HNHacker News
TopNewBestAskShowJobs

vayup

305 karma · joined October 30, 2020

submissionscomments
vayup··on Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]
Some of the stuff that was extracted from the unencrypted traffic in the link:

- T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text.

- AT&T Mexico cellular backhaul: Raw user internet traffic

- TelMex VOIP on satellite backhaul: Plaintext voice calls

- U.S. military: SIP traffic exposing ship names

- Mexico government and military: Unencrypted intra-government traffic

- Walmart Mexico: Unencrypted corporate emails, plaintext credentials to inventory management systems, inventory records transferred and updated using FTP

This is insane!

While it is important to work on futuristic threats such as Quantum cryptanalysis, backdoors in standardized cryptographic protocols, etc. - the unfortunate reality is that the vast majority of real-world attacks happen because basic protection is not enabled. Good reminder not take our eyes off the basics.

vayup··on Android's sideloading limits are its most anti-consumer move
> now Google has stopped providing device trees for the newer ones which I therefore won't buy

Yeah, that sucks. I don't know if they made any official statement on that. I hope they will continue releasing device trees. It's a feather in their cap that the best mobile device to use for de-Googling so far was a Pixel device (with alt OSes). I hope they won't lose that distinction.

vayup··on Android's sideloading limits are its most anti-consumer move
Almost all of the pushback I have seen is on the notion of "developer registration", not the cost. That's what I was responding to.

I don't know how much it costs. But if there's any pushback that it costs too much, my comment is not about that.

vayup··on Android's sideloading limits are its most anti-consumer move
No, I am not flexing. I am just stating a fact.

FWIW, I am also pissed that there are only two mainstream options.

vayup··on Android's sideloading limits are its most anti-consumer move
Dare I say it, I think we're being too harsh on Google here.

When you own a massively successful consumer product like Android, which is foundational to users' lives, you have an obligation to your users to keep them safe*. Sometimes you will have to choose between protecting users who don't know what they are doing at the expense of limiting users who know what they are doing. In this case, they have chosen to err on the side of the former.

I get it. It's OK to not like this development, especially if you use a lot of sideloaded apps. However, if you call this "anti-consumer", then perhaps you and Google have different notions of who the consumers are.

All said and done, Android/Pixel is still the most open mobile platform. Users are still free to install other AOSP-based OSes such as Graphene OS, which have no such restrictions on sideloading.

PS: I'm a former Google employee. I don't think I am a Google shill. I worked on mobile security, but I was not involved on this matter.

* I am using "safety" as a catch all for privacy and security as well.

vayup··on Ask HN: What's the best alternative to Dragon NaturallySpeaking?
With VoiceBuddy:

- You can just focus on the content and speak naturally. It is extremely smart in applying punctuation and formatting.

- You don't need expensive Microphones to get good accuracy. The crappy microphone that comes with your laptop should be good enough.

For me Dragon was pretty much unusable without expensive microphone setup. And even then, it needed constant intervention for punctuation and formatting.

Here's an example of what I mean. In these tests, I just spoke the words, I did not dictate any punctuation. Mistakes annotated by ~

VoiceBuddy (with microphone built into my cheap Logitech Webcam): The color of animals is by no means a matter of choice. It depends on many considerations, but in the majority of the cases tends to protect the animal from danger by rendering it less conspicuous. Perhaps it may be said that if coloring is mainly protective, there are to be but few brightly colored animals. There are, however, not a few cases in which vivid colors are themselves protective. The kingfisher itself, though so brightly colored, is by no means easy to see. The blue harmonizes with the water and the bird, as it darts along the stream, and looks almost like a flash of sunlight.

