HNHacker News
TopNewBestAskShowJobs

sunshine-o

1,030 karma · joined February 25, 2023

submissionscomments
sunshine-o··on Enhancing X11 Application Security with LXC
This is a great article.

I have little experience with lxc but I guess waypipe could be an option too.

sunshine-o··on U.S. government will decide who gets to use GPT-5.6
Honest question: for those working with those models on offensive security, how much does this move make sense?

I am asking because I have seen a growing number of stories about organizations getting owned by either raw mismanagement of security, supply chain attacks that are often a failure at the ecosystem level, npm, etc.

I am not really seeing from what we hear about the use of AI for penetration as a threat yet. The growing problem with security seems to be more at the management and ecosystem layers.

Not many story that netfilter, ipfw or pf got owned by one of those frontier models.

A lot of stories that organisation X and Y left keys on a public repo for months.

sunshine-o··on European Commission lines up Amazon and Microsoft for cloud gatekeeper status
The problem is nobody believe those company would ever hand over 10% or even 1% of their turnover to the EU.

The EU should be careful with those kind of threats because in the world that is taking shape I can really imagine MS telling them one day that none of their Windows is gonna boot tomorrow if they don't calm down. The EU at large is totally dependent on those companies so who is really fearing who?

sunshine-o··on Digital euro clears key hurdle as EU seeks to break free from U.S. credit cards
> How does digital euro replace credit cards? That's basically the same as direct debit. It doesn't address the reason why I use credit cards.

Exactly, it is just their latest marketing move to have people accept it.

I was in a meeting at the ECB 6 years ago, the digital euro was high priority and we were supposed to see the first pilot 5 years ago.

The project is actually older and I saw schematic of the system and screenshot and the management interface 6 years ago. It was developed by a German company.

I am not sure why we are not using it right now... it can either be:

- the urgency, like upcoming financial collapse, disappeared,

- the bank lobbied so hard they killed the previous design,

- the EU is just insanely incompetent.

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
My guess is a lot of people had too much expectations for blockchain and crypto.

I remember here on HN 10 years ago everybody wanted to put everything on a blockchain. Some were betting on the collapse of the financial system.

None of those things happened but ethereum created a neutral, stable, secure cheap and transparent programmable financial platform.

Because it is neutral a lot of people ported the bad things happening in the traditional financial system to crypto: the scams, debt, speculation, etc.

And then most people started to hate it.

I guess 20 years ago most porn was hosted on Apache web servers, now it would be nginx. Should we hate nginx because of porn?

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
Yes.

So DAI is a distinct system from USDS. The relationship is the creator of DAI is the same as USDS and I believe his new organisation maintains the legacy DAI contract and system.

If I remember correctly, the DAI model was beautiful:

- Instead of getting your DAI from an exchange, you could deploy your own instance of a vault, lock your ETH as collateral in it and mint DAI.

- So it was not a unique vault for every DAI but you could choose your collateral assets from an authorized list for your own vault.

I am not sure if in the case of a collapse of USDC and USDT you would have been the only one able to close your own vault and get back your good collateral assets...

Those "decentralised" stablecoins are complex and feel like they had to start from a blank page and create USDS to stay relevant in a more competitive and regulated crypto world. For example USDS has the mechanism to block it for specific holders (like USDC and USDT) but it hasn't been activated as far as I know.

This is why when there is a hack ETH, BTC and DAI are used because they are the "better" money...

In the end I agree, if you can back a decentralized stablecoin with a centralized stablecoin, how good is that system really?

The best stablecoin is the one you deploy a vault for, back it with over-collaterized (anywhere between 3 and 10x) uncensorable cypto (like ETH) and are the only one who can close the vault unless it get liquidated.

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
You are forgetting Ethereum which is the defacto main standard and driver in the "crypto industry". Most of those chains are in fact EVM based (so outside of Bitcoin, XRP or Solana).

The people in and around the Ethereum Foundation are solving very interesting problems but nobody talk about it on HN. For example I believe they are at the forefront of the use zero-knowledge proofs.

Just dig into [0].

