HNHacker News
TopNewBestAskShowJobs

secure

5,258 karma · joined July 12, 2011

submissionscomments
secure··on Box of Secrets: Discreetly modding an apartment intercom to work with Apple Home
I built something similar! https://michael.stapelberg.ch/posts/2021-03-13-smart-interco...

> I bought the cheapest compatible BTicino intercom device (BT 344232 for 32 €) that I could find on eBay, then soldered in 4 wires and added microcontrollers to make it smart. It now connects to my Nuki Opener Smart Intercom IOT device, and to my local MQTT Pub/Sub bus (why not?).

secure··on Sandboxing AI Agents in Linux
I recently blogged about how I do this using MicroVMs on NixOS: https://michael.stapelberg.ch/posts/2026-02-01-coding-agent-...
secure··on Coding Agent VMs on NixOS with Microvm.nix
Yeah, when you run ≈10k agents instead of ≈10, you need a different solution :)

I’m curious what gVisor is getting you in your setup — of course gVisor is good for running untrusted code, but would you say that gVisor prevents issues that would otherwise make the agent break out of the kubernetes pod? Like, do you have examples you’ve observed where gVisor has saved the day?

secure··on The browser is the sandbox
You might want to add a little note to that effect to your link blog :)

I have added year indicators to my blog (such that old articles have a prominent year name in their title) and a subscribe note (people don’t know you can put URLs into a feed reader and it’ll auto-discover the feed URL). Each time, the number of people who email me identical questions goes down :)

Anyway, thanks for blogging!

secure··on The Holy Grail of Linux Binary Compatibility: Musl and Dlopen
https://github.com/gokrazy/freeze is a minimal take on this
secure··on Can I start using Wayland in 2026?
GNOME’s “proper wayland implementation” also does not work with my monitor, as I explained in the article:

> By the way, when I mentioned that GNOME successfully configures the native resolution, that doesn’t mean the monitor is usable with GNOME! While GNOME supports tiled displays, the updates of individual tiles are not synchronized, so you see heavy tearing in the middle of the screen, much worse than anything I have ever observed under X11. GNOME/mutter merge request !4822 should hopefully address this.

secure··on Can I start using Wayland in 2026?
No, the company has not always referred to itself in all capitals.

https://forums.tomshardware.com/threads/nvidias-name-change....

When I got to know their products, they were nVidia.

secure··on Can I start using Wayland in 2026?
Probably not specific to Sway, but specific to the nVidia driver.
secure··on Can I start using Wayland in 2026?
No, the lesson of “separate display server from window manager” was very clear when Wayland was started. People have been discussing this over the years ever since. (See also “client-side decorations” for another part of this issue that was heavily discussed.)
secure··on Can I start using Wayland in 2026?
I’ve been using X11 with high-DPI screens since 2013, but with integer scaling (200% or 300%), never fractional scaling.
secure··on SGI demos from long ago in the browser via WASM
Was it vroom by any chance? A slot car racing game in space: https://nixdoc.net/man-pages/irix/man6/vroom.6.html

Video:

https://www.youtube.com/shorts/imguo4oUd-c?app=desktop

secure··on Bye Intel, hi AMD I'm done after 2 dead Intels
Thanks for your reply!

Can I suggest that we ask todsacerdoti to add a filter to their cross-posting thingie that skips articles that the author posted to HN?

I’m asking because todsacerdoti’s posts of my content always seem to be the ones that get traction, no matter if I post first on HN or lobsters. In fact, I’m wondering how he can even submit when I have already submitted — why isn’t his post marked a dupe? (To be clear: this was for my prior submissions, not this particular one.)

secure··on I am giving up on Intel and have bought an AMD Ryzen 9950X3D
> If OP's CPU cooler (Noctua NH-D15 G2) wasn't able to cool down his CPU below 100C, he must have been (intentionally or unintentionally with Asus multi core enhancement) overclocked his CPU. Or he didn't apply thermal paste properly or didn't remove the cooler plastic sticker?

I did not overclock this CPU. I pay attention to what I change in the BIOS/UEFI firmware, and I never select any overclocking options.

Also, I have applied thermal paste properly: Noctua-supplied paste, following Noctua’s instructions for this CPU socket.

secure··on I am giving up on Intel and have bought an AMD Ryzen 9950X3D
I’m using Prometheus for this, with the Prometheus Node Exporter
secure··on Bye Intel, hi AMD I'm done after 2 dead Intels
HN mods, can we please finally ban this cross-posting bot called https://news.ycombinator.com/user?id=todsacerdoti?

This is my post, and my own submission got marked as a “dupe” (https://news.ycombinator.com/item?id=45155986).

On every blog post I post, todsacerdoti steals my post. It’s a bot. Why isn’t it banned?

secure··on I like to install NixOS (declaratively)
Yeah, the clicky installer is pretty nice and smooth, but I mention in the article why the clicky installer is not good enough for me to install VMs — you cannot customize/pre-load it, and I want to minimize the manual steps.
secure··on How I like to install NixOS (declaratively)
SuSE Linux (around since the 90s) had such a single-layer-manages-everything approach, so yes, it’s not a new concept.

