HNHacker News
TopNewBestAskShowJobs

rndgermandude

4,815 karma · joined December 16, 2013

submissionscomments
rndgermandude··on Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For
>simply stop using Google products

Google squashed most of the competition in a lot of sectors, and the few remaining competitors aren't any better often.

Aside, even if you do not actively use google, google will still be in your life, by tracking and selling you. Already there is realistically no way to entirely "ungooglify" your life as long as you live and partake in some modern western society.

And soon it seems, you will be using a Google browser because you have to, because your bank or employer website or whatever will require their web "attestation" DRM, and will not accept your Firefox, Brave, Chromium, Vivaldi, Opera or whatever attestation.

And if you're hoping for other attestation vendors... Try streaming anything that needs a subscription without using Google's widevine DRM. You will be surprised on how few options there are, not just in implementations but in streaming services that support anything besides Google's widevine.

Google and probably Microsoft and Apple will be big enough browser vendors to be widely supported "attested environments" and attestation providers. Everybody else will bite the dust on that front.

E.g. "x% of websites do not accept Firefox's attestation" will drive more users away from Firefox, and that in turn will lead to even fewer websites supporting Firefox attestation because why spend the dev resources to support it with that measly market share when people can just use one of the big browsers?!

And google knows this very well, from the "works best/only in Chrome" to widevine. They were even able to make MS abandon their browser engine and jump on the google engine train, after all.

This to me is very clearly an antitrust issue that needs antitrust suits and regulation.

rndgermandude··on OpenAI shuts down its AI Classifier due to poor accuracy
Right. The point is: it absolutely does NOT measure what it claims to measure, i.e. truthfulness.

You can detect indicators of stress... or hot weather... or stage-fright (admittedly a form of stress)... or too much caffeine... or an underlying (maybe undiagnosed) medical condition, etc. So it does not even necessarily measure "stress".

It's about as useful as the so called "fruit machine" which they used to test for homosexuality[0], in that it is utterly useless while at the same time can be quite ruinous for people. People have been fired over polygraph "fails", and while not admissible in courts, people probably have been fingered for crimes after they failed polygraphs. Also, criminals have gone free after passing polygraphs[1].

>But everyone knows that it's not very reliable in almost every circumstance it's used.

You and I may know that. But a lot of people actually do not. That's why it's still used. Either because people administering those tests think it's "good science", or because those people administering it know that while it's all bullshit the person they are testing might not know that and break down and admit to things. Remember that fake polygraph on the show The Wire, which was just a copier they strapped to the suspect. If I remember correctly that was based upon true events.

A quick google shows e.g. you can hire "polygraphers" to e.g. "test" if your partner was unfaithful, making claims such as: "However, assuming that you have a good polygrapher with a fair amount of experience in working with betrayal trauma, you're going to get results that are at least 90% accurate or better."[2]

The US (and probably a lot of other) government(s) like their polygraphs very much, too[3].

> you can often tell (i.e. with better accuracy than chance) whether or not a subject is able to give a confident, uncomplicated yes-or-no to a straightforward question in a situation where they don't have to be particularly nervous

Uhmm, if somebody sat me down in a room, strapped all kinds of "science" to my body and then asked me questions, I'd be quite nervous regardless of whether I am truthful or not. In fact, I'd be even more nervous knowing it's a polygraph and bullshit, because I cannot know if the person administrating it would know that too.

If that somebody then asked me "Have you ever killed a prostitute?", or "Have you ever colluded with the enemy?", or "Have you ever cheated on your partner?", or "Have you ever stolen from your employer?", for example, my stress would certainly peak despite being able to confidently and truthfully answer "No!" to all of those questions. And I am sure the polygraph would "measure" my "stress".

[0] Yes, that was a real thing too. https://en.wikipedia.org/wiki/Fruit_machine_(homosexuality_t...

[1] E.g. the Green River Killer Gary Ridgway passed a polygraph, so the police turned their resources to another suspect who failed the polygraph. That was in 1984. Ridgway remained free until his arrest in 2001. He killed at least 4 more times after the investigation stopped focusing on him after that "passed" polygraph.

[2] https://www.affairrecovery.com/newsletter/founder/use-abuse-...