Is the Ethereum Foundation and broader project dedicated to pumping the cryptocurrency ETH? obviously not and they are not by far the top holder of it.

The fact that the crypto is not providing real returns is actually one of the main criticism of the project.

- [0] https://ethereum-magicians.org/

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
I believe with x402 and USDC you can pay as low as $0.000001 per HTTP request with no fees.

The existing "credit card" infrastructure is not designed to compete with that.

Now some actors like Paypal could have come up with an HTTP 402 standard and implementation 25 years ago but they never did. I am not sure why.

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
> Stablecoins are not backed by a central bank. Instead their source of value comes from a private company that holds actual US dollars or USD-equivalent reserves (like treasury bills, etc).

Yes but the problem is there are already a lot of US dollars and the pandora box was opened since the end of WW2 at least.

Is the US dollar you hold in a bank outside of the US the same as the one in the US? no...

Are they all insured and backed by the Federal Reserve? absolutely not.

In a sense if you are abroad the USDC you get from Circle on a blockchain are much closer to a "real" dollar than most of us can get their hand on.

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
In recent years, since a lot of central banks have been putting gold and other assets instead of US dollars on their balance sheet, the dollar need new outlets and this is what those stablecoins through Circle and Tether are: easy access to dollars for anybody with a computer and internet connection, skipping banks and other financial institutions.

Trump is a pro crypto president in the sense that he is making it official and a lot of actors in finance are fighting it because it is killing their own lucrative scam.

The whole Trump memecoin and World Liberty Financial is shady but really a side story.

The bottom line is if you hold USD a lot of "legacy" actors are making money on your back. With stablecoins Tether, Circle & co join the party.

sunshine-o··on Crypto in 2026: Oh, This Is the Bad Place
The original stablecoin, DAI, used since 2017 by a lot of people living in countries ravaged by horrible inflation cannot be taken away.

It can just be a smart contract with overcollaterised crypto backing it. And the idea is kind of genius.

All the USDT and USDC which appeared later on a just "proxy" for "real" dollar hold by Tether or Circle. There is nothing permissionless or decentralized about them.

So "stablecoin" can mean very different things in practice.

sunshine-o··on WhatsApp's "End-to-End Encryption" Is the Biggest Lie in Tech History
By the way, I remember the chat apps interoperability in Europe was announced more than 2 years ago but so far no major competitor app have enabled it.

What are our options today to chat with WhatsApp users without using their app?

sunshine-o··on W Social, public institutions and the theater of European digital sovereignty
The whole * media industry got so bad we just assume it will be controlled, whether it is on a piece of paper, TV or the Internet.

Sad.

sunshine-o··on W Social, public institutions and the theater of European digital sovereignty
I thought it was a reference to the Weimar Republic.
sunshine-o··on DeFi Labelling in Argos: How We Classify Every Transaction on Ethereum
Nothing against that particular company but I have noticed access to indexed data for users is getting harder and harder in the ethereum ecosystem.

Etherscan (the leader I guess) and others are limiting more and more access to their API through "Access to selected chains community endpoints". But no simple user will be willing to pay $50 a month for a bit of data.

All those companies are chasing big clients like a wallets but now that we have x402 [0] why not offer a pay per request / pay as you go option?

I haven't really followed that space but it seems the fact that TheGraph [1] never really succeeded in their model is one of the reason there is a problem to access indexed data for users.

- [0] https://www.x402.org/

- [1] https://thegraph.com/

sunshine-o··on Frood, an Alpine Initramfs NAS (2024)
ZFSBootMenu and Alpine are a beautiful match.
sunshine-o··on Iroh 1.0
I am looking at the awesome page [0] and was surprise not to see a syncthing equivalent.

Wouldn't that an obvious use case? or am I missing a technical limitation?

- [0] https://github.com/n0-computer/awesome-iroh#file-sharing

sunshine-o··on Yserver: A modern X11 server written in Rust
The wayland.fyi people might have a point on the whole X11 vs Wayland thing [0].

At least it is worth reading.

- [0] https://wayland.fyi/

sunshine-o··on A Call to Action: Stop the FCC's KYC Regime
Same problem with IPv4.

