HNHacker News
TopNewBestAskShowJobs

wolrah

2,701 karma · joined December 24, 2014

submissionscomments
wolrah··on How bicycle coaster brakes work (2018)
> leaving deceleration to the motor wears it down much faster

Not in the slightest, and I have no idea where this idea even came from. Whatever amount of stress the engine and rest of the drivetrain is under even at maximum engine braking, it experiences significantly more under any hard acceleration. Even semi truck jake brakes that actually reconfigure the engine's air flow to generate even more deceleration forces than would otherwise be possible max out at a fraction of the acceleration powers that same engine is capable of producing.

The only part of a standard automotive drivetrain that has significant directional differences in strength/wear would be the differential gears, but even that difference isn't going to matter in anything close to normal use. If you're doing clutch drops in reverse that's another matter.

The biggest risk to anything drivetrain-related from engine braking would be badly shifting a manual transmission and either damaging the transmission itself or choosing the wrong gear and over-revving the engine.

The brake light thing I fully agree with you though. I love engine braking when I'm doing performance driving as much as the next guy, but I won't do it in traffic for anything more than holding speed on a downhill for that reason. Significant deceleration in traffic should always be accompanied by brake lights.

wolrah··on USPS whistleblower describes new plans for voting by mail hidden from the public
> The chaos seems to be a feature, not a bug.

There's no "seems to" about it, any benefit of the doubt went out of the window years ago. There's a significant portion of the US Republican party that doesn't just have reasonable questions about when government is the right answer but considers it their explicit purpose to dismantle government institutions which do work well on principle.

wolrah··on Since it was stripped of planetary status, Pluto’s defenders have been fighting
That sure does seem to be the only argument on the "keep Pluto around but nothing else" side, "I learned it this way and I'm done learning"
wolrah··on Since it was stripped of planetary status, Pluto’s defenders have been fighting
The question would be what are the specific rules that lead to that, and how you'd apply those rules outside of our own solar system. Any rule that just calls those distant objects KBOs is specific to our own solar system which is a silly rule to be making in a world where we already knew about hundreds of exoplanets.

The question at hand is "how do we define a planet" from a universal standpoint, because it hadn't really been defined beyond an "I know it when I see it" level and that was becoming a problem.

Objective rules that do not assume you're talking about our solar system are key here, and the serious proposals basically come down to 8 planets or dozens and growing, and from a practical standpoint the former was the obvious choice IMO since all it really affects is what gets focused on in general education environments.

If you just want to make an arbitrary decision that these things are planets because you want them to be as opposed to because they meet certain criteria, that's not useful to anyone.

wolrah··on Since it was stripped of planetary status, Pluto’s defenders have been fighting
Science works on logical rules.

What logical rule would you propose that allows Pluto to be a planet without also bringing in a bunch of others?

If you just want to arbitrarily declare things are they way you like them to be, religion is over there.

wolrah··on Matrox: Graphics for Professionals
Same with the early Xbox VGA mods.
wolrah··on Ask HN: What would happen if your company stopped using all AI tomorrow?
The only thing we use large models (they are not fucking AI, never will be, and calling them that only supports the hype nonsense) for in actual production is voicing generic IVR messages and such. If we lost that we'd go back to having to record them ourselves. Whoopdeedoo.

Other than that, interacting with my boss would become less stupid (or at least be his own variety of it instead of ChatGPT's variety of stupid) and nothing meaningful would change.

Everyone who's saying that they wouldn't get anything done at all, you're already doomed and I can't wait to watch the collapse after this crap has ruined so much.

wolrah··on Suica, Japan's First IC Transit Card
New York and Seattle both have the same thing and it's wonderful. Google Wallet even allows the user to set it to not require an unlock for transit transactions.
wolrah··on I accidentally logged hundreds of thousands of phone calls to military bases
It's also not uncommon for telecom providers to use it for their own internal routing because enough telecom software did in fact develop support for it despite lack of public implementations.

As someone who's been in the VoIP industry for over 20 years it makes me sad to think of what could have been if both ENUM and IPv6 were more widely adopted. For many years you could reach me via email, SIP, or Jabber with the same identifier and if there were effective support for ENUM in the USA my work phone number would have been able to connect you to any of them, directly and with G.722 HD voice long before it eventually came to modern cellular networks.

wolrah··on X262: X264 with MPEG-2 Support
> Handy for those four people left who want to author DVDs, but this is extremely light on details.

MPEG-2 is also used in broadcast television standards, so those of us playing with QAM modulators for home or business internal cable TV networks have to deal with it if we want our channels to be tunable by standard TVs. These days a lot of TVs understand H.264 or H.265 but whether they'll accept it from their OTA/cable tuner or if they reject anything other than standard MPEG2 is up in the air, and of course anything old enough to not have streaming support has no reason to know any newer codecs.

