HNHacker News
TopNewBestAskShowJobs

pmw

136 karma · joined January 21, 2013

submissionscomments
pmw··on Backups Aren't Simple
The most polished Glacier backup/restore mechanism I know -- because I helped build it -- is through rustic <https://rustic.cli.rs/docs/commands/init/cold_storage.html>. It has native support for backing up to Glacier (because writing to Glacier is identical to writing to regular S3), and it supports external "warmup" programs to support cold storage of your choice, with Glacier having an existing warmup program you can use.
pmw··on I hate packaging my software for Linux
I am a solo developer of a niche CLI application. The use-case is backing up your computer data to S3 Glacier (cold storage) and later restoring from it.

I took two actions to distribute my app.

First, I automatically build static binaries for Windows, macOS, and Linux: https://gitlab.com/philipmw/warmup-s3-archives/-/releases/v1... . This part is fully within my control, and I believe these binaries fully cover the potential audience. This works well because my app is just one binary, so I am not worrying about distributing assets or other complications. If you like this, adopt my `.gitlab-ci.yml`.

Second, I am already a Nixpkgs contributor, and I added my package to Nixpkgs. Nixpkgs is niche in its own way (as you point out too), but it makes it trivial to adopt my app if you're already using Nixpkgs. Given that my app's intended audience is very tech-savvy, Nixpkgs is probably a good fit here.

pmw··on Bay Area mom out thousands after scammers use AI to mimic daughter's voice
TOTP can be used today to authenticate a couple to each other over an untrusted medium.

It’s rather high friction; you have to set it up in advance, and then read a six digit number over the phone. And I am not sure that it mitigates the threats… in this situation, I suspect it wouldn’t. It could even make the situation worse if the daughter is genuinely in trouble but can’t access the authenticator.

But I can’t think of a better solution. Any other ideas?

pmw··on Talkie: a 13B vintage language model from 1930
Related: https://github.com/haykgrigo3/TimeCapsuleLLM

> A language model trained from scratch exclusively on data from certain places and time periods to reduce modern bias and emulate the voice, vocabulary, and worldview of the era.

Discussed here: https://news.ycombinator.com/item?id=46590280

pmw··on Swappa.com for GrapheneOS compatible devices – Stay Away
I had a similar experience with eBay. The problem is that “unlocked“ typically refers to being able to use it on a different carrier—not related to the bootloader.

So I bought an “unlocked” Pixel that had a locked bootloader. Returned it. Felt bad because the seller correctly classified it.

Ultimately I found an eBay seller (thegizmotrader) that explicitly lists the bootloader as unlockable.

When buying secondhand, I suggest looking for Pixels not associated with any particular carrier (as are sold by Google online store), and especially not Verizon.

pmw··on Retiring GPT-4o, GPT-4.1, GPT-4.1 mini, and OpenAI o4-mini in ChatGPT
You are probably thinking of `timeout`.
pmw··on Article on the History of Spot Instances: Analyzing Spot Instance Pricing Change
I am a fan of Rackspace Spot, and use it personally. It started out being a pure play Kubernetes cluster provider, but recently they added support for VMs.

I was so impressed by its pricing and efforts at transparency that it motivated me to learn Kubernetes. I finally achieved the "cattle, not pets" nirvana. My Kubernetes cluster running a demo service costs me $14/month: $4/month for the spot instance, $10/month for the load balancer, and $free Kubernetes control plane (non-redundant; not intended for production). $14/month is an amazing value, as long as you know the limitations.

Although this article greatly emphasizes Rackspace's market-based prices, they do have some price controls. First, they have a reserve (floor) price on their compute. In their older data centers, it's $0.001/hr ($1/mo), while in their newer data centers it's 10x higher: $0.01/hr ($7/mo). Second, their bidding UI supports bids only in increments of $0.005/hr, so you actually can't bid $0.001: $0.005/hr ($4/mo) is the lowest supported. If everyone bids $0.005/hr to start, then is $0.001/hr even achievable as a market-clearing price?

