Hacker News Reader

wolfgang42on Australian who ordered radioactive materials walks away from court

> just piling on ugly radioactive waste in your bedroom

This is an egregious mischaracterization which detracts from your otherwise excellent comment. Lidden was working on collecting the periodic table in decorative display cases.[1] I don’t get the point of coin collections either, but that doesn’t mean I would describe one as a “grubby heap of heavy metals.”

[1] https://www.luciteria.com/element-cubes/plutonium-for-sale

wolfgang42on Parallel ./configure

Some relevant discussion/pointers to other notes on this sort of proposal can be found here: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/AutoconfVa...

(The conclusion I distilled out of reading that at the time, I think, was that this is actually sort of happening, but slowly, and autoconf is likely to stick around for a while, if only as a compatibility layer during the transition.)

wolfgang42on Ask HN: Share your AI prompt that stumps every model

Linking to ChatGPT as a “source” is unhelpful, since it could well have made that up too. However, with a bit of digging, I have confirmed that the information it copied from Wikipedia here is correct, though the AP and Spokane Times citations are both derivative sources; Mr. Thomas’s comments were first published in the Rochester Democrat and Chronicle, on July 11, 1988: https://democratandchronicle.newspapers.com/search/results/?...

wolfgang42on How I blog with Obsidian, Hugo, GitHub, and Cloudflare

I’ve been through a couple of different tools for my personal blog, and, having seen this trap, every time I did the migration I made sure to write a blog post about something completely unrelated instead. A few years ago I built my own static site generator and I vowed that I would never try to publish it for other people to use, another trap[1] that often springs on enthusiastic developer-blogger types.

[1] https://news.ycombinator.com/item?id=21616774

wolfgang42on How I blog with Obsidian, Hugo, GitHub, and Cloudflare

Personally, I’m a lot better at recognizing good writing than producing it, and LLMs are great at being a “calculator for words.”[1] Writing posts became a lot easier once I got an automated editor I could tell to “break up this run-on sentence to make it less confusing” or “rearrange these paragraphs so I introduce concepts before I start using them”. The end result is still the same, but this way I save a lot of time I used to spend glaring at Roget, Strunk, and White.

[1] https://simonwillison.net/2023/Apr/2/calculator-for-words/#c...

wolfgang42on This site uses cookies to store the fact you clicked “Accept Cookies”

Yes, it’s a design choice, in that you have chosen to design something worse for the sake of feeling industrious.

There is no need to show a consent banner for authentication cookies (these are considered “Strictly necessary cookies... essential for you to browse the website and use its features, such as accessing secure areas of the site”). On the flip side the directive on tracking consent covers any method of tracking, it doesn’t let you go “nyah nyah, I didn’t use a ‘cookie,’ I made my own and called it something else!” so if you think you would need a banner for a cookie, you will need a banner no matter how you do it.

wolfgang42on This site uses cookies to store the fact you clicked “Accept Cookies”

The only difference between your “DOM cookie” technique and a browser cookie is that it sounds like you’ve (re)invented a session cookie that only works with single-page apps. Either way it boils down to an opaque session ID token which is stored on the client and sent to the server with every request. You could do the same expiry/crosschecking/validation on the server either way; it makes no difference for security how the client stored it.

Frankly, this entire codebase is full of code smells that are hallmarks of Dunning-Kruger security (I should know, I was like that myself once!) and the fact that you haven’t learned anything in the 3 years since it was written is alarming.

wolfgang42on This site uses cookies to store the fact you clicked “Accept Cookies”

Could you explain how, rather than linking to the middle of a large chunk of code? Fundamentally you need to have some way to associate the data on the server to a particular client, and cookies (or something like them) is the way HTTP does that. In particular, your link appears to be using PHP’s $_SESSION, which... uses a cookie.[1] (Or a URL parameter, but that’s usually a much worse idea than cookies, especially for something that’s handling logins.)

[1] https://www.php.net/manual/en/session.idpassing.php

wolfgang42on The Columbian Orator taught nineteenth-century Americans how to speak

Most people today will be familiar with her as depicted in the title card for Columbia Pictures.

