HNHacker News
TopNewBestAskShowJobs

xtajv

172 karma · joined May 7, 2017

submissionscomments
xtajv··on TikTok removing posts for violating the "joy of TikTok"
This is legitimately reassuring.

There are nearly-century-old journalistic guidelines and ethical codes about what you do and do not put into widespread news media.

Posting explicit details about methods used in a celebrity suicide encourages copycats.

Posting explicit details about a shooter's extremist philosophical beliefs brings those beliefs closer to the mainstream AND encourages copycats.

There was a certain recent college debate that I was very surprised to see proliferate across social media, because of the fact that We Do Not Publish Snuff Films.

I actually assumed it was a deepfake, doubted AP News Wire and Reuters, and finally bought it when I saw a tiktok from the TMZ cutting room floor. The fellow in charge didn't believe it either... until he did, and then it was an all-hands-on-deck moment steadied by someone clearly experiencing a huge surge of adrenaline but keeping their cool while operating in their element.

xtajv··on The fight between doctors and insurance companies over 'downcoding'
There's plenty of hasty generalizations going on in this comment.

If you see this sort of thing happening in the U.S., the place to complain is your state's insurance board.

Medicine is hard enough without people TRYING to do harm.

And actuarial science is brutal enough WITHOUT glossy justifications for assuming that healthcare providers are bad actors.

xtajv··on The fight between doctors and insurance companies over 'downcoding'
Translation: Insurance companies intentionally injecting bugs into their own software to make requests that don't respect user input.

Despicable.

xtajv··on The fight between doctors and insurance companies over 'downcoding'
Fire insurance protects against the rare disaster where there's a fire.

Flood insurance protects against the rare disaster where there's a flood.

Health insurance protects against the rare disaster where somebody's actually able to get healthcare.

xtajv··on Meshtastic 64 – A meshtastic radio for the Commodore 64
It pains me to mention this but I don't think it's responsible not to: https://github.com/meshtastic/firmware/issues/4030

At time of writing (2025-09-27, plus or minus a timezone), there does not appear to be any serious attempt to secure application-layer message contents. (At least, not yet)

My hope is that this cool new radio link option will still gain traction and grow and develop without painting itself into a corner, security-wise.

To wit- security hints on https://en.wikipedia.org/wiki/OSI_model have improved substantially since my last readthrough.

xtajv··on Goodbye, Six-Figure Tech Jobs. Young Coders Seek Work at Fast-Food Joints
I dream that LLMs will be the disaster that finally convinces the software engineering field that code isn't so "soft" after all, and that software engineering should be licensed, bonded, and insured.

Every single other engineering field has gone through it. "Regulations are written in blood".

xtajv··on P-fast trie, but smaller
Oh no you're right- usually the handwavy argument that will be made is "Okay, hashing is never O(1) in the bitlength of the input... it's O(1) in the number of elements being hashed, and the rest of the complexity analysis is done relative to the number of elements".
xtajv··on Abusing Entra OAuth for fun and access to internal Microsoft applications
Oh boy, this should be good. Mark my words, this will be followed by a "proof" of nonexistence, in the following form:

"Well, let's build a list of attacks that I can think of off-the-cuff. And then let's iterate through that list of attacks: For each attack, let's build a list of 'useful' things that attackers could possibly want.

Since I'm the smartest and most creative person on the planet, and can also tell the future, my lists of ideas here will actually be complete. There's no way that any hacker could possibly be smart enough or weird enough to think of something different! And again, since I'm the smartest and most creative --and also, magically able to tell the future-- and since I can't think of anything that would be 'worth the cost', then this must be a complete proof as to why your security measure should be skipped!"

xtajv··on Abusing Entra OAuth for fun and access to internal Microsoft applications
> Network security is such an afterthought but it’s the best layer of defense you can have!

I mean, it's an additional layer.

Defense-in-depth is about having multiple.

xtajv··on Abusing Entra OAuth for fun and access to internal Microsoft applications
I guess the term "defense in depth" has fallen out of fashion?
xtajv··on Abusing Entra OAuth for fun and access to internal Microsoft applications
Usage of the slang "auth" is my current favorite indicator of complete cryptographic snakeoil.
xtajv··on Open Lovable
It seems like trademark infringement.
xtajv··on Show HN: Companies use AI to take your calls. I built AI to make them for you
https://hothardware.com/news/google-sued-by-original-pixel-o...