[3] https://support.clearancejobs.com/t/the-differences-between-...

rndgermandude··on Twitter starts limiting how many tweets you can post per day
Sure. Or it could just the kind of mistake that is being made all the time. I remember for example facebook taking itself offline[0], or cloudflare taking itself offline[1]. And of course pre-Musk twitter is well known itself to regularly have had significant incidents.

This new twitter incident could well be a result of layoffs and the resulting loss of institutional knowledge, but that's hardly a foregone conclusion.

[0] https://en.wikipedia.org/wiki/2021_Facebook_outage

[1] https://blog.cloudflare.com/cloudflare-outage-on-june-21-202...

rndgermandude··on Data-Free Disneyland
Why would it be abuse if you just asked for the data to be deleted? As long as you do not misrepresent things and do so politely, of course.

If Disney wants to spent time and money and reputation to figure out if they legally need to delete the data they collected about you and only do so when that's the case, then that's their choice. Same as it was their choice to collect data in the first place.

If they instead want to be nice and consumer-orientated, as they like their public image to suggest, or at least save some bucks, then they will hit the delete button. They gotta have such button by now anyway for legal requests from Californians.

rndgermandude··on Ask HN: Right to Repair for Software?
Farmers have to put in constant work to generate revenue. "IP" revenue too often entails create-once-earn-forever. However, "IP" often has a higher upfront investment attached to it, and often is not (as) "scalable", unlike farming.

What I am trying to say is that both things are very different in details where it matters, so I think this is a rather flawed analogy.

Maybe a closer analogy would be landowners who rent out land. Should a person who bought land 10 years ago be able to generate revenue from renting it to a farmer?

rndgermandude··on ExifTool – Read, Write and Edit Meta Information
Exif itself defines three main times: DateTime, DateTimeOriginal, DateTimeDigitized. To add insult to injury, each has an additional SubsecTime*

Then you have in the GPS tags: GPSTimeStamp, GPSDateStamp

And those are just the common tags...

Next question is, what format do these tags use. DateTime, while it's supposed to be "YYYY:MM:DD HH:MM:SS", is generally a free-for-all in practice when it comes to the order of the date components, the format of the components, or what separator to use.

I've seen software write DateTimes e.g. like "1-12-23/1:13pm" instead of "2013:01:12 13:13:00". Whether it was actually M-DD-YY or D-MM-YY, etc in this case is more of guesswork when all the values are below 12 :P

And if I remember correctly there was one piece of software which wrote UTF-16-BE strings instead of the mandated ASCII.

rndgermandude··on “I’m selling data of 400M Twitter users that was scraped via a vulnerability”
As others have mentioned, the time range of when the data was scraped seems to be end of 2021 to start of 2022, maybe into mid 2022. If correct, that was certainly before Elon Musk took over, probably even before he made his initial offer.
rndgermandude··on LosslessCut: lossless video/audio editing
The problem with that is that the skipped data will still be present and therefore easy to recover if you know what you're looking for. That may "leak" seconds worth of video (and audio) the user may have thought was removed. And those seconds may contain something sensitive, e.g. a pan over some confidential information on some paper or screen, or genitals, or whatever.
rndgermandude··on Instagram Is Over
In my German circles, that spot has been covered by whatsapp for a long while now. It never has been instagram or anything else really. For me it went from studivz (long defunct German "facebook" for university students, didn't last long), via facebook (for a short while, and due to lack of alternatives) straight to whatsapp, and has stayed there ever since, with the exception of some photography interested people sharing larger sets of photos on flickr at times, and some dating/sexting happening on snap (but most of that still was/is on whatsapp). Instagram was always understood as a place where you go if you want to see celebs, influencers and the "wannabes".

Granted, I am a bit older, a millennial (as much as it hurts me to admit) and an older one at that, but I regularly take the tram in my city at times when all the teenagers are going to school or coming from school, and you can see a damn lot of whatsapp on all those phone screens, a lot of tiktok, and a good amount of discord.

rndgermandude··on Retrofitting null-safety onto Java at Meta
It sure can be a problem when people initialize stuff with nonsense to avoid running into nullable warnings. However, accidentally running into null pointer exceptions is still worse than people deliberately footgunning themselves with bad workarounds.