Agreed otherwise, I'm curious what the purpose is when we already have libavcodec under the same license and also what's going on with the links.

wolrah··on Judge sets framework for Nine PBS to retrieve archival data
No idea how OSS and Iron Mountain were doing things so this is pure speculation, but if for example Iron Mountain were providing an object storage platform on which OSS then ran some secondary platform that stored all the data in one place with separate metadata to figure out what's what then it's entirely reasonable that they might not be able to easily separate it out. Not saying that'd be a good way to do it, but it's easily plausible

I do something similar with my clients backups, each individual client gets their own bucket on B2 for many obvious reasons but to sort out anything beyond what's obvious from the bucket name you need the backup software and appropriate encryption keys.

wolrah··on RustDesk now supports true unattended remote access on Wayland
The specific purpose of RustDesk is to have the middleman making remote access across networks easier. It's intended to replace TeamViewer, LogMeIn, etc. not VNC or RDP.

You either pick a middleman you want to trust or you run one of your own, if you don't want that or need the features if offers RustDesk is not for you.

wolrah··on RustDesk now supports true unattended remote access on Wayland
To establish a connection between client and remote host, you are expected to go through a coordination server which you trust, that can be either the official one or your own self-hosted instance. Your client and the remote host will then attempt to directly connect if possible, only actually sending the display and input streams through a relay server if a direct connection is impossible due to NAT or whatever else.

The use case where encryption is not supported is directly connecting by IP address, which is not the intended use for this software. It's an open source analog to TeamViewer, not a replacement for VNC or RDP. The direct connect functionality is there primarily for testing, which is why it's entirely disabled by default and the option to turn it on is buried at the bottom of a dialog that requires elevated privileges to access. If your use case is focused on those direct connections, RustDesk is not aimed at you.

wolrah··on RustDesk now supports true unattended remote access on Wayland
> RustDesk still does not support encrypted connections when self hosting

Not true at all. RustDesk connections are fully encrypted even when using a self-hosted server. What is not supported are encrypted direct endpoint-to-endpoint connections not going through a server at all, because that's not a use case RustDesk is designed for. The feature is intended for testing, which is why it's disabled altogether by default.

If your use case is focused on direct connections without a server, RustDesk is the wrong tool for the job. It's an open-source self-hostable analog to Teamviewer, the server is inherent to the design.

wolrah··on How a device finds encrypted DNS by itself
> since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only

Why would you think this? It's trivial to get certs for internal services that mainstream devices trust, they just have to use names from a portion of the public DNS space that you can demonstrate control over. It doesn't actually have to be publicly exposed.

wolrah··on Nine PBS sues Iron Mountain over blocked access to archival data
> But just 50TB of data? Duplicating that would have been cheap and trivial.

Seriously. I'm just a random nerd and I have a home server with 96TB of raw disk space divided in to two RAIDZ1 pools which cost me around $2500 to build five years ago and has required basically zero maintenance since then.

Hard drive prices are absolutely bonkers right now but even with that in mind if I were to build a modern version of this same machine I could do it for under $10k using brand new hardware and it'd have double the storage

wolrah··on Should you stop cracking your knuckles?
We're talking about a field that is well documented to have been started by an absolute charlatan who believed in magical "subluxations" causing basically all diseases.

We know by all objective measures that the entire idea is a level of nonsense that's almost religious in scale, which is a great analogy because it similarly demonstrates how "lots of people believe in it" is an absolutely meaningless argument.

wolrah··on Bluesky's active user base is shrinking as its focus expands beyond the app
> They aren't better than the Republicans at all.

This is exactly the kind of thing the parent poster was talking about.

The Democrats certainly aren't left, and they're not great, but we live in a world where the Republican party ranges between refusing to condemn and openly supporting white nationalism, gloats about making trans people's lives worse, encourages police to use unnecessary force, etc. even before we get in to the impacts of their economic policies.

Despite being a massive disappointment as far as actually making positive changes, one is still obviously miles better than the other because they're not trying to drive the car the wrong way as fast as possible. Claiming that the two major US parties are no different requires willfully ignoring a lot of bad stuff that one party does for which there is no comparison on the other side. There are absolutely specific issues on which there is often no meaningful difference but as a whole there is a universe of difference.

wolrah··on Should you stop cracking your knuckles?
People who realize that if their athlete believes it'll make them better, and it doesn't actually hurt them most of the time, there's value in indulging them.
wolrah··on A year of fighting scrapers on my 1.5 million-page website
> If I run a local script or an LLM that needs to fetch a web page from your site and you block that script or LLM as being a bot, you hurt me, the user. I wanted the information and I have no way of getting at it without investing my own time and effort in going to your website.

