HNHacker News
TopNewBestAskShowJobs

rdpintqogeogsaa

5,542 karma · joined January 10, 2021

submissionscomments
rdpintqogeogsaa··on A note on subscription prices from LWN
That's the thing though. You can get all the value from LWN through here. Even if it wasn't for them tolerating subscriber links being posted on HN, the week-long delay isn't nearly enough an incentive to actually subscribe, rationally speaking.
rdpintqogeogsaa··on Rethinking the C Time API
> Remember that since 1989, no actions were taken to improve its security.

Technically, gets() was removed from the standard library in C11[0]. However, that is far from a semantically meaningful overhaul of the standard library. I nonetheless felt the need to point out that there was a very specific effort for the sake of completeness.

[0] https://en.cppreference.com/w/c/io/gets

rdpintqogeogsaa··on Engineers do not get to make startup mistakes when they build ledgers
Footnote to QLDB: AWS has deprecated QLDB[1]. They actually recommend using Postgres with pgAudit and a bunch of complexity around it[2]. I'm not sure how I feel about such a misunderstanding of one's own offerings of this level.

[1] https://docs.aws.amazon.com/qldb/latest/developerguide/what-...

[2] https://aws.amazon.com/blogs/database/replace-amazon-qldb-wi...

rdpintqogeogsaa··on The XAES-256-GCM extended-nonce AEAD
Zig[1].

[1] https://ziglang.org/documentation/0.11.0/std/#A;std:crypto.a...

rdpintqogeogsaa··on HTTP Message Signatures
This was finalized and published as an RFC 9421. Is there any reason in particular you link to a draft version?
rdpintqogeogsaa··on Sqids – Generate short unique IDs from numbers
Interestingly, it seems there might have been independent invention of the same idea[0]. Have you checked for any patents in the space?

[0] https://bytes.grubhub.com/why-we-use-crypto-when-generating-...

rdpintqogeogsaa··on Twitter's anti-Mastodon filter evasion
For example by not providing a privacy policy that contains all the information required by GDPR article 14.
rdpintqogeogsaa··on Twitter's anti-Mastodon filter evasion
GDPR exists right now, actually, and most instances are far from in compliance.
rdpintqogeogsaa··on The Restaurant Industry’s Worst Idea: QR Code Menus
It is not required to pay bills by scanning the QR code. It is perfectly possible to enter the IBAN and reference number manually as long as your banking provider lets you do so.

What is required is that you, when creating an invoice, provide the QR code for doing so.

rdpintqogeogsaa··on I *detest* the crazy industry politics that made ECC memory so “special”
I've been through this ordeal recently, but I'm probably missing something anyway.

You need to have a compatible CPU/motherboard/chipset. For normal CPUs: AMD Ryzen non-Pro APUs don't have support for it, the rest of AMD's CPUs and chipsets have unofficial support for it. You'll have to check the motherboard vendor's support page if a certain board also has support for ECC. Then you need ECC memory modules and you should stick near the qualified vendors list (QVL) here since systems are kind of pickier with ECC memory. For Intel, you're out of luck except for the W680 chipset, but motherboards seem to be scarce.

For high-end desktop (HEDT) and workstations CPUs: AMD's Threadripper lineup have official ECC support, but still check with the motherboard vendor first. For Intel, most Xeons should do it, but check before you buy. The same caveat about motherboards applies here, too: Check if there's ECC support first and stick to the QVL to be safe.

rdpintqogeogsaa··on Xv6, a simple Unix-like teaching operating system
Is this a fork of xv6? Did you get permission to remove the LICENSE file?
rdpintqogeogsaa··on Spam domains that plague my email
Could be a study to see how much response such an obviously fraudulent e-mail gets, sent from that same university conducting the study.

I admit that it's a fringe case, but it could be a thing.

rdpintqogeogsaa··on Microsoft open sources Salus software bill of materials (SBOM) generation tool
This is nearly beside the point, but why include SHA-1 as a default hash algorihtm in a greenfield project?
rdpintqogeogsaa··on Making IRC better
Yet there are also large networks like QuakeNet or UnderNet with no TLS anywhere.
rdpintqogeogsaa··on NIST announces first PQC algoritms to be standardized
Key part here is "are finalizing". It's still possible for at least some of the deals to fall through. I guess NTRU is the backup plan just in case and/or a method to apply pressure by saying the public is now aware there's a plan B. I exüect this passage to imply at least one negotiation has been going poorly.

It would probably be interesting to look up who of these people also has patents outside of the USA. If there really is someone being particularly stubborn, one might reasonably expect them to enforce the non-US patent variant outside of the USA.

rdpintqogeogsaa··on Hertzbleed Attack
What's the impact on AES-NI specifically? If hardware AES is impacted and no microcode updates are coming, this would be bad news.