Dragon 15.6(with the same microphone), unusable due to recognition errors: ~the color of ~monuments~ is by no means a matter of choice~ ~it depends on many considerations~ but in the majority of the cases tends to protect the animals from danger by rendering it less conspicuous~ ~perhaps it may be ~saidthat~ if coloring is mainly protective~ ~and~ ~not~ to be but few brightly colored animals~ ~there are~ however~ not a few cases in which ~we~ ~would~ colors ~of~ themselves protective~ ~the kingfisher itself~ though so brightly colored~ is by no means easy to see~ ~the blue harmonizes with the water ~the~ bird~ as it darts along the stream~ and looks almost like a flash of sunlight~

Dragon 15.6 (with $220 high-end microphone setup - Sennheiser): The color of animals is by no means a matter of choice. It depends on many considerations~ but in the majority of the cases tends to protect the animals from danger by rendering it less conspicuous~ ~perhaps it may be ~saidthat~ if coloring is mainly protective~ there are to be but few brightly colored animals~ ~there are, however~ not a few cases in which we would colors are themselves protective~ ~the kingfisher itself, though~, so brightly colored~ is by no means easy to see~ ~the blue harmonizes with the water and the ~board~~ as it darts along the stream~ and looks almost like a flash of sunlight~

vayup··on Jeep pushed software update that bricked all 2024 Wrangler 4xe models
No attack suspected here. Nonetheless, it exposes an often under appreciated attack vector. It is scary how easy it will be for a motivated actor to cause chaos by just bricking stuff en masse.
vayup··on Ask HN: What's the best alternative to Dragon NaturallySpeaking?
I am the developer of VoiceBuddy. If you use windows, give it a try. I have been using Dragon for 15 years, and made VoiceBuddy because I thought it can be a lot better.

www.voicebuddy.co

vayup··on Qualcomm to acquire Arduino
There is a whole lot of commerical products built out of what we consider hobby projects (Adruino, Raspberry Pi). Eg: digital displays, industrial equipment controllers etc. All of this is clubbed under the nebulous IoT moniker.

My take: Qualcomm hopes to leverage Adriano adoption to expand their IoT share, and also to grow Adruino's footprint to include more smart IoT devices using Qualcomm's chipsets (Eg: Robotics)

vayup··on Fire destroys S. Korean government's cloud storage system, no backups available
A lot of folks are arguing that the real problem is that they refused to use US cloud providers. No, that's not the issue. It's a perfectly reasonable choice to build your own storage infrastructure if it is needed.

But the problem is they sacrificed "Availability" in pursuit of security and privacy. Losing your data to natural and man-made disasters is one of the biggest risks facing any storage infrastructure. Any system that cannot protect your data against those should never be deployed.

"The Interior Ministry explained that while most systems at the Daejeon data center are backed up daily to separate equipment within the same center and to a physically remote backup facility, the G-Drive’s structure did not allow for external backups."

This is not a surprise to them. They had knowingly accepted the risk of infrastructure being destroyed by natural and man-made disasters. I mean, WTF!

vayup··on Signal Protocol and Post-Quantum Ratchets
CNSA 2.0 FAQ: https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI...
vayup··on Signal Protocol and Post-Quantum Ratchets
That's not how we approach security. We don't think in terms of 'Trust' in algorithm. We think in terms of risk management. It's not uncommon for new algorithms and approaches to have algorithmic or implementation flaws. That is a risk. One of the mitigations we often consider is adding another layer of defense.
vayup··on Signal Protocol and Post-Quantum Ratchets
This is a good time to remind everyone the technically sound choice of hybrid crypto is discouraged by NSA. I wish they didn't. PQ is a major overhaul to crypto systems. Setting aside the risk of yet-to-be-discovered algorithmic vulnerabilities, there is a huge risk of implementation mistakes leading to compromise. Mature classical crypto should be used as a backstop by deploying PQ in hybrid mode along classical crypto.
vayup··on Signal Protocol and Post-Quantum Ratchets
Counter argument: When the sole reason for existence for Signal is private/secure messaging, it makes sense to resist opening up to third party development.

That's a big can of worms that invariably will impact their ability to deliver on their main mission - private IM. Eg of problems: Who gets dev access, how do you vet plugins/aps from deceiving users, would users understand the risks, when an app gets compromised how to fight malicious campaign to discourage using Signal etc. etc.

vayup··on The AI coding trap
When it tells me that I need to switch to act mode for it to read files and create a detailed the plan, I just chide gently and ask it to read the damn files in plan mode. Works every time. I wish I dont have to do that.
vayup··on Memory Integrity Enforcement
In theory, it is a 1/15 chance of successful attack. Which is a terribly low success rate of attack prevention.