IDK about you, but I went from "die-hard Nexus lover/Pixel preorder" to ungoogling everything in my life (including every piece of "family tech support" hardware for which I do tech support and periodic maintenance).

For the uninitiated: The Google Pixel had a factory defect in soldering that made the chip housing the audio codec flat-out fall off. For me, the issue manifested at month 13 into a 12-month warranty, with the symptom that I could receive phone calls or play music, but no audio in/out of any kind was actually reaching the device, no matter whether I used 3rd party peripherals, wired headphones, native speaker, the works.

Google's "solution" for the factory defect --which they acknowledged in a thousand-person google group dedicated to debugging the issue-- was the following inane reasoning: "Well, these are cell phones, which means that we have your cell phone number... so how about we just call you?"

Keep in mind, this required me to keep my SIM parked in a non-functional device for the prospect of receiving a phone call which I would not be able to hear or respond to.

I still remember that bug nearly a decade later and will NEVER use a Google Pixel, Google Fiber subscription, or Waymo vehicle unless I see substantial convincing evidence to suggest that anyone at the company understands that "reliability engineering" includes building a support and repair model for paying customers.

Until then, Goodbye, Google.

xtajv··on FOKS: Federated Open Key Service
This is actually so needed. I've heard the phrase "minting your own tokens?!" used as an argument for (N)oAuth. The current state of affairs is honestly just sad.
xtajv··on FOKS: Federated Open Key Service
Okay sorry nobody's said it yet. I'll say it.

You cannot call it that.

I will not be entering the workplace and suggesting that we use a product whose name is very easily mistaken for "the F word". It is an immediate non-starter.

(I'm sure it's a great project, and you probably meant for people to pronounce the name as "folks" rather than... y'know, the other way. I'm telling you this in a spirit of kindness so your project can be more successful and see increased adoption)

xtajv··on I used o3 to profile myself from my saved Pocket links
Obligatory: Please do not assume that you will be able to accurately profile strangers based on metadata or "digital footprint"-type information.
xtajv··on Progressive JSON
Choose APIs that offer SLAs. <3

It's not about being picky. It's about communicating needs, and setting boundaries that are designed to satisfy those needs without overwhelming anybody's system to the point of saturation and degraded performance.

xtajv··on Progressive JSON
There's nothing wrong with "accidentally-overengineering" in the sense of having off-the-shelf options that are actually nice.

There is something wrong with adding a "fancy" feature to an off-the-shelf option, if said "fancy" feature is realistically "a complicated engineering question, for which we can offer a leaky abstraction that will ultimately trip up anybody who doesn't have the actual mechanics in mind when using it".

xtajv··on I can’t understand Apple’s Critical Alert policy (2023)
hey so idk if folks remember how DoNotDisturb got intro'd.

(anybody else do "Lock-in" drills in school where we all had to be SILENT?)

xtajv··on I can’t understand Apple’s Critical Alert policy (2023)
No it doesn't.

Some of us are just like, really particular about schedules.

(The internet is full of weirdos, sorry).

xtajv··on Gmail will soon stop support for the 3DES encryption cipher for incoming SMTP
> A scenario where the attacker controls the plaintext being sent but doesn't know what the plaintext is seems quite unlikely.

https://en.wikipedia.org/wiki/Chosen-plaintext_attack#In_pra... comes to mind.

(Not sure what attack scenarios OP had in mind -- iust sharing the usual CPA example)

xtajv··on I can’t understand Apple’s Critical Alert policy (2023)
P.S. I'm sorry to be grouchy about it- I just don't think folks realize that yes, 1. emergency infrastructure really does run over the same networks as everything else 2. That We carve out special lanes for emergency/911 packets. That traffic is special.
xtajv··on I can’t understand Apple’s Critical Alert policy (2023)
Ok sorry, I'm going to state the obvious.

The "Apple Critical Alerts" API is clearly intended as a replacement channel for cellular emergency alerts[0]. (If not a "replacement", then perhaps a "supplemental" option. Redundancy is good when we're talking about whether "911" works).

The "Apple Critical Alert" API policy, restricting who's allowed to call the API, is a good thing. You just do not get performant public notifications if you allow just anybody to broadcast. (Milli)seconds count, people.

I hate Singleton patterns as much as anybody. And I hate when business happens behind closed doors, with limited public access, and restricted opportunity for public comment.