Assuming ChaPoly needs expensive masking mitigations and AES-NI is safe, ChaPoly just became a lot less attractive, too.

rdpintqogeogsaa··on Nintendo's big piracy case is a sad story
They are not. You still have strings attached: the requirement of attribution and the disclaimer. With 3-clause and 4-clause BSD, there are even more strings attached.

You can't just take MIT-licensed code. You have to take the code and the full copyright notice and license grant with disclaimer.

rdpintqogeogsaa··on OpenBSD folklore and share/misc/airport
From what I can tell, at least it's historically inherited. 4.4BSD had a list of airports in the same location.

Its inclusion in 4.4BSD seems a mystery though. No other files on the 4.4BSD distribution seem to reference it. The atc(6) game involves airports, but it doesn't seem to actually open this file, both in 4.4BSD and in OpenBSD.

rdpintqogeogsaa··on Erik Naggum
This is actually specified in ISO 8601; they call it the ordinal date.
rdpintqogeogsaa··on MIT-0 License
> With CC0, you relinquish all rights to the work, including copyright.

With CC0, you relinquish your copyright only, but explicitly retain trademark and patent rights (!).

> 4. Limitations and Disclaimers.

> a. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.

This makes it sort of iffy for software when software patents exist unless coupled with some kind of patent waiver or assertion of not holding and not being aware of patents. While you can argue with MIT-0/0BSD/whatever else there might be that there is an implied patent license, there is an explicit non-license for patents with CC0.

rdpintqogeogsaa··on Ask HN: Using an LLC to protect side project IP
You seem to be looking for a lawyer. Asking concrete legal questions on a public forum is not a substitute.
rdpintqogeogsaa··on The Unlicense is an inferior license wrapped in an atrocious name
0BSD is actually incompatible with a desired pure CC0. Unlike CC0, 0BSD keeps copyright intact. It's just a license with no conditions except the usual disclaimer; CC0 attempts to cause a public domain dedication wherever possible. Consider the following:

1. Let there be a file F. F is released to the public under 0BSD.

2. Let there be a project P. P includes code from F. The license notice of F is scrubbed as part of the inclusion process.

3. P is released as CC0.

The author of P cannot release the project as CC0 because the author has no right dedicate another person's code (F) to the public domain. Because 0BSD doesn't cause a public domain dedication in jurisdictions that accept doing so, F would have to continue being separate and explicitly exempt from the effects of CC0 to be an accurate of its usage terms. Effectively, this makes 0BSD be a de-facto attribution license in a CC0 project. In practice, it makes no difference, but it's legally deeply inelegant.

rdpintqogeogsaa··on Plagiarism as a patent amplifier: Understanding the delayed rollout of PQC
Rogaway has abandoned his patents on OCB[0]. But by now, AES-GCM has hardware support and is ubiquitous. Nowadays, misuse resistance and resistance against partitioning oracle attacks are things you'd (also) expect from a modern AEAD design. AEGIS outperforms AES-OCB. The AEAD horse has already left the barn; there is no longer any point in closing the door.

[0] https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3...

rdpintqogeogsaa··on Naming Things with Hashes (2013)
I'll take this opportunity and also point out a pet peeve of mine with this spec in section 7:

The Luhn algorithm used as a check digit is suboptimal; better options with greater detection rates of various kinds of human input errors exist, see e.g. https://www.uni-due.de/imperia/md/content/dc/yanling_2015_ch..., p. 12 also showing some other options. See also http://page.mi.fu-berlin.de/rhschulz/Literatur/checkdigits_l... for further reading on check digits.

rdpintqogeogsaa··on Useful Old Technologies: ASN.1 (2013)
> Edit: would be really happy to see some good open source compilers with extensible encoding support being listed here

I think that's the reason of ASN.1 being trapped in a very restrictive space. From Olivier Dubuisson's ASN.1 -- Communication between Heterogeneous Systems, p. 86 et seq. talking about use of ASN.1 by the IETF:

> the definition of many macros and macro instances to represent semantic links instead of information object classes and information objects although no ASN.1 compiler properly takes into account the macro concept (on the other hand, no compiler of the public domain does with the information object class concept unfortunately);

In essence, ecosystem failure due to a non-existent overlap of the telecom industry (full of commercial and expensive solutions) and the Internet community (working in a standards committee that tracks pre-existing permissionless innovation distributing the standards at no cost, strongly affiliated with free software ideas) caused ASN.1 to fall by the roadside.

Now that ASN.1 is considered uncool, the ecosystem certainly won't be coming anymore, so we'll be forced to reinvent ASN.1, probably re-learning every lesson along the way.

rdpintqogeogsaa··on Selling my own GPL software, part 1: a lot of hurdles
This has an interesting aspect to it.