I feel C#'s nullable has helped me personally to avoid a lot of potential bugs and also changed the way I write code in a lot of places - like creating `bool Try...(..., out var)` style APIs instead of "old school" returns-null/throws style stuff, which I think make a lot of code cleaner and more easy to read.

Sometimes nullable can get a little messy and annoying, especially when retrofitting old code to make use of it without breaking existing APIs, and all in all the way C# does it is a clear net win in my opinion.

rndgermandude··on Why Twitter didn’t go down: From a real Twitter SRE
I am not trying to comment on anything else here, but this:

>>Minimum< 40 hour work week. 100% office work.

Those are the norm for most fulltime people in most jobs. You know that, right? Right?

rndgermandude··on Twitter to employees: all office buildings closed, badge access suspended
No, I didn't say that. And there it really becomes tricky, If they try to unilaterally change terms of the contract, they cannot do that. However, at the same time an employee is not entitled to dictate the direction of a company. I am pretty sure a lot of the "perks" that might go away in favor or "hardcore mode" weren't contractually guaranteed. The terms of the employment contract wouldn't have changed then. If they muddle around e.g. with pay or work hours that would be quite different.

I don't really see the "constructive dismissal" argument either that others brought up, as that would require the employer deliberately creating a hostile work environment. Just saying "we're going into hardcore mode" and taking away some perks that weren't guaranteed wouldn't yet fulfill that. There might be of course other shit that twitter/Musk pulled/pulls that may legally satisfy a constructive dismissal. The email, in my laypersons view, wouldn't be enough.

However there is a strong point about the "missed the email" argument, and the non-affirmative nature of the "resignations" it creates. I think that's a rather strong point in favor of the employees. But then again, never underestimate courts ability to render "surprising" rulings.

My guess is though that twitter would not just "dismiss" everybody who did not respond. At the very least HR would get in touch with those people anyway, at which point employees can say "oh wait, what email?". I'd think the email is just meant as a pre-filter to save time by filtering out what people you do not need to talk to because they want to stay anyway.

rndgermandude··on Twitter to employees: all office buildings closed, badge access suspended
I wonder if this legally really is the case. Twitter seems to have asked "Do you still want to work here", giving an option to affirm. They didn't say "you have to go", they said "you may go if you do not like the new direction of the company, please tell us which one it is".

I'd be rather careful with that, and not just proclaim these people were terminated. I see a rather good chance court could rule very differently.

rndgermandude··on ZLibrary domains have been seized by the United States Postal Inspection Service
Artists - just like inventors etc - should be compensated for their work, but in my humble opinion not in what has become now essentially perpetuity.

So, an artist eeking out a living on something they worked hard on and released a month ago or two years ago gets sympathy from me. An artist who released a thing 20 years ago and still wants to eek out a living off that, such an artist doesn't really have my sympathy. The great-grandchildren who want to get paid for something an ancestor released 120 years ago[0]? Hell no, go do something yourself to make money.

If you're Lars Ulrich in 2000 and sue Napster over songs you released 10-20 years ago, while sitting on a net worth of maybe around 100-200M USD (now 350M), then my sympathy is with the pirates.

This doesn't touch the issue of how a lot of artists are not making much money, not because of pirates but because of predatory music labels and publishing houses.

It also ignores the problems with the "lost sales" theory. A lot of the pirates would have never paid for stuff they downloaded in the first place. And a lot of pirates started paying after pirating some stuff. E.g. I remember discovering a lot of artists from songs I illegally copied on LAN parties back in the day[1], usually artists too small to be on a lot of rotation on radio and MTV (yes, MTV used to have music, crazy) which I probably would have never known about otherwise. And I gave lots of money to these artists, buying their CDs, going to their concerts when possible, and so on. In the same vein, I discovered artists on whatcd and similar pirate places later on.

And doesn't touch on the "please take my money" issue... There are a lot of things that are out of print, etc, that you cannot pay for. E.g. large companies holding licenses to content may even take works out of print deliberately in tax avoiding schemes - I am not a Hollywood accountant, but from my limited understanding they can declare a loss when doing so which is worth a lot more in tax reduction than keeping a title in print.