Secondly, their pricing is not as sweet on everything else beyond spot compute. Load balancers are $10/mo each. On-demand instances are comparable to on-demand pricing in other cloud providers. (A 2 vCPU / 4 GB RAM instance in the older data center costs $27/mo; almost equal to AWS t4g EC2 instance with the same vCPU/RAM combo.)

Today I run a POC web service on Rackspace Spot, and I pay $14/month; this is the lowest achievable price on Rackspace Spot, and it is not production-quality.

If you run a production web service, your costs grow to $40/mo (redundant Kubernetes control plane) + $27/mo (on-demand cheapest instance) + $10/mo (load balancer) = $77/mo at a minimum. You'll also be paying for storage, but I don't include that. Spot instances don't even play a role here.

Is that still a great value compared to other providers? I am not sure. If it is, then Rackspace Spot marketing is focusing on the wrong thing. And if it's not a great value anymore, then it makes sense only if your workload is heavily dependent on interruptible compute.

pmw··on I took all my projects off the cloud, saving thousands of dollars
OVH Cloud’s dedicated Eco servers
pmw··on Samsung makes ads on smart fridges official with upcoming software update
I was also infuriated by this, so much so that I switched to TIDAL. Migrating was easy— I used their recommended webapp ti migrate all my playlists. Have been using TIDAL happily ever since. Never any popups or ads.
pmw··on Driven Down: Amazon delivery drivers and workplace technologies
Amazon and its Delivery Service Partners (DSPs) employ thousands of drivers. These drivers are overworked and are owed thousands in wages a year, sacrificing their safety for speed and efficiency.

Our report focuses on this workplace surveillance technology, and how it makes these jobs worse for drivers and our communities.

pmw··on I regret building this $3000 Pi AI cluster
Thanks for the transparency. Much respect to you.
pmw··on FOKS: Federated Open Key Service
To better wrap my head around how FOKS facilitates team collaboration, I'd like to see two comparisons:

1) compare to a team-shared Linux machine with SSH daemon. Each team member has a user account, and they can manage their SSH authorized keys, including keys stored on Yubikey. The team can share files and git repositories on the Linux machine's own storage. Some differences I see with this approach are the federated aspect and "append-only data structures that allow clients to catch dishonest server behavior".

2) compare to Radicle, a decentralized git service. Identities are keypairs.

With FOKS, how coupled is storage of git and secrets to the FOKS server?

pmw··on FOKS: Federated Open Key Service
Max, this looks interesting and I'd like to follow the blog. Would you please add an Atom feed to the blog?
pmw··on Using Sun Ray thin clients in 2025
Everyone now has fondness for these and for thin clients in general, but I don’t see this concept used in modern times. Is there any modern equivalent, in particular with the power of a workstation rather than a kiosk? Amazon’s WorkSpaces is anemic— low memory and high price, with their own marketing proposing it for contact centers and front desks. What modern thin client solution can truly replace full computers, especially with local / on-prem processing?
pmw··on Ask HN: What ist your AdBlock strategy?
It's an networking term to distinguish between ISP-owned and customer-owned equipment. https://en.wikipedia.org/wiki/Customer-premises_equipment
pmw··on Apple Passwords’ generated strong password format
Estimating entropy is challenging because it's a reverse process from how it ought to work. I created https://phrase.shop, which generates passphrases with a known quantity of entropy. Hover over any of the three action buttons to see exactly how many bits of entropy will be used to generate the passphrase.
pmw··on Rounding Percentages
Not sure how much I like this. With this algorithm, the user would never see 100% displayed, because at that point the UI would change to remove the progress bar entirely. Whereas seeing 100% feels oddly satisfying, even if inaccurate.
pmw··on Software glitch saw Aussie casino give away millions in cash
> How many people would use slots if it were just putting a dollar in the slot, then a screen saying 'lose' and that's that?