The Big Three TV broadcasters (NBC, ABC, CBS: National Broadcasting Company, American Broadcasting Company, and Columbia Broadcasting System) are all named after the country, though CBS now seems like the odd one out.

wolfgang42on Certification Authority/Browser Forum adopts new security standards

There are also plenty of ways to set it up so the only thing the public can see is that the name exists; and you should probably be prepared for that to become public knowledge anyway (even if using a wildcard certificate), if only because there are so many ways for users to accidentally cause DNS leaks.

Using an ACME DNS challenge would be the simplest option if it wasn’t such a pain to integrate with most DNS services; but even HTTP challenges don’t actually need to expose the same server that actually runs the service, just one that serves /.well-known/acme-challenge/* during the validation process. (For example, this could be the same server via access control rules that check what interface the request came in on, or a completely different server with split-horizon DNS and/or routing, or a special service running on port 80 that’s only used for challenges.)

(I was thinking about this a lot recently because I had a service that wanted to do HTTP challenges but I didn’t want to put the whole thing on the Internet. In the end my solution was to assign an IPv6 range which is routed by VPN internally but to a proxy server for public requests: https://search.feep.dev/blog/post/2025-03-18-private-acme)

wolfgang42on Goblin.tools: simple, single-task tools to help neurodivergent people with tasks

Most computer people, perhaps. For the average user the difference between an app and a website (especially an app-like website) is much fuzzier, and “launching” an app sounds more technical (and thus more appropriate for an operation that they don’t entirely understand) than “opening” it, so that’s the word they use.

wolfgang42on Goblin.tools: simple, single-task tools to help neurodivergent people with tasks

I suspect this tool is probably tuned to help with “14-step coffee days”[1] rather than big projects; the list you got is genuinely the more plausibly helpful one for that situation.

[1] https://crafty-butch.tumblr.com/post/638122754578726912/by-w...

wolfgang42on Ask HN: How much traffic do you serve and with which database engine?

The OP doesn’t give any hints as to what users are doing, so as I said I just assumed “last 90 days of data” was the only query they’d make, but it’s a fair point that that caused me to leave out CPU power since it’s basically negligible for just shoveling data off of a disk.

Thanks for expanding on my comments about how important actually having detailed requirements is for doing performance calculations!

wolfgang42on Ask HN: How much traffic do you serve and with which database engine?

Let's do some math.

First, the IOT devices reporting daily. In the absence of further context, I’m going to assume that it doesn’t matter when the devices report, so they can be configured to spread out their load. I’m also going to assume 1kb of data per device, but with an HTTPS API there’s roughly 7kb of overhead that we need to account for when calculating bandwidth. (Source: http://netsekure.org/2010/03/tls-overhead/ . TLS session resumption gets that down to ~300 bytes, but adds implementation complications.)

    $ units -1v '1M req/day' 'req/sec'
        1M req/day = 11.574074 req/sec
    $ units -1v '1M req/day * 8kbyte/req' 'kbyte/sec' # Incoming bandwidth
        1M req/day * 8kbyte/req = 92.592593 kbyte/sec
    $ units -1v '1M req/day * 1kbyte/req' 'years/TB' # Storage
        reciprocal conversion
        1 / (1M req/day * 1kbyte/req) = 2.7379093 years/TB

It looks like our load here is a whopping 12 RPS, and we could handle the traffic on an ISDN line from the 1990s. Data storage is a little trickier; if we can’t compress or delete old data we may have to stop by Best Buy for a new hard drive every half decade or so.

Users can’t be configured to load balance themselves, so we’ll be pessemistic and assume that every single one of them logs in to check their device over their morning coffee. We’ll also assume that every time they do that they want all of the data from the last 3 months, though in practice this could probably be summarized before we send it to them.

    $ units -1v '5000 req/1 hour' 'req/sec'
        5000 req/1 hour = 1.3888889 req/sec
    $ units -1v '5000 req/1 hour * 90 kbyte/req' 'MB/sec' # Outgoing bandwidth
        5000 req/1 hour * 90 kbyte/req = 0.125 MB/sec

For this, we have just under 2 RPS, but our responses are quite a lot bigger so the bandwidth is higher—we probably want to move into the early 2000s and upgrade to a DSL connection. Oh, and we also want to make sure our disk can handle the read load—but conveniently, since we’re just pulling raw data and not asking for any complicated joins, these numbers are actually the same. 2 RPS gives us 500ms per request; since a spinning rust drive pessimistically takes 10ms/seek we only have a ~50-seek budget per request so we probably want to make sure to cluster or partition the table by device to improve data locality. (Doing that increases the write load significantly, though, so maybe we want to upgrade to an SSD or think about a database that’s smart enough to do some kind of periodic bulk rebalancing.)

