Hacker News Reader

untitaker_on ICE is using fake cell towers to spy on people's phones

like I said, if you assume your adversary is the US government then they might as well start issuing rogue TLS certs to target individuals.

untitaker_on ICE is using fake cell towers to spy on people's phones

I don't think there are many options to host sourcecode and binaries in a way that is safe against an adversary like the US, and especially in such a way that technically illiterate users are protected. Because you'd have to assume that CAs are not off-limits either then.

untitaker_on ICE is using fake cell towers to spy on people's phones

I think GP is talking about a scenario where Microsoft would serve either malicious source tree or binaries to just one user, not all of them. that would be fairly hard to detect. but in such scenarios we'd also have to start asking questions about the state of the entire CA ecosystem.

untitaker_on You too can run malware from NPM (I mean without consequences)

i can guarantee you npm will externalize the cost of false-positive malware scans to package authors.

untitaker_on Building a BitTorrent client from the ground up in Go (2020)

the answer to this problem in general is NAT hole punching, but BitTorrent doesn't actually have an answer to your problem. if you are behind a NAT, you can only connect to peers that are not behind a NAT or have port forwarding set up. for popular torrents this is good enough because you don't have to connect to all peers.

> This is possible with port forwarding. But that's a niche set of peers, who have the power to configure port forwarding on a NAT proxy.

yes it's niche but I guess this means BitTorrent isn't as P2P in practice as one wants it to be, but held up by seedboxes.

untitaker_on AI companies cause most of traffic on forums

Presumably they switch UA to Mozilla/something but tell on themselves by still using the same IP range or ASN. Unfortunately this has become common practice for feed readers as well.

untitaker_on JavaScript dos and donts Mu-An Chiou

browsing code is one usecase. opening issues (and having many tabs of issues open), discussing pull requests is another one. I don't think an SPA would be suited for that kind of content. Discourse might be a counter-example, but they had to do strange things for SEO, and some of its UX choices are also controversial.

I was mildly intrigued when github.dev launched and I could just open vscode in my browser. best of both worlds in a sense, just not very well integrated into each other.

untitaker_on GRC SpinRite

lmao

untitaker_on GRC SpinRite

people complain about character assassination in this thread, but then, what is this supposed to be?

untitaker_on HTML Web Components: An Example

> If we're not doing any state manipulation and are just using static props I don't see why we even need any abstraction at all.

People are using React outside of SPAs just because they're already used to it, and because it's got a rich ecosystem of reusable components.

I don't know how to implement setShowTooltip in vanilla js and webcomponents. It is probably really ugly. But also, making your web components work with progressive enhancement does not necessarily mean you have to get rid of React. You can still use React to define a custom HTML element, and combine the state management of React with the progressive enhancement of web components.

untitaker_on HTML Web Components: An Example

the problem is that react is being used outside of SPAs, for any sort of interactivity, because it is easy to hire for at this point and because there are a lot of existing components to choose from. so yeah, progressive enhancement doesn't work if the actual component is state-heavy, or the entire site is state-heavy. When React came out, its tutorial was very centered around being embeddable on existing web pages, and it was framed as more of a "jQuery replacement". IIRC the term SPA didn't even exist yet. The other commenter already pointed out what the end result is.

if you don't do it for accessibility, do it for SEO. yeah a lot of commenters here already pointed out that SSR is a thing now, but the concerns you had still apply then. There's two paths to test now, one with JS and one without. This kind of always was the case though.

untitaker_on A four year plan for async Rust

All of this would be correct in an alternative reality where everybody in the Rust community, including every person ever involved in the language's evolvement isn't aware of these complaints.

untitaker_on A four year plan for async Rust

This is a popular sentiment that I share to some degree, but I really wish we could just move on from this discussion. It happens in every post that is even just vaguely about Rust or async. It's like reading complaints about the GIL on a post that is loosely connected to Python! At some point it just gets boring.

"I will forever argue that [...]" -- Why are you forever arguing?

