Hacker News Reader

prussianon To save C, we must save ABI (2022)

I think the bigger issue is time_t, and I have, in fact wrote comments that literally state the code is "best before Jan 19, 2038." Said code may never be recompiled since it will trigger regulatory certification.

prussianon Humiliating IIS servers for fun and jail time

I do. As others have replied, Windows Server--including IIS, means you have a domain joined machine, likely with an SPN of HOST/MACHINE.DOMAIN. Windows services and IIS App Pool Identities log in with an (g)MSA or virtual accounts (NT Service*) and you get a fully working and managed Kerberos experience without having to deal with 30, 60, 90 day password rotations. Log into your MS SQL Server with Kerberos, log into some other webapp's oauth2 flow with Kerberos, etc, it all just works. You can use WinRM with your native Windows shell without having to do anything special, and even technically bypass 2FA since that's just how it really works.

Can you do all this on Linux? Yes. Will it ever be set up correctly? Depends where you work, but based on my experience so far, not likely.

prussianon The Future of Email

They also send faxes to providers as well. It's kind of ridiculous when you think of it.

prussianon Debunking Zswap and Zram Myths

enabling != configuring. Are you saying this is all that's necessary, assuming an existing swap device exists? That should be made clearer.

Edit: To be extra clear. When I was researching this, I ended up going with zram only because:

* It is the default for Fedora.

* zramctl gives me live statistics of used and compressed size.

* The zswap doc didn't help my confusion on how backing devices work (I guess they're any swapon'd device?)

prussianon Debunking Zswap and Zram Myths

With zram, I can just use zram-generator[0] and it does everything for me and I don't even need to set anything up, other than installing the systemd generator, which on some distros, it's installed by default. Is there anything equivalent for zswap? Otherwise, I'm not surprised most people are just using zram, even if sub-optimal.

[0]: https://crates.io/crates/zram-generator

prussianon -fbounds-safety: Enforcing bounds safety for C

Fedora and its kernels are built with GCC's _FORTIFY_SOURCE and I've seen modules crash for out of bounds reads.

prussianon TSMC says employees tried to steal trade secrets on iPhone 18 chip process

Don't forget GE Aerospace. It gets a bit weirder too since you have joint ventures like CFM and Engine Alliance.

prussianon TSMC says employees tried to steal trade secrets on iPhone 18 chip process

Which Comac? I thought they all used GE (CFM for Comac 919) or Russian/Chinese sourced engines.

prussianon Direct TLS can speed up your connections

True, it can help Microsoft SQL Server as well. In SQL Server 2022, they finally added Strict Encryption. I'm glad to see more databases are removing these strange STARTTLS like features.

prussianon Office is too slow, so Microsoft is making it load at Windows startup

I think people forget that some of this software may be relatively fast. The problem is, most corporate environments are loaded up with EDRs and other strange anti-malware software that impede quick startup or speedy library calls. I've seen a misconfigured Forcepoint EDR rule block a window for 5 seconds on copy and paste from Chrome to Word.

Another example: it takes ~2 seconds to run git on my work machine

    (Measure-Command { git status | Out-Null }).TotalSeconds

while running the same command on my personal Windows 11 virtual machine is near instant: ~0.1 seconds. Still slower than Linux, but not nearly as bad as my work machine.

prussianon .INTERNAL is now reserved for private-use applications

Just be mindful that any certs you issue in this way will be public information[1] so make sure the domain names don't give away any interesting facts about your infrastructure or future product ideas. I did this at my last job as well and I can still see them renewing them, including an unfortunate wildcard cert which wasn't me.

[1] https://crt.sh/

prussianon Meta to pay Texas $1.4B for using facial recognition without users' permission

Isn't this a case of shrinkwrap contracts? Use (viewing) is acceptance? https://en.wikipedia.org/wiki/Shrinkwrap_(contract_law)

prussianon Red Hat to author new Linux driver for Nvidia GPUs in Rust

Honestly? Given I've seen crashes and printk messages from AMDGPU with words like "General Protection Fault," I'd say memory safety is probably the most important thing missing in these GPU drivers.

prussianon OpenSSH 9.5 released with keystroke timing obfuscation

It's probably because FIPS 140-2 doesn't list it. I know machines booted with fips=1 and fips certified openssl, etc, openssh won't accept ed25519 keys for key auth.

prussianon Hacking the LG Monitor's EDID

I'm wondering if the real issue is the user doesn't have a DisplayPort 1.4 supporting cable or equipment. The speeds, color (10bit) and the resolution suggest to me that could be the real problem. I doubt the monitor would intentionally ship with such out of spec edid, especially since the monitor claims support from 48Hz to 144hz, likely for variable refresh rate.

prussianon Blocked by Cloudflare

PayPal's "secure browser" effectively becomes broken by Firefox's first part isolation. that took some time to figure out.