In practice, it is 15/16 chance of detection of the exploit attempt. Which is an extraordinarily high rate of detection, which will lead to a fix by Apple.

Net net, huge win. But I agree they come across as overstating the prevention aspect.

vayup··on Memory Integrity Enforcement
> ...attackers must not be able to predict tag values that the system will choose. We address this issue by frequently re-seeding the underlying pseudo-random generator used to select new tags.

This point could use more explanation. The fundamental problem here is the low entropy of the tags (only 4 bits). An attacker who randomly guesses the tags has 1/16 chance of success. That is not fixed by reseeding the PRNG. So I am not sure what they mean.

vayup··on The thousands of atomic bombs exploded on Earth (2015)
it = country that is evaluating its response to an attack on another member
vayup··on The thousands of atomic bombs exploded on Earth (2015)
Good time to remind everyone that Article 5 does not really commit the member states automatically into a war. It will be insane for any country to sign such a treaty. The language in Article 5 permits each NATO member to decide for themselves what action they want to take when Article 5 is invoked.

This is what it says:

"The Parties agree that an armed attack against one .. shall be considered an attack against them all and ..that, if such an armed attack occurs, each of them, ...will assist the Party or Parties so attacked by taking forthwith, individually and in concert with the other Parties, such action as it deems necessary, including the use of armed force, to restore and maintain the security of the North Atlantic area."

vayup··on Google can keep its Chrome browser but will be barred from exclusive contracts
> Can anyone now simply claim they're a competitor and get access to Google's tons of data?

The ruling lays out the definition for "Qualified competitors". Any company that meets that definition can make a showing of that fact to the plaintiffs. Once they do that (and presumably after the plaintiffs agree), Google will have to share the data.

vayup··on Ask HN: What trick of the trade took you too long to learn?
As I grew older (and hopefully wiser), I have internalized investment returns is a lot more than sanitized numbers. I did the numbers and as a result did not buy much real estate when I was yonger. It was pretty clear, if I put the same cash outflow into stocks, I would come out ahead... Way ahead!

The things is, I didn't put the same cash outflow in stocks. For various reasons. But mainly, it was just not psychologically palatable to max out my investments on equity by streching my finances. With hindsight, given the buffer in most real estate investments (left with tangible assets, banks shouldering some of the risk etc.) it would have been a lot more psychologically palatable to investment my max in real estate.

My point is not that real estate is "best". But merely, there is a lot more to returns than cold numbers. If you think you already understand it, and are under 30, you are likely underestimating the significance of that. I know I did.

vayup··on Bloom Filters by Example
Same with me
vayup··on Android phones could soon warn you of "Stingrays" snooping on your communicatio
Basic defense against Stingray type devices is to disable 2G in your settings. In theory, you may not have coverage when only 2G is available. In practice, it is 2025.
vayup··on OpenAI charges by the minute, so speed up your audio
Gemini charges by tokens rather than minutes. I used VAD to trim silence hoping token count will go down. I noticed the token count wasn't much different (Eg: 30 seconds of background noise had the same count as 2s of background noise). Either Gemini API trims silence under the hood, or the nature of tokenization is dependent on speech content rather than the length. Not sure which.

In either case, I bet OpenAI is doing the same optimization under the hood and keeping the savings for themselves.

vayup··on Quantum mechanics provide truly random numbers on demand
Quantum random source is a solution looking for a problem. Today the industry widely uses hardware random number generators whose entropy source comes from physical phenomena. Yes, it has its own problems. But having an entropy source with insufficient entropy is not one of them.
vayup··on Monster Cables picked the wrong guy to threaten (2008)
Has a "...what I do have are a very particular set of skills, skills I have acquired over a very long career. Skills that make me a nightmare for people like you." energy to it.
vayup··on Passkey marketing is lying to you (it's actually really simple)
The premise that this is a new drawback introduced by passkeys is false. If a relying party wants to lock you into big tech ecosystem for authentication, they can do that today by only supporting SSO from them. They don't need to wait until passkeys come about.
vayup··on Reviving Chromebooks with Ubuntu
Reviving Chromebooks is a lot easier than that. Just install ChromeOS flex.
← PreviousPage 2 of 2