We've been paying for v4 and v6 for decades but somehow we cannot get rid of v4. My guess is there are a lot of interests at play.

sunshine-o··on Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
This is something that worries me with a distribution like Alpine Linux.

It is hard to avoid a package like chromium [0] or firefox which are in the "community" repo. Now have fun check it at every update, this is not practically feasible.

For the web browser one can say we should use Flatpak anyway but there are a lot of other apps like sway from the community repo that cannot be flatpaked.

- [0] https://pkgs.alpinelinux.org/package/edge/community/x86_64/c...

sunshine-o··on A Call to Action: Stop the FCC's KYC Regime
Phone numbers are just a liability:

- It is kind of expensive,

- You are forced to provide it to many official institutions,

- It is the default or mandatory insecure 2FA for many institutions,

- It always get leaked somewhere and is one of the most common/reliable identifier.

We still have them around governments and telcos love it and old people and scammers are its last users.

sunshine-o··on Why I'm Forced to Say Farewell: Google Management Has Lost Its Moral Compass
> Sundar Pichai in 2018 stated very clearly that “AI applications we will not pursue: …

> 3. Technologies that gather or use information for surveillance violating internationally accepted norms.

Really?

Algorithms for ads and mass surveillance were always at the core of Google model.

And there is not really such thing as "internationally accepted norms", Google, as a pioneer, literally defined them at the time.

sunshine-o··on The EU Open Source Strategy
Asianometry just released a video about this: The EU Chips Act is a Failure [0]

Definitely the most cynical video he ever released.

- [0] https://www.youtube.com/watch?v=eqoX9OIR-DI

sunshine-o··on GrapheneOS user reported to authorities for using GrapheneOS
My guess is computers will end up soon where cars are today.

I will be unclear if you can use your GOS, Linux or BSD computer. You might get stopped, checked, if the authorities want to screw you they can always find something. If you have an accident your insurance will find something.

So you will live in a constant fear of getting caught, and you do not really know why. Until you end up getting a chromebook, aka a bus card or Uber rides.

In most western countries the rules for car safety are draconian but I see everywhere 80+ years old people, out of their mind, driving SUV while looking at their phone.

Since the 2010 people would call themselves hackers because they hang out here, use Github, VSCode and know about Kubernetes. But now you are about to get arrested for using GOS or whatever. At least the meaning of the term hacker is getting its shine back a bit.

sunshine-o··on Ask HN: Is the web for machines (/llm.txt) the one we wished we had as humans?
I just found out Cloudflare supports real-time html to md conversion [0]

- [0] https://blog.cloudflare.com/markdown-for-agents/#convert-htm...

sunshine-o··on Ask HN: Is the web for machines (/llm.txt) the one we wished we had as humans?
llms.txt usually includes a clear sitemap and description of information available on a site.

There are also clear definition of the restful scheme and API/data access options.

One very basic example would be the weather channel https://weather.com/llms.txt

sunshine-o··on Ask HN: Is the web for machines (/llm.txt) the one we wished we had as humans?
Amazing, I didn't know.

So it get even stranger, I am the only one reading those /llms.txt ...

sunshine-o··on Love systemd timers
This is actually something that I like in systemd.

I am dealing with mostly non systemd system: BSD, Alpine, termux On BSD anacron works well, but I do not why I am always running into problems with the cronie anacron implementation. And it is very hard to debug.

I would really like a simple modern cron/anacron alternative.

Cronicle looked cool but it is node.js, a bit heavy and being replace now by their new product called xyOps anyway.

sunshine-o··on Radxa Dragon Q8B: A Laptop Cosplaying as an SBC?
This is a one beautiful SBC.

Apparently we might be able to run OpenBSD on it [0]

FreeBSD is unclear [1]

- [0] https://www.openbsd.org/arm64.html

- [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267292

sunshine-o··on EU fines Temu €200M for allowing sale of illegal products
Yes, but who is fining the commision?

The best way to fight Temu would be to maintain a society where young people are not so desperate that the only comfort they can afford is to order the cheapest crap online.

← PreviousPage 3 of 19Next →