In terms of being blocked by CloudFront (not cloudflare),I actually got a website to fix their policies by just emailing their tech support and showing that simple user-agent changes bypasses their policy anyhow.

prussianon Hackers manage to unlock Tesla software-locked features

I want to add agreement to this, but to be more precise: people should own the things they buy and artificial (software ) means of locking people out of features shouldn't be allowed.

prussianon Response to “Developers are lazy, thus Flatpak”

https://github.com/nixpak/nixpak

prussianon Hyper – A fast and correct HTTP implementation for Rust

https://maud.lambda.xyz/

Maybe this?

prussianon Dropbox telemetry can't be disabled

If you're using Linux with GNOME desktop, GVFS can mount Google Drives automatically once you set your google account up in GNOME Online Accounts.

prussianon We updated our RSA SSH host key

Unless it has changed recently, you can't have a trust chain of OpenSSH certs though so it's cumbersome that your signing key is not only the root ca but also basically has to be 24/7 accessible to sign any server/client you want to bring up.

prussianon Use the XDG Base Directory Specification

I'd say for windows, you'd probably want to define them as well since a lot of ports will use HOME, XDG_* and other non-windowsy environment variables anyhow.

prussianon The IAB loves tracking users but hates users tracking them

I don't even think the Heuristics would need to be that complex. Big email still uses reputation lists to determine if they should junk an email, so applying sender reputation, or lack thereof, to the domain part could be good enough to safely hash as an identity.

prussianon Twilio incident: What Signal users need to know

>My feelings on gun control can be summed up as "I want mail order rocket launchers delivered to my doorstep."

I don't know. I'm a believer in extreme gun rights as well, but giving people the power to have rocket launching systems like MANPADS just seems a bit, dangerous.

prussianon Show HN: Kvass, a personal key-value store

Cool. Curious why you chose sqlite instead of something like badger [https://github.com/dgraph-io/badger] given you expose it as a key value database, which badger is.

prussianon An unscientific benchmark of SQLite vs. the file system (btrfs)

Probably in reference to Ext4's[0] configurable rename-replace behavior under auto_da_alloc

[0]: https://www.kernel.org/doc/Documentation/filesystems/ext4.tx...

Edit: note this isn't a universal property either, so it's still wrong: https://btrfs.wiki.kernel.org/index.php/FAQ#What_are_the_cra...

prussianon Bad Emacs Advice

>It's because it was not a thing in Italy

I'm pretty sure even Tomatoes weren't. I hope this isn't the reason for the disdain.

prussianon Japan HP accidentally deleted 77TB data in Kyoto U. supercomputing system

>So, how could this (IMO) bad behaviour be fixed?

By reading in the whole file at once. Bash does not mmap shared the script it is parsing. You can see this behavior with

    strace -e read,lseek bash << EOF
    echo 1
    echo 2
    EOF

bash will read(), do its multi-step expansion-parsing thing and then lseek back so the next read starts on the next input it needs to handle. This is why the problems described in the story can happen.

The other way to fix this is to simply use editors that will just make a new file and move over that file on the target on save. I believe vim or neovim does this by default, but things like, ed or vi do not. Emacs will do something similar on first save if you did not (setq backup-by-copying t) but any write after will still be done in-place. I tested this trivially without reviewing the emacs source simply doing the following and you can to with $EDITOR of choice:

    !#/usr/bin/env bash
    echo test
    sleep 10
    # evil command below, uncomment me and save
    # echo test2

while running sleep, if changing the script causes things to happen, your editor may cause the problem described.

prussianon Sherver: Bash lightweight web server

Are you sure?

    strace -ff -e execve /bin/bash -c 'x="$(cat <<< "test")"'
    ... snip
    [pid 311214] execve("/usr/bin/cat", ["cat"], 0x56280da76fc0 /* 3 vars */) = 0

prussianon Sherver: Bash lightweight web server

Here: https://github.com/remileduc/sherver/issues/1 that way you can have HTTP/1.1 support even with arbitrary output lengths. I was planning on sending this to the linked repo so the owner doesn't need to use HTTP/1.0.

EDIT: changed link to the github issue I created with inlined utility.