The article you're replying to describes in explicit detail how the bots and their operators have directly caused and continue to knowingly cause real harm to the author and others in similar positions, both financial costs and administrative/maintenance burdens that would not have otherwise been required.

You then respond "but if you block the bots then I won't be able to use the bots, and that harms me because I might have to read your web site myself..."

Are you serious?

> That might or might not be what you expected, but it's worth taking into account.

I would wager that for almost everyone who is blocking bots after getting functionally DDoSed by them this is absolutely an expected and desired outcome.

> And finally, something worth noting is that there are so many websites whose owners complain about bots, but the real problem is that the website is poorly built and should be improved anyway.

Both can be true. If you operate a git repository with a public-facing web interface for example there are going to be a lot of possible operations that are inherently expensive but also incredibly rarely used by normal users so it doesn't really matter, but the bots now ignore your robots.txt and are programmed to go after every link they can find, so they trigger every single possible expensive operation more times in a night than your actual users ever have in the history of the site while dividing requests across so many different IP addresses that rate limiting becomes impossible at the individual scale. These days they're even feeding the discovered URLs back in to their models to have them invent new possible URLs and trying those in hopes of finding content never publicly linked. They will send you thousands of requests for URLs that they literally made up.

Sometimes the site is in fact badly coded and operations that should be simple have higher costs due to bad design but you don't have to look very far to find situations where legitimately high-cost resources are exposed to the public because they're expected to be used in a non-abusive way. We should always be standing up against abuse of public resources, unless we want to lose them altogether.

> Bot traffic is not necessarily bad.

You are right, but whether it's good or bad more or less comes down to a cost/benefit analysis. As we've already covered infinite times, these bots being used to train LLMs cause significant real costs to the operators of these sites. What benefits do they offer in return? We know the clickthrough rates are terrible, so what other reasons would site operators have to make those real costs worth it? So someone can get a response back from an algorithm that confidently misinterprets or even entirely misreports what the data actually meant?

Even the most die-hard "information wants to be free" types who absolutely want their datasets trained on would probably prefer that the bots accessed the data directly via an API or downloaded a database dump rather than spidering and scraping a web interface intended for humans.

wolrah··on PCIe 8.0 spec hits 1 TB/s of bandwidth and has new connector technology
Article is from May, there were a few posts about this topic (though not linking this exact article) back then but none seem to have generated any discussion.

We have what, gen5 in modern PCs? I haven't been paying much attention recently, it's not like I can justify the price of major upgrades thanks to the slopophiles having ruined the memory and storage markets. Whatever it is, it'll be a while before we see this in anything consumer-facing.

1TB a second is just wild though. Wiggling electrons around 256 billion times a second, and then doing it 16 lanes wide reliably for years on end is a feat of absolute wizardry.

wolrah··on A Remote Indigenous Community Built One of Canada's Fastest Fiber Networks
> Around that time, Starlink’s satellite internet service was becoming widely available. Many of WJBTN’s potential clients asked why they shouldn’t just purchase that instead of a fiber-optic connection that involved drilling into their homes.

I feel like this is one of those things where we need a mass education campaign about signal bandwidth, and that wireless is for things that need to move around while maintaining connectivity or things that are just impractical to wire. If it can be wired it should be wired. Starlink and its future competition should not be used as a primary internet connection by anyone that is practical to wire. It's great for RVs, boats, aircraft, etc. and is a wonderful backup connection with a guaranteed diverse physical route that can't be affected by local backhoe activities but it should not even be in the running for a primary connection anywhere that a PON network is practical.

wolrah··on Developers are attached to tools because tools encode trust
> I think we would be better off if people worked harder to prevent vulnerabilities before releasing the software.

Pawn Stars meme: "Best I can do is people using glorified chatbots to generate mediocre code an order of magnitude faster"

That said, the vast majority of the exploits that led to the widespread adoption of automatic update mechanisms were based around memory safety bugs which we do in fact have solutions to entirely prevent in most newly developed software these days.

wolrah··on Over 150k Flights: Airlines Just Flew the Busiest Day in Recorded History
You are correct, most people who were trying to get from California to Maine or the reverse for the purpose of getting there would probably prefer to fly. Unless a ticket were significantly cheaper than air travel almost everyone doing the full trip has at least one train enthusiast in their party who is doing it because they want to do it.

The thing is, a high speed corridor enabling that trip would, as you note, involve many stops of which each pairing represents another potential flight that the same train might replace. Many of those pairings will be short enough flights that a proper high speed rail corridor would easily compete with if not destroy the short-haul flight offerings.