I used to think that you don’t need Nix to get most of the benefits that Nix/NixOS are known for. And to a certain extent, that’s true — you can achieve much in other scenarios. But by now, I think the reason why Nix/NixOS work well and deliver these powerful abstractions is because they are Nix all the way down, giving you an unparalleled level of integration/reach for your declarative layer.

secure··on How I like to install NixOS (declaratively)
Yes, I use this same config snippet throughout my installs and haven’t gotten around to managing my home with Nix yet.

Later, I refactored this config snippet into a Flake that I include: https://github.com/stapelberg/nix/ …but that’s for a follow-up blog post :)

secure··on I like to install NixOS (declaratively)
Welcome to Linux!

I agree that through the lens of “how much time do you save?”, automating a NixOS installation is not worth it. As you describe, it’s just a few interactive commands in the upstream installer.

But from the perspective of “how much effort is it to spin up a new VM for this new project / task?”, spending the extra few minutes on building the fully automated installation path is well worth it. Also consider the perspective of “how many steps does it take to recover this VM in a disaster scenario?”, where reducing the manual steps to a minimum is very helpful.

BTW, the maintenance of the installer is virtually free: The configuration I show is the configuration I use in NixOS as well, so that needs to be updated anyway. Aside from that, to rebase my installer from NixOS 24.11 to NixOS 25.05, I just changed a number. When setting up a new machine, I can either download the upstream installer and write it to a USB stick, or I can change a number, rebuild (< 2 minutes) and write to a USB stick. Really not much difference.

secure··on How I like to install NixOS (declaratively)
> Almost none of the packages the author listed get used, including zsh

Just to clarify: the point of having packages like lshw and zsh available is not for the case of performing the automated installation (where, yes, they are not used), but for the case where I want to interactively poke around in a booted installer to inspect the target system.

secure··on I like to install NixOS (declaratively)
Glad to hear that the article describes exactly what you need :)

Try out building an installer and run it in a VM, it only takes a few minutes!

secure··on How I like to install NixOS (declaratively)
Yes. I also submitted my article myself (https://news.ycombinator.com/item?id=44148997), but the upvotes came in on this duplicate submission.

I don’t know who todsacerdoti is, but looking at their submission history, it looks like this account automatically cross-posts from other sites (maybe lobsters?)

secure··on My 2025 high-end Linux PC
True, but I tested the Radeon RX9070’s power consumption with a 4K monitor.

  * ASUS, builtin-GPU@4K: ≈39W
  * ASUS + nVidia GF4070@4K idle: ≈50W
  * ASUS + radeon RX9070 (Linux 6.15): ≈80W
secure··on My 2025 high-end Linux PC
> It isn't clear to me but is the author indicating that Linux kernel support for 2.5GbE is still early stages, would it be better to wait a while before getting a motherboard with 2.5?

If you want to play it safe, waiting longer before buying new hardware is always a good strategy. As I wrote, though, aside from needing a new firmware package, I did not notice any issues with the 2.5G support in the end.

> There's a diff being presented between two lshw outputs? How is that diff shown?

I ran lshw > lshw-intel-285k-asrock.txt when I used the ASRock board and lshw > lshw-intel-285k-asus.txt when I used the ASUS board. Then I ran diff -u lshw-intel-285k-asrock.txt lshw-intel-285k-asus.txt and copy&pasted (parts of) the output into the blog post.

secure··on In praise of grobi for auto-configuring X11 monitors
Thanks for the advice. I try switching to Wayland every year, but it has never worked without heavy graphics artifacts / flickering / glitches on any of my machines (I use an nVidia GPU so that I can drive my Dell UP3218K monitor).

Meanwhile, X11 works really well for me. No tearing, no artifacts, no breakages on upgrades. Really can’t complain.

Maybe next year.

secure··on In praise of grobi for auto-configuring X11 monitors
Yes, I didn’t want to analyze and compare different solutions, I just wanted to share the joy of finding a solution that works well for me.

Using hot keys is nice, but hot keys (intentionally) don’t work while my screen is locked. I contemplated mapping an xrandr call onto a smart button (Shelly Button 1, essentially triggering an HTTP request), but in the end grobi has the same effect and is even more convenient than having to press buttons.

secure··on In praise of grobi for auto-configuring X11 monitors
The Dell UP3218K monitor I describe does not work “out of the box” on any OS. Even finding a GPU that can drive it at all is tricky.
secure··on Minimal Linux Bootloader (2018)
I use this bootloader in gokrazy and blogged about debugging a limitation in it a while ago: https://michael.stapelberg.ch/posts/2024-02-11-minimal-linux...
secure··on Rsync replaced with openrsync on macOS Sequoia
Indeed! Have a look at http://github.com/stapelberg/rsync-over-grpc/, where I demonstrate how to use the rsync protocol (specifically, my https://github.com/gokrazy/rsync implementation) over gRPC.

Very handy if SSH+rsync is locked down in your corporate environment, but building services with gRPC isn’t :)

secure··on Rsync replaced with openrsync on macOS Sequoia
I looked at openrsync when I was writing my own https://github.com/gokrazy/rsync implementation (in Go!) and it’s good code :)

It’s a shame that openrsync is not 100% compatible with rsync — I noticed that Apple was starting to switch to openrsync because my own tests broke on macOS 15.

Page 1 of 16Next →