And it also doesn't even touch humanity's need to preserve important cultural artifacts for the future.

[0] Remember, up to artists death + 70 years copyright term. While this exact scenario has probably not happened yet, as these rules are too new, you get a glimpse of what will happen in the future when you look about all the legal fighting still happening over Sherlock Holmes - a figure and body of worked created mostly before copyright law even existed.

[1] Yes, I am old. If you have no idea what a LAN party is, it's basically a bunch of people actually meeting in some venue with their computers, wire everything together into a temporary LAN, to play games and swap files, which back in the day really was the only sane way to do mulitplayer and filesharing stuff as internet speeds were so limited, and internet was usually very expensive, often still paying by the minute.

rndgermandude··on Volkswagen develops hydrogen car that can travel 2k kilometers on one tank
Distribution can be figured out, same as it was for fossil fuels and as it was/will be for electric energy. It would be a chicken and egg problem, for sure, however hydrogen has some big pros over electric, in that you can fuel up quite rapidly and get longer ranges, and doesn't have the harmful emissions of fossil fuel (how to produce the hydrogen in the first place is another issue, but the same is true for EV "fuel"). So I can see there could be a market for it as well as political will, if they can figure out the production side at a competitive price point. However, that's a big if.

I can see it entering special markets first, like long haul trucking, and become more widespread from that. Time will tell if that actually will happen.

rndgermandude··on Show HN: Encrypt and hide files inside images
I'd say it's good enough. An adversary would need to know the file the secret is hidden inside, what method was used, probably would need the unaltered container file to compare with to extract the bits, and then has to overcome the additional layer of encryption.

I didn't check the code corresponding to the submitted article, but I'd guess it would be infeasible even for an advanced or even state adversarial actor to automatically check lots and lots of images (unless there is some kind of "signature" that can be detected) just in case there might be some LSB-based steganographically hidden secret inside.

If the adversary is doing a targeted attack against an individual/group of individuals, it might be more feasible, but then I'd wonder if other means of attack, including the good old monkey-wrench-to-the-knee aren't still more efficient.

rndgermandude··on Former WSJ reporter says law firm used Indian hackers to sabotage his career
>And it is very well enforced on both sides.

That guy or gal calling your grandparents about that "fixing that virus" or "refunding that amazon purchase" begs to differ...

rndgermandude··on The Low Cost of Cancelling Someone
My guess is that when such high profile cancellations happen, it's more of a matter of perceived zugzwang.

Some platform does a high profile ban, and then the PR inboxes of the other platforms are set ablaze with journalists asking for comment on how your particular platform wants to handle that person - high profile bans make nice clickbait articles after all - and the twitters and reddits and youtubers and so on of this world talk about what those other platforms are doing/are not doing/should be doing. At this point the other platforms have to do something, either issue a ban as well, or issue some kind of statement why at this time they won't be issuing a ban. Usually the option to just issue a ban as well is a lot easier and PR-wise "safe" than trying to come up with a "defensive" statement of why such a ban is not (yet) appropriate.

rndgermandude··on The Low Cost of Cancelling Someone
Labor protection may help with keeping your current job. But they probably will not help with you advancing your career, and they will not help with your co-workers looking funny at you because somebody on the internet alleged you are a so-and-so-ist. Or customers and/or other partners refusing to work with you. And so on.

Back in school (in Germany[0]) we had a case of a teacher, who among other things taught PE, and who was falsely accused of "inappropriately touching some girls". The girls in question told everybody (except the teachers of course) that they will be fabricating such a story as "revenge" for the PE teacher actually trying to make them take part in PE instead of just sitting around. As soon as the police got involved, they backed down and recanted, apologizing and basically claiming they considered it not "a big deal" and just a "prank", but by that time the damage was done.

The teacher in question had been suspended during the investigation and of course that was the talk of the school and everybody including their parents knew about it. After being cleared, parents would constantly ask to take their kids out of his PE class "just to be sure", so he ended up not teaching PE at all anymore shortly after. Afterwards we usually saw him eat alone, as the other teachers seemed to avoid him, and roam around alone in the halls during breaks instead of going to the teachers lounge like everybody else. He retired as early as he could.