You’ll be surprised by the concept of “risk-free play”:

https://www.lpm.org/news/2024-03-08/gas-station-gambling-is-...

pmw··on Insult Passphrase Generator
This is great in that it creates a grammatically correct sentence, which really helps with memorization, and which is lacking in many other "passphrase generators" that are simply sets of disconnected words.

Though password managers are useful, they don't obsolete memorization! At the very least, you need to memorize your password manager's master password. I also don't put extra-sensitive passwords in my password manager, such as for my email account, laptop OS, SSH key, employer enterprise account, etc. I probably have about ten passwords / passphrases memorized, and I don't think this'll ever reduce.

To scratch my own itch, I created https://phrase.shop, which also generates grammatically correct phrases (not full sentences though), minus the insults. Hopefully you find it useful too!

pmw··on OTP at a High Level (2019)
Those two aren't even the only options. There's also Lisp-Flavored Erlang (LFE), and maybe other languages targeting the virtual machine BEAM.

https://lfe.io/

It's similar to a multitude of languages targeting the Java Virtual Runtime (JVM) -- functional, imperative, object-oriented, actor-based -- whatever you want, but they all produce interoperable bytecode.

pmw··on Firefox Sync actually works
I am not the OP, but I believe he's referring to the ability to be logged in to different AWS accounts simultaneously. Without containers, logging in to AWS account B would invalidate the tabs where you're already logged in to account A.
pmw··on Amazon Unveils Graviton4: A 96-Core ARM CPU with 536.7 GBps Memory Bandwidth
Me too. The closest we can get in consumer hardware is the Ampere Altra Dev Kit: https://www.ipi.wiki/products/com-hpc-ampere-altra

It’s a Neoverse N1 architecture, whereas the new Gravitron is Neoverse N2.

It is an E-ATX form factor, and I can’t tell whether the price makes it a good value for someone who simply wants a powerful desktop rather than ARM-specific testing and validation.

pmw··on A cheap radio hack disrupted Poland's railway system
> The way the US does it (especially detecting if a train has not been separated along the way by using a caboose/end-of-train beacon) may cost less money, but would be viable to such issues.

Detecting separation doesn't rely on the end-of-train device. The EOTD only helps with this by 1/ helping activate the brakes twice as fast by detecting loss of pressure on its end and opening the brake valve, and 2/ sending periodic status indication via radio signal to the locomotive so the crew has more visibility into what the pressure is and whether the tail of the train is moving.

pmw··on Write your passwords down (2010)
One of my toy projects is https://phrase.shop -- a small webapp that generates grammatically correct phrases that are both random and memorizable.
pmw··on How to Yubikey
I have multiple Solo Key 2 devices. (I bought a Kickstarter 4-pack.) I use one of them regularly, and I successfully added it to iCloud as a security key. It has been 100% reliable.

In August 2022 they released a major firmware update. Maybe that addressed the iCloud incompatibility and reliability issues?

pmw··on I bought a CO2 monitor and it broke me
Can anyone recommend a quality CO2 monitor for personal/home use?
pmw··on AWS Tape Gateway
But you pay the same egress rate.
pmw··on The Rock 5B is not a Raspberry Pi killer–yet
Yes, this is a problem. ARM SystemReady certification program is aiming to solve it. Unfortunately the only boards that meet this certification are significantly more expensive.

For example, Honeycomb LX2 (https://www.solid-run.com/arm-servers-networking-platforms/h...) -- very solid, great specs, upgradeable RAM up to 64 GB, but its price has been increasing over time, now at $919. Still, looks tempting to me.

pmw··on RISC-V SBC VisionFive 2 Officially Shipped
Not great; VisionFive appears to be significantly less performant.

https://browser.geekbench.com/v5/cpu/compare/17159543?baseli...

pmw··on Raspberry Pi Shortages Could Last Another Year
Thanks, this is great! I didn’t know about any of these.
Page 1 of 2Next →