"I feel like I am alone with [...]" -- No, I read it every day on here.

untitaker_on FFmpeg-online: ffpmeg running on the browser

Similar, but nicer UI: https://ffmpeg.app

untitaker_on Austria rail operator OeBB unveils new night trains

ideally yes but i don't think it can be done with the current organizational structure of the european rail network. not consistently, only bilaterally

untitaker_on Austria rail operator OeBB unveils new night trains

> There is already a bottleneck on these trains because the staff need to bring you to the compartments.

No, that's just not how it works most of the time with ÖBB, not even in Nightjet. I walk in and the ticket inspection happens later. Yes there's staff outside with NJ to sort you in, but you can walk around them. At no point are they a real bottleneck.

untitaker_on Austria rail operator OeBB unveils new night trains

> Additionally from Amsterdam to Zürich 3 people got robbed while still in the Netherlands. This train is reservation only, they could at least lock the doors or something to prevent criminals from boarding.

compartments can be locked, locking up the entire train and having the entire boarding process be bottlenecked on ticket inspectors seems highly impractical

untitaker_on Ask HN: What is nitter and why does it still work?

other instances are working. they are denoted at https://github.com/zedeus/nitter/wiki/Instances and more readably at https://status.d420.de/

untitaker_on Misinformation should be refuted, not censored

https://en.wikipedia.org/wiki/Brandolini%27s_law

> The amount of energy needed to refute bullshit is an order of magnitude bigger than that needed to produce it.

untitaker_on UK pulls back from clash with Big Tech over private messaging

brilliant idea. let those governments know who really rules the world. we already have a bunch of dictatorships censoring the internet on purpose, so let's do their job for countries whose democratic processes can't do it for them.

untitaker_on What do I think about Community Notes?

this is not what vitalik is saying. he is saying that the output of the algorithm has not been modified after the fact. he explicitly mentions the possibility of vote brigading and fake accounts, both of which are well within elon's capabilities.

untitaker_on Request: Re-open JPEG XL issue

this has nothing to do with what i am talking about. the issue is legitimate but there are no news or interesting insights here.

untitaker_on Request: Re-open JPEG XL issue

this is a rando spamming the chromium issue tracker. what is newsworthy about this?

untitaker_on A guide to closures in Rust

I agreed with your original comment but this insistence on "functions never capture environments" is not useful when a really large portion of programmers come from those kinids of languages and are trying to learn Rust.

You can insist on correct terminology or adapt to your surroundings and try to speak the language of your target audience. I assume somebody who calls closures "anonymous functions" is speaking as a JavaScript developer to JavaScript developers. Even if not, it's not unreasonable to adopt the terminology of such a popular language.

untitaker_on AWS’s anti-competitive move hidden in plain sight

I have a suspicion that cloud vendors are using bandwidth pricing as a way to deter abuse. Can't use them for ddos, tunneling, file sharing or mass scraping that easily anymore. The lock-in is a nice side effect.

Though Corey is talking about internal network use and I am talking about bandwidth to internet

untitaker_on How do you quickly search databases that are hundreds of millions of records?

Try just using ripgrep, sed, cut, etc. I found it is good enough for most data analytics I want to do on dumps like these. Particularly replacing grep with ripgrep makes a big difference.

If that isn't fast enough, perhaps try feeding them into clickhouse. There is a recent talk on fosdem about how to load dumps easily into it: https://fosdem.org/2023/schedule/event/fast_data_analytical_...

untitaker_on Google to remove all VPN ad blockers that don’t comply with their policy

Which content-blocking APIs are you talking about? Blockada just started hosting a DNS server. Google just made it so that blocking decisions can't be made locally anymore and all my used domain names are sent to a third-party server. Given deployment of SSL and even cert pinning in almost all apps I know of, I doubt the local VPN API allowed them to gather much more info than hostnames either.

EDIT: I see you're affiliated with Google Play. You should've lead with that.

untitaker_on Cloudflare Pages: Best server tech since CGI-bin?

Cloudflare automatically redirects any /foo.html URL to /foo, with a permanent redirect. That is certainly not standard behavior, neither on httpd nor gh pages

untitaker_on Cloudflare Pages: Best server tech since CGI-bin?

Site generators hiding it is not a problem for portability. Supporting that redirect is also not a problem! Permanent redirects are.

Also, old-school is still the dominant way with how small sites are hosted, in terms of number of hosting providers who offer cgi hosting.