Not directly related to "cancel culture", but to the mindset that goes with it, my mom told me later in life that back in elementary school, one couple took out their kid of my sisters' class before school even started, because their kid had been assigned a teacher who... was male. That was enough. There was no allegation, no rumors of inappropriate behavior, no nothing. The parents in question had never met him before either. He just was male.

[0] Germany has (had) very strong labor protections for teachers. All teachers, including the one I am writing about, used to be "officers of the state" (Beamte), and therefore in order to be fired they'd either have to commit treason, an act against the democratic order, or a crime resulting in a felony conviction of no less than 1 year in prison. These days, a lot of teachers do not automatically become "officers of the state" but are merely employed.

rndgermandude··on Okta Exposes Passwords in Clear Text for Possible Theft
>only true in an edge case

Sorry, when it comes to passwords, in particular plain text ones, this is not good enough.

Then you repeatedly say "hashes", which may mean anything from md5 to argon2id and whatever. Given that Okta stores plaintext in some cases, the generic use of the term "hashes" is a bit of a red flag to me, to be honest.

rndgermandude··on Most books don't sell only a dozen copies
There were many useful facts that I hadn't considered, to be honest, especially regarding what was counted (probbly print sales tracked by BookScan) and how (unique ISBNs).

Also, whenever some party brings up stats to make some point, I think it's fair to examine their figures, methodology and so on and just be a bit pedantic about it. And this was a claim made in a major antitrust case. The facts, and the general pedantry, show some serious likely issues and raise some important questions about the figures a party in a major trial made, and which were then - mostly uncritically - echoed all over the place.

Regarding Kristen McLeans comment:

The "in their dataset" is a very important detail that shouldn't be overlooked. The dataset for this is the book sales figures of the top 10 publisher published books. They get the numbers from partnered retailers (some 75% of retailers according to the article), and it only covers print copies, not ebooks, not audio books. It does not cover direct sales to larger organizational buyers, like library systems, either.

And it's grouped by unique ISBN, not by title. As the article points out, most books come in many editions (hardcover, paperback, etc), each of which has their own ISBN. The article author illustrates this by telling about his own book, which is one book with 4 different unique ISBNs (though one was for an ebook, and one for the audio book, both of which wouldn't be covered by this dataset anyway).

rndgermandude··on It seems that the good times for online Minecraft play are over
I have no issue with Microsoft setting community standards for the online spaces they run, or anybody else for that matter. But Microsoft is setting community standards for places they do not run here, just because these spaces use their software. This is ridiculous, and sets yet another dangerous precedent.

What's next? Maybe Office 360 profanity filter, where your Office 360 account gets banned for writing about the Austrian Village formerly known as Fucking[1] in MS Word? Maybe the Windows 12 won't let you access your perfectly legal porn anymore? Or any files related to Scunthorpe. Or Edge refuses to stream Game of Thrones for you because of nudity and profanity... and then goes on to delete all your data and ban your MS account?

[1] https://en.wikipedia.org/wiki/Fugging,_Upper_Austria

rndgermandude··on Cloudflare's abuse policies and approach
For context, because I didn't know and I'd think others might not either: Apparently Chloe Segal killed herself by going to a public park and lighting herself on fire, telling witnesses in a spoken suicide note her reasons were homelessness and mental health issues.

Josh Moon then playing "Fire" ("I am the God of hellfire and I bring you fire") is in extremely bad taste and outright vile. I can very well see this as gloating.

And yet, it does not prove kiwifarms direct involvement. It's a short extract from a stream he did. Playing devil's advocate for a second, it for example might very well have been a response to media at the time already claiming he/kiwifarms was to blame for the suicide and therefore a rather misguided attempt to poke fun at what he might have considered unfair reporting.

rndgermandude··on Cloudflare's abuse policies and approach
Seriously?
rndgermandude··on Cloudflare's abuse policies and approach
They do have an agenda for sure. That wasn't the question, tho. The question was whether they condone or even encourage their users to target people with the goal of driving those people into suicide?