To use your example, it looks like there are currently two flights between California and Maine, both run weekly by United between PWM and either LAX or SFO flying east on Saturday mornings and returning west on Sunday morning. A hypothetical high speed rail corridor connecting coast-to-coast between either of those city pairs might not replace a lot of flights across the whole country but one train running along that full route might have replaced one from Portland to Buffalo, another from Boston to Columbus, another from Cleveland to St. Louis, et cetera.

wolrah··on 24,650 internet-accessible BMCs leak password-derived hashes before login
> The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.

The management ethernet port of most servers I've ever encountered is also, by default, bridged to the first non-management ethernet port in a failover configuration where if the dedicated port is not connected the management controller will connect to the "eth0" port instead.

> It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.

"Well if you just use it right the footgun is perfectly safe..."

Every industry has their own category of "rules written in blood" either metaphorically or literally, and a LOT of them come down to the fact that if there's a right way and a wrong way to do things, and the right way is not the path of least resistance, it's going to be done wrong constantly by everyone who thinks they can get away with it. You have to make your systems as easy as possible to do things the right way and as hard as possible to do things the wrong way.

If it can be connected directly to the internet it will be directly connected to the internet. There are a lot of people working in IT or performing entry level IT tasks in a company with no official IT who have only learned what they absolutely needed to to achieve their desired outcome. As the famous imgur comment says, "Human Engineering: As long as it does what I want it to do, it doesn't matter what else it does." They can access their server remotely and their thought process stopped there.

The default shipping configuration should be as secure as is practical to implement. Deprecating and disabling by default a protocol known to be insecure for decades seems like table stakes to me. They could still leave it present so those who had infrastructure depending on it could turn it on, but disable it by default on new hardware and present a prompt on firmware upgrades for older versions recommending it be disabled if not used. Other easy ones I could think of for server management controllers in particular would be to recommend either configuring an allowlist or even disabling the default gateway altogether so it's unable to directly communicate outside of the LAN.

Insecure-by-default "you should know better" is bad design. Yes, they should know better, but you know that a lot of them either won't know better or will be incentivized to not care.

wolrah··on LLM Usage in Debian: Three Proposals
> Shouldn't OSS be the first to benefit?

OSS projects have in many cases been the first to be hurt by LLMs.

As you note, LLMs are heavily trained on OSS code. This makes them very good at "license-washing" copyleft code in to a decidedly-not-cleanroom reimplementation which is different enough at first glance that it would be hard to stop without a legal battle most OSS projects could not even dream of.

Plenty of ink has also been spilled on how LLMs have led to a significant increase in administrative workload for OSS maintainers by allowing users to produce a high volume of both bug reports and pull requests that are likely to be of varying quality or adherence to project standards but unlike a new human contributor will never develop in to a better community member. It's infinite newbies forever, a computer-generated Eternal September.

On top of all that, as noted in the Debian proposal the companies training these LLMs have proven themselves to have no shame or concern for the resources of others in the process of gathering data, inefficiently crawling every single URL they can find and nowadays even using their own models to generate new potential URLs that have never existed, in ways specifically designed to make filtering, rate limiting, or blocking the traffic altogether as hard as possible while performing what are often some of the most resource-expensive requests. These tactics have imposed substantial real costs on basically everyone who hosts their own infrastructure as well as community hosting projects, without even getting in to the hardware-related cost increases every single one of us have experienced.

LLMs have gone to a lot of OSS projects, stolen their code, beat up their maintainers, and emptied their wallets. Now the LLM people are coming by wanting big projects to work with them, "for their security" like a protection racket.

wolrah··on Is this the end of the once-mighty GoPro?
> and their software is horrible

As a long-time GoPro owner who recently added an Insta360 X5 to his collection, I can't really see any meaningful difference in software horribleness. They are both really really bad, with ads everywhere constantly pushing subscriptions to their cloud services.

At least with the normal cameras the software can be entirely ignored, I can take video from my Hero5 straight in to any ordinary NLE and go from there, but the 360 camera requires their software to convert from the native format to anything usable, even if I'm keeping it as 360 footage.

The worst part IMO for both is that they prioritize mobile apps over their PC software so if you want to edit on a computer like a normal reasonable person you lose features compared to idiotically doing things on a phone.

wolrah··on I'm a USB-C Maximalist
Those power supplies often shipped with both a full cord input which was grounded but also a folding two-prong component that made it in to a wall wart and of course was not grounded.
wolrah··on I'm a USB-C Maximalist
> The issue with a generic cord is that it won't connect the earth pin on those chargers.

Nor does the two-prong "wall wart mode" tip many of them shipped with. The ground was only connected on the extended cord attachment.

wolrah··on I'm a USB-C Maximalist
Those Apple chargers in fact use the C7/C8 connector to interface the plug adapter, so you can skip their official parts and use any compatible cord.

I for years used a power cable from an Xbox with my old Magsafe1-era Macbooks.

← PreviousPage 2 of 32Next →