But again, if we're talking about the choice between """ locking down this one special channel, because it's responsible for real-time public safety alerts """ vs. """ asking how many broadcasters can possibly share that channel, before contention and congestion result in human-perceptible delays to alert delivery. """ Then I would opt for the former.

--- [0] You know how your phone will buzz REAL loud if there's like, an Amber Alert or Tsunami or something? That's a feature of the cellular system. To my knowledge, emergency alerts and 911 calls go over a separate dedicated mini-channel, which has gone by various names through POTS/2G/3G/5G and beyond. A.K.A.s: - Public Warning System (PWS) - Wireless Emergency Alerts (WEAs) - CMAS (Commercial Mobile Alert Service)

xtajv··on Hypothalamic deep brain stimulation augments walking after spinal cord injury
> So in fact with things like transgender it is things like the hypothalamus-pituitary link that is interfered with to shut down endogenous sex hormone production

If by "interfered with",you mean "corrected to adjust for an otherwise-torturous feedback loop where the brain is hardcoded from birth to interpret the body itself as pain", then yes, this is an accurate statement about dysphoria.

Zhou et al (Nature, 1995) is my favorite study where this fact about trans people has been confirmed via brain scans or postmortem dissection, but I've got about 20 more if anybody's got questions about whether gender dysphoria is actually a thing.

One could also defer to the piles of statements from medical organizations attesting to the scientific fact that trans people exist and are born like that and are merely receiving medical treatment for a bona fide medical condition. For some inane reason, this extremely painful condition is politically-incorrect to discuss in plain terms, because it is literally so bad that people will "turn pain into a contest" when talking about it.

We see this in the statistics.

41% is the lowest suicide attempt rate statistic that you will find in any respectable study on the amount of suffering involved here.

That particular statistic has a tendency to go down if people are allowed to receive medical treatment for their medical condition, but I need people on the internet to understand that gender dysphoria is absolutely worth killing oneself over.

P.S. For the woke kids in the audience who would accuse me of "transmedicalism" because I'm willing to mention that this stuff literally shows up on brain scans, please refer to the opening discussions in "Comprehensive Care of the Transgender Patient" regarding DSDs and the large diversity of known etiologies for gender dysphoria.

Just because your dysphoria doesn't show up in the bNST doesn't mean that it's not there, or not measurable. Nobody is excluding your pain by acknowledging that diagnostics and imaging are literally part of medicine. Cancer patients also get tests, and if their cancer doesn't show up on one particular screening exam, it probably shows up on another.

If your scan hasn't been invented yet, you can in the meantime defer to psychometrics like GIDYQ-AA, UGDS-GS. Those instruments are also options to measure clinically-significant gender dysphoria, and if your clinician is uneducated or unwilling to use established psychometrics, find a doctor who follows AMA recommendations.

Doctors who don't oughta lose their license.

xtajv··on Winding down Google Sync and Less Secure Apps support
> Part of the problem is that it's just so opaque. You send the token and the server replies "nope", with no further explanation.

Catch-all HTTP 401s and 403s are there to thwart https://en.wikipedia.org/wiki/Oracle_attack - unfortunately, servers cannot afford to be "helpful" when it comes to unauthenticated clients.

xtajv··on An Old Conjecture Falls, Making Spheres a Lot More Complicated
I'm terrible - one might even go so far as to say that the telescope conjecture has collapsed.
xtajv··on All EU Members are committed to achieving full climate neutrality by 2050
why not both? :)
xtajv··on Hotel safety tips from a former intelligence officer
"I don't have to worry about $PARTICULAR_DISASTER_SCENARIO because I've already precomputed a strategy for that scenario by ruminating about it."

!=

"I don't have to worry about $PARTICULAR_DISASTER_SCENARIO because I'm generally organized and well-situated above a certain threshold: If you picked a random disaster scenario $x out of a hat, chances are pretty good that I'd already be equipped to handle it."

P.S. Not trying to "counter-argue", just sharing a different perspective.

xtajv··on Tell HN: Chinese TikTok is the most privacy invasive app I've ever seen
Bugs are just security issues.
xtajv··on Qualcomm shook down the cell phone industry for almost 20 years (2019)
I remember the ol' "LTE is short for Long Term Employment" joke.

It took me several months of strictly non-4G-related work to recognize vanity license plates again.

← PreviousPage 4 of 5Next →