Oh, I almost forgot, we'll also want to make sure we have disk space to keep track of all of those idle logins who aren’t doing anything:

    $ units -1v '1M records * 1kbyte/rec' 'GB'
        1M records * 1kbyte/rec = 1 GB

Modern computers—for very relative definitions of modern—are fast, if they don’t get bogged down. Based on my numbers, you could probably run your system from a Macbook in your desk drawer; but it would be trivial to add a requirement which would multiply any of these numbers by several orders of magnitude. The problem with trying to compare architectures is that you have to really understand what your needs are, and not only are they going to be difficult to compare to someone else’s setup (small differences can add up fast when multiplied across requests) but it’s also hard to tell how much effort the other system put into optimizing (or, for that matter, how much effort you want to put into optimizing).

wolfgang42on The “strategic reserve” exposes crypto as the scam it always was

Famously subject of the biggest heist in Canadian history: https://en.wikipedia.org/wiki/Great_Canadian_Maple_Syrup_Hei...

wolfgang42on We were wrong about GPUs

The quest for performance has turned modern CPUs into something that looks a lot more like a JITed bytecode interpreter rather than the straightforward “this opcode activates this bit of the hardware” model they once were. Things like branch prediction, speculative execution, out-of-order execution, hyperthreading, register renaming, L1/2/3 caches, µOp caches, TLB caches... all mean that even looking at the raw machine code tells you relatively little about what parts of the hardware the code will activate or how it will perform in practice.

wolfgang42on I tasted Honda’s spicy rodent-repelling tape and I will do it again (2021)

TIL about http://demo.gltr.io/client/index.html

The specific top_k counts were:

I(4) tasted(927) Honda(5363)'s(0) spicy(327) rodent(11589)-(0)re(202)pelling(1) tape(5202) and(6) I(1) will(67) do(29) it(3) again(0)

So we can conclude that the LLM doesn’t think much of “tasted Honda” or “repelling tape”, and was very surprised by “Honda’s spicy rodent”, but it knows enough about human nature that “and I will do it again” came as almost no surprise whatsoever.

wolfgang42on A hexagonal-tiled cartogram for U.S. counties

Yeah, an important but little-understood fact about ZIP codes is that they are not an area, but a collection of points (≈mailboxes) and polylines (delivery routes); this is because they were created by the post office, who care about logistics, not land. You can try to impute geographical location from them and this mostly works, but there are fun edge cases such as an area where the streets going in one direction are in one ZIP code and all of the cross streets in a different one. The code for an address can also be changed at USPS’s convenience (making comparisons over time difficult); in extremely rural areas “your ZIP code” may be whichever town you prefer to pick your mail up from.

(My favorite fun fact about ZIP codes: 12345 is the General Electric headquarters and factory in Schenectady, New York. They get a lot of mail addressed to Santa Claus.)

wolfgang42on Ross Ulbricht granted a full pardon

You’re not going to hear from the people who thought it made perfect sense, so the replies are a pretty biased sample. (This is also true of the parent complaint about reading comprehension, tbh.) But I see three confused replies and three corrections (not counting my own), so it doesn’t seem to be every reply.