Yes, it's AGPL with source code publicly available, but if you remove that license key check yourself, you have to make it public, effectively broadcasting that you don't pay for software. In a way, it's naming and shaming. The alternative is using the fork of someone else who has done so and complied with the license, but then you're suddenly dependent on some random downstream and who knows what else they have mixed or might mix into it or just give up merging from upstream eventually.

rdpintqogeogsaa··on Useful Old Technologies: ASN.1 (2013)
This root cause analysis matches up with my experience. You can absolutely have safe ASN.1 with ASN.1 compilers, but the implementations that star in these vulnerabilities tend to be generic or ad-hoc DER/BER parsers.

You'd be hard-pressed to be able to blame ASN.1 with XER (XML Encoding Rules) encoding since then you'd throw an XML parser at the problem, side-stepping the bit twiddling and exchanging it for XML parsing bugs instead. Similarly, if all you have is fixed-length items, OER (Octet Encoding Rules), you essentially get a formally specified struct with a well-defined way to go from there to XML or JSON with JER (JSON Encoding Rules).

I imagine we'll see this happen with CBOR (whose ASN.1 equivalent is technically CDDL) a few years down the road.

rdpintqogeogsaa··on Microsoft forked MIT licensed repo and changed the copyright [fixed]
If you're attached to your copyright: 0-clause BSD is a thing that exists[0]. Toybox uses it.

If you want to throw your copyright out the window: The commonly accepted solution seems to be CC-0[1], which tries very hard to disclaim rights and limit liability in as many jurisdictions as possible, complete with a fallback license grant for failed public domain dedications. Because CC-0 makes some people uncomfortable despite the lengths it goes to reach its goals, some projects work with dual-licensing to cover the other side, such as Monocypher.

Neither of them address patents. If patents are something you want to/need to address, you could perhaps paste the patent clause from BSD-2-Clause-Patent onto 0-clause BSD.

See also the discussion on [2,3].

[0] https://spdx.org/licenses/0BSD.html

[1] https://spdx.org/licenses/CC0-1.0.html

[2] https://en.wikipedia.org/wiki/Public-domain-equivalent_licen...

[3] http://landley.net/toybox/license.html

rdpintqogeogsaa··on Microsoft forked MIT licensed repo and changed the copyright [fixed]
Disclaimer: I am not a lawyer. The following is not legal advice and, in particular, has not been tested in court to the best of my knowledge.

You can't use a different typeface, font size or color in a plain text document. That does not mean you have no options. The criterion is that it is “written, displayed, or presented that a reasonable person [...] ought to have noticed it.”

Consider the following:

    Nihil  harum  autem  impedit  commodi  ut  occaecati.   Nihil
    quisquam ab molestiae veritatis consectetur.  Quis  molestias
    sunt  facere  tempore  est.  Eum quia quisquam veritatis illo
    minus sint atque ipsa.  Omnis optio ducimus  minus  nemo  non
    deleniti  voluptas.   Blanditiis  nisi  eum  eum beatae fugit
    delectus.  Optio neque sed nostrum veniam eos.  Culpa ut  no‐
    bis  rem  est dignissimos est eum sed.  Occaecati dignissimos
    eveniet odit aut est ipsum minus nisi.
    
    
    
    
                           !! IMPORTANT !!                 
                       DISCLAIMER OF WARRANTY              
                                   
        The software is provided "as is", without warran‐
        ty of any kind, express or implied, including but
        not limited to the warranties of merchantability,
        fitness for a particular purpose and noninfringe‐
        ment.  In no event shall the authors or copyright
        holders be liable for any claim, damages or other
        liability, whether in an action of contract, tort
        or  otherwise, arising from, out of or in connec‐
        tion with the software or the use or other  deal‐
        ings in the software.
    
                                                                      
    
    
    Unde sint ab qui ut.  Debitis qui deserunt fugiat aut nihil
    impedit vel saepe.  Et ad voluptas quia.  Omnis libero  ni‐
    hil  perferendis  aut  ab.  Illo et neque voluptatibus.  Et
    animi consequatur enim eius aut at veritatis.  Modi error a
    ratione  tempore  velit inventore.  Accusantium accusantium
    et quam quis nemo id.
This seems rather noticeable to me, gets to the point, and is considerably more readable.

By using the all-caps sparingly, we've made way to draw attention to the heading, then offset the passage with large amounts of whitespace to draw attention to the passage itself. At the same time, this keeps readability of the actual text that you want people to read.

rdpintqogeogsaa··on Microsoft forked MIT licensed repo and changed the copyright [fixed]
I observe some confused comments on this page that seem to argue that the MIT license doesn't come with a requirement to keep the copyright line intact (which is demonstrably false, you don't get two paragraphs into the license without finding the attribution requirement).

The part that caught my interest is: How many people consciously picked the MIT license when they actually meant a non-attribution license?

Page 1 of 4Next →