in-band signalling somewhere: You have to put packets on the line, and those packets are ultimately just a stream of anonymous bytes.

If it wasn’t a period, it would be something else & you’d have to handle that instead.

pja··on ADSL works over wet string (2017)
Tony Finch is a real person: https://dotat.at/social.html

He used to be hostmaster@cam.ac.uk, amongst other things. Why he’s farming internet points on HN I’ve no idea!

pja··on Apple apologizes for iPad 'Crush' ad that 'missed the mark'
Because it destroys the tools of art by crushing them into a featureless grey rectangle.

Which is a little on the nose for the way artists are feeling right now...

pja··on Sound-suppressing silk can create quiet spaces
The introduction of electric vehicles has made Spanish cities much quieter. The youth can hurtle around on their electric bikes / scooters in the wee hours without waking everyone up for miles around!
pja··on LPCAMM2 is a modular, repairable, upgradeable memory standard for laptops
This PDF[1] suggests that an LPCAMM2 module has a 128 bit wide memory interface, so the epic memory bandwidth of the M3 max won’t be achievable with one of these memory modules. High end devices could potentially have two or more of them arranged around the CPU though?

[1] https://investors.micron.com/node/47186/pdf

pja··on XZ backdoor story – Initial analysis
That only happens once at startup though?

IIRC the original detection was because sshd was using a lot more CPU coping with the torrent of spam connections any sshd on the internet gets than it usually would.

pja··on XZ backdoor story – Initial analysis
It's doing an extra ECC operation on every connection, but that shouldn't take 500ms on a modern CPU.

The people who have reverse engineered the code say it also requires the command message to be bound to the ssh host key as well, so if the host key is an RSA key then it might be doing an extra RSA decryption operation on every connection as well?

That would probably do it.

pja··on Stanley Kubrick did it his way
Sicario was an original screenplay by Taylor Sheridan: https://en.wikipedia.org/wiki/Sicario_%282015_film.

Calling the other two "remakes" seems unnecessarily reductive imo.

pja··on Going in circles without a real-time clock
If your DHCP server supports bulk queries (RFC6926: https://www.rfc-editor.org/rfc/rfc6926.html ) then responses to such a query from a dhcp client include a timestamp in the form of an 32-bit integer count of seconds since the epoch.

I don’t know how widely this DHCP RFC is supported though.

pja··on Mistral AI Launches New 8x22B MOE Model
llama.cpp can quantize a model for you:

https://github.com/ggerganov/llama.cpp?tab=readme-ov-file#qu...

pja··on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
I guess xzdec was supposed to sandbox itself where possible so they disabled the sandbox feature check in the build system so that future payload exploits passed to xzdec wouldn’t have to escape the sandbox in order to do anything useful?

Sneaky.

pja··on Backdoor in upstream xz/liblzma leading to SSH server compromise
Debian packages can have epochs too. I’m not sure why the maintainers haven’t just bumped the epoch here.

Maybe they’re expecting a 5.6.x release shortly that fixes all these issues & don’t want to add an epoch for a very short term packaging issue?

pja··on Backdoor in upstream xz/liblzma leading to SSH server compromise
This account changed the instructions for reporting security issues in the xz github as their very last commit:

    commit af071ef7702debef4f1d324616a0137a5001c14c (HEAD -> master, origin/master, origin/HEAD)
    Author: Jia Tan <jiat0218@gmail.com>
    Date:   Tue Mar 26 01:50:02 2024 +0800

        Docs: Simplify SECURITY.md.

    diff --git a/.github/SECURITY.md b/.github/SECURITY.md
    index e9b3458a..9ddfe8e9 100644
    --- a/.github/SECURITY.md
    +++ b/.github/SECURITY.md
    @@ -16,13 +16,7 @@ the chance that the exploit will be used before a patch is released.
     You may submit a report by emailing us at
     [xz@tukaani.org](mailto:xz@tukaani.org), or through
     [Security Advisories](https://github.com/tukaani-project/xz/security/advisories/new).
    -While both options are available, we prefer email. In any case, please
    -provide a clear description of the vulnerability including:
    -
    -- Affected versions of XZ Utils
    -- Estimated severity (low, moderate, high, critical)
    -- Steps to recreate the vulnerability
    -- All relevant files (core dumps, build logs, input files, etc.)
    +While both options are available, we prefer email.

     This project is maintained by a team of volunteers on a reasonable-effort
     basis. As such, please give us 90 days to work on a fix before
Seems innocuous, but maybe they were planning further changes.
pja··on Baltimore's Key Bridge struck by cargo ship, collapses
https://en.wikipedia.org/wiki/Dolphin_%28structure%29?wprov=...

If they're designed to stop a bulk carrier then presumably they can stop a container ship.

pja··on HMRC offers a Linux version of Basic PAYE Tools, but it recently stopped working
It is a web app. Runs a local webserver & talks to a browser.
pja··on HMRC offers a Linux version of Basic PAYE Tools, but it recently stopped working
There might have been a Tk GUI at some point, but these days it’s a local webserver talking to a local browser which handles the UI.

It’s just another rest webapp internally I think.

pja··on HMRC offers a Linux version of Basic PAYE Tools, but it recently stopped working
Still works for me. I think there was a libc issue a year or two ago, which was fixable by patching the libc they bundled with the app.
pja··on HMRC offers a Linux version of Basic PAYE Tools, but it recently stopped working
Huh. It works fine for me.

However, sometime around then it stopped launching the bundled browser & started launching the system browser to talk to the webserver that runs in the background & manages the local storage (SQLite IIRC) and communications with HMRC themselves.

So my first guess, if it isn’t working for you, would be to test whether xdg-open does the right thing on your system.

A year or two ago it stopped working entirely due to a libc mismatch, which I had to fix by patching in a more recent libc. That was less fun.

← PreviousPage 4 of 34Next →