I think the problem is that I took an artistic style in an attempt to paint a picture for the reader, but I did it in a long thread on a technical forum where people are probably mostly skimming rather than engaging in literary criticism, so I should maybe have anticipated this would be a problem.

wolfgang42on Ross Ulbricht granted a full pardon

I thought that starting my story in media res would make for a better dramatic effect, but it seems I overestimated my audience and went a little too heavy on the narrative ellipsis.

wolfgang42on Ross Ulbricht granted a full pardon

I mean, it’s possible that the library had rearranged their chairs in the intervening years and that exact one was now at a different table, but it was certainly a chair in the same location.

wolfgang42on Ross Ulbricht granted a full pardon

He was being arrested in the article, not IRL. When I say “Ulbricht walked into the public library and sat down at the table directly in front of me” I mean that I read

> He went... past the periodicals and reference desk, beyond the romance novels, and settled in at a circular table near science fiction, on the second floor... in a corner, with a view out the window and his back toward the wall.

and realized that I was in the Glen Park public library, at a circular table near science fiction on the second floor, in a corner with my back to the window, and facing directly towards where the article had just said he had sat.

wolfgang42on Ross Ulbricht granted a full pardon

Tangentially related: I had the disconcerting experience of reading a Wired article about his arrest[1] while unknowingly sitting about six feet from the spot where he was apprehended. When I read that the FBI agents had stopped at Bello Coffee while preparing their stakeout, I thought, huh, interesting coincidence, I just had a coffee there.

Then Ulbricht walked into the public library and sat down at the table directly in front of me, and suddenly as I was reading I could look up and see exactly the chair he had been in, where the plainclothes police had positioned themselves, how they had arranged a distraction.

Having this tableau unexpectedly unfold right in front of my eyes was a fascinating experience, and it certainly made the article suddenly get a lot more immersive!

[1] https://www.wired.com/2015/05/silk-road-2/

EDIT: to be clear, I was not present for the arrest. I was reading the magazine, some years after the arrest, but in the same place as the arrest. (I didn’t qualify the events with “I read that...” since I thought the narrative ellipsis would be obvious from context; evidently not.)

wolfgang42on One Dog vs. the Windows 3.1 Graphics Stack

Furries do tend to be more open about kink (as part of the community’s general culture of acceptance), but to describe furry as a “kink subculture” is misleadingly reductive at best.

wolfgang42on Fun facts about SQLite

> If you have constant, multiple, concurrent writes on a non-append-only database, it is bound to perform poorly no matter what database you pick.

This is obviously incorrect, since Postgres can handle more than one simultaneous write transaction just fine. The rest of your post is accurate, but this is an intentional design decision to simplify SQLite’s implementation, not some fundamental limitation.

wolfgang42on Minutes of a Meeting Held at Gear Ratio on Tuesday 13 June 78 [pdf]

The Forgotten Weapons video says that probably less than 100 of these were ever produced, and the production line never managed to make one that worked properly. This seems like an important detail which is missing entirely from the Wikipedia article. (There used to be a paragraph mentioning the small production run, but it got lost in this edit[1] in 2021.)

[1] https://en.wikipedia.org/w/index.php?title=Mamba_Pistol&diff...

wolfgang42on Ask HN: Predictions for 2025?

That requires the parents to be accepting and engaged, which is a great long-term goal but will take much longer to achieve than the first-order effects of losing access to peer communities. (There are also feedback loops: a group being less visible means that people in the group are less likely to realize it isn’t something uniquely wrong with them, there are fewer other people who know fact from myth, and so on.)

wolfgang42on Training myself to run farther with Strava's API and an IoT dog feeder of M&Ms

From the fine article itself:

> If you wanted to have this thing completely isolated though, you could have a no-outbound-internet subnet with this device on it so long as the device you are going to run the script on has line-of-sight.

> You can do this because Tuya devices have a local-only protocol that tinytuya supports, so you can send commands just within your LAN.

wolfgang42on Throbac: THrifty Roman numeral BAckwards-looking Computer

After staring at the linked PDF for a while, I think the display was a collection of lightbulbs (presumably behind a mask plate), probably arranged something like this:

     Upper dial   V XV
     (Quotient)    III
  
     Lower dial LLLVV
  (Accumulator) XXX X
                   IIII

wolfgang42on The optimised version of 7-Zip can't be built from source

Prepare yourself for a shock then; bootstrapping rustc starts from an already-built version of rustc[1]:

> the only way to build a modern version of rustc is a slightly less modern version.

(There is, at least theoretically, a non-circular bootstrap chain starting with a very old rustc written in OCaml, but the more practical alternative is probably to use mrustc[2] instead.)

[1] https://rustc-dev-guide.rust-lang.org/building/bootstrapping...

[2] https://guix.gnu.org/en/blog/2018/bootstrapping-rust/