This might be well the case. I am not one of their users nor am I educated in this matter, so I'd like to know too. When somebody makes this claim, as has been made multiple times in the threads here, with demands to therefore remove kikifarms from the internet, I think it is reasonable to ask for at least some evidence of such a claim.

rndgermandude··on Day ahead electricity prices for EU
>I've read somewhere that Czechs (day ahead price of 463EUR/MWh) produce electricity at 0.1EUR/MWh

No, that's entirely unrealistic. 0.1EUR per KWh is realistic, so my guess is that you misremembered the units. The price per MWh would then be 100 EUR. But not even that is realistic anymore for the Czech Republic, given they produce most energy from fossil fuels[1], and the prices recently have skyrocketed.

Now you may ask why they'd be selling to an exchange and buying it back for more (if that actually happens to a degree that matters). One reason is of course profit. Although one must not confuse the production price with the final consumer price or even the exchange price. Production is one thing, getting the power to where it's needed is another thing, accounting, taxes and so on.

Another reason for putting it into exchanges, is that they might at times produce more than needed, so selling off excess production seems somewhat reasonable as the kind of plants they are running cannot be started and stopped at will. At other times, they might not be producing enough, and then need to buy at exchanges.

It's not as easy as assuming somebody is just grabbing a lot of money. Although some money grabbing is most likely part of the answer as well.

Germany is selling energy as well, by the way. Germany has thus far net exported around 20 TWh this year[2]. The entire energy need of Germany is around 540 TWh per annum. That would suggest Germany (thus far) has exported a little over 5% of it's energy production to other European nations in this crisis year. It may have something to do with France currently having temporarily shut down 32 of its 56 nuclear reactors[3], with a net 10 TWh being exported from Germany in the direction of France. And it probably has something to do with Germany producing a lot more energy than it needs when the sun is shining and the wind is blowing nicely.

The Czech Republic on the other hand exported 6 TWh net to Slovakia and another 4 TWh to Austria. But in turn Slovakia exported almost 9 TWh to Hungary[4].

That is to say... it's complicated.

[1] https://www.iea.org/countries/czech-republic

[2] https://www.energy-charts.info/charts/energy/chart.htm?l=en&...

[3] https://www.france24.com/en/france/20220825-france-prolongs-...

[4] https://www.energy-charts.info/charts/import_export/chart.ht... (might be lagging behind a little)

rndgermandude··on Zuckerberg says FBI warning prompted Biden laptop story censorship
Yes, that guy pressed the button even though he should have known there are consequences to that.

If you implement heuristics, it's your damn job to test your implementation and monitor it for adverse effects.

In the context of this article, somebody made the decision to specifically change the thing (no matter if you want to call it a heuristic or an algorithm or whatever) to bury a certain story. This is not even an unintended outcome, it's an entirely intended outcome.

rndgermandude··on The EU Commission accepts high error rates when checking chats
No
rndgermandude··on A bike tour of Dresden, the heart of Germany’s semiconductor industry
Calling the AfD voter block "outright facists" is not helpful. Yeah, there is sadly plenty of people in there deserving of that description. And yeah, the danger the AfD poses should not be downplayed, nor should the danger of PEGIDA be downplayed.

But study after study, survey after survey has shown that most of the voter block of the AfD are not "outright fascists" but people disillusioned by the establishment parties who then fall prey to the the less extremist public messaging the AfD likes to do. These people aren't fascists', they aren't nazis, and constantly calling them names will certainly not help, but drive them even more towards the AfD.

So please, I implore you to tone down your hyperbole. Where this kind of "basket of deplorables" rhetoric eventually leads we can all watch with horror.

rndgermandude··on Removing HTTP/2 Server Push from Chrome
The http/2 stream is multiplexed over a regular tcp stream. At least some push HEADERS and data was most likely already send over the tcp stream, and is most likely already a few hops away from the actual server. By the time the server actually gets the first http/2 RST_STREAM(s) a lot of data from multiple useless pushes could be inflight already. At this point you cannot just close the http/2 stream to avoid data being send. You can only either RST the entire tcp stream and kill all multiplexed http/2 flowing over it (avoiding some data transfer), or accept the data that arrives on your closed http/2 streams and send it in the direction of /dev/null.

Server push, as opposed to preload/hints, only makes sense when you know a) a client will absolutely need the data and b) you're reasonably sure the client does not have the data yet (e.g. data that is uncacheable).

Page 1 of 34Next →