HNHacker News
TopNewBestAskShowJobs

y0ghur7_xxx

2,612 karma · joined May 15, 2008

submissionscomments
y0ghur7_xxx··on Rewards of Up to $500K Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days
> If there is a commonly used open source library without hackable bugs, you won't even hear about the author who committed his/her own time to build reliable software.

Come on, that's not true. There was a sectest made on dovecot a while back, and it came out to be a really well written piece of software, and everybody complimented the authors and had kind words for them. Same for ssh and a lot of other oss.

y0ghur7_xxx··on Norwegian Consumer Council report on how tech companies use dark patterns [pdf]
This filter removes most of the cookie dialogs: https://github.com/r4vi/block-the-eu-cookie-shit-list
y0ghur7_xxx··on Going IPv6 Only [pdf]
> What do you do if your cellular provider goes IPv6-only, but your home ISP will only give you a v4 address?

Get a tunnel from he[1] and access the home network through that.

[1]https://tunnelbroker.net/

y0ghur7_xxx··on Issues and requirements for SNI encryption in TLS
Seems like slowly the web is becoming secure like TOR.
y0ghur7_xxx··on Blockers to IPv6 Adoption
> the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.

But that's not a problem for me. It's a problem for my isp. And if he does not care, why should I?

y0ghur7_xxx··on Blockers to IPv6 Adoption
I deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel, and as I was about to debug what went wrong, I just asked myself "Why am I doing this? My ISP has no ipv6, every site I visit has an ipv4 address, why am I keeping all this ipv6 stuff on? I don't need it. It's just useless work". And so I reverted everything to ipv4 and I am happy since. Less work for me.

I see NO reason to deploy ipv6 at the moment. I don't see it for home lans, I don't see it for my workplace, I don't see it for bigger enterprises.

But you can have a gazillion IPs with ipv6!! Yeah, so what?

y0ghur7_xxx··on OWASP Mobile Security Testing Guide
I interacted a bit with the OWASP community a few years ago, and it seemed to me the O on OWASP is not really there. It feels like the community is made of a few guys, the typical stereotype pentester: a bit arrogant, and difficult to communicate with when you have different views.

Sorry for the negative post, but there are no comments on this story and I felt like I needed to say this.

y0ghur7_xxx··on The GDPR blog post
> A company who it didn't affect much, spent 100s of our hours? I think it would reasonable to call that onerous.

100 hours is 12.5 days. That is not much to protect your users data.

y0ghur7_xxx··on The GDPR blog post
> You can pay with your data if you consent to it.

No I can not. I can pay with money. User data is not money.

y0ghur7_xxx··on The GDPR blog post
> Why is it a problem that you have to agree to be monetized to read a stupid blog post?

Do you want my opinion or what the gdpr says?

My opinion is that my data is not a commodity exchange. We (I) usually use money for that.

The gdpr says

"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

So they can politely ask me for my data to read the blog post, and I can politely refuse to give it to them. And if my data is not necessary for letting me read the blog post (it is not) then they have to let me read it anyway.

> If you don't like those terms, go read something else.

That is what I did. I left the site. But this is not what I am angry about. They are lying by saying that i MUST consent to their terms.

> If you refuse their terms, it seems obvious to me that they should be able to refuse to serve you. Maybe I'm missing something here, but this sounds like asking for a free lunch.

User data is not money. User data is user data. I am not asking for free lunch.

y0ghur7_xxx··on The GDPR blog post
> They can't, but they can, for example, ask for a fee to read the article. They don't deny you reading it, but they don't have to give it to you for free either.

Of course they can charge a fee. They should.

> Either you share your data, so they can make money to operate the site, or you don't, but then the content is not free.

No. My data is not a commodity exchange. The GDPR makes that VERY clear. I can not pay with my data. Full stop. There is money for that.

y0ghur7_xxx··on The GDPR blog post
"To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy, including cookie policy."

No Medium, I must NOT agree to your privacy policy and your cookie policy, because to use and share my data you need my FREE consent. AND you can NOT deny me reading an article without giving consent, because then the consent is not FREE, and it is NOT strictly necessary for the service.

Medium: either you allow me to read blog posts on your webserver without FORCING me to allow you to collect my data, or you don't. Choose. But stop fucking annoying me with lying banners.

y0ghur7_xxx··on Ask HN: My eyesight is not good enough to read HN. What can I do?
Why don't you just zoom in? This seems so obvious to me that I am sure I am missing something.

I set the hn zoom level to 120%, and firefox remembers my zoom setting for the site so I don't have to set it every time.

y0ghur7_xxx··on Gitlit: handle Git lfs file locks with ease
I was looking for a desktop app that could show and handle git lfs file locks in a graphical gui for me and my coworkers, but found nothing.

So I made one. Maybe someone else finds this useful.

y0ghur7_xxx··on Unique IPv6 prefix per host [pdf]
because if you want slaac to work without nat, the smalles ipv6 subnet you can have is a /64. so if your provider gives you just a single static /64, all you can allocate is a single subnet.
y0ghur7_xxx··on Ask HN: What has been your most rewarding job or project and why?
I made a frontend for nntp. Even if usenet is long dead.

I was following a group (it.comp.console) at the time using thunderbird but I didn't like google groups so I wrote my own nntp web frontent to follow the group on my smartphone. I contacted some usenet server admins and asked them if I could peer with them (one here on hn), so I set up an nntp server (inn2) and wrote a node/express/js app to read and post to the group.

I make zero money from it, but people liked it and started using it, and now i have about 100 users on the website. I made it mainly for myself as a hobby, but I like that some people like what I made.

https://fcku.it/comp.misc

y0ghur7_xxx··on PowerBuilder History, Powersoft History (2004)
We still have some legacy PowerBuilder apps running today, and I am responsible for one. I still have to change some things in the app from time to time.

PowerBuilder is (was) an extremely powerful rad tool. The datawindow still has no rivals for crud operations on data and for reports.

The web has taken over, but the productivity this tool gives you is nowhere to be found in the modern dev stacks.

y0ghur7_xxx··on Casino high-roller database stolen through a thermometer in the lobby fish tank
> But don't go too far and substitute authentication for network isolation. Vulnerabilities are a thing.

I don't know if I still agree with this. One of my most important and private services is exposed on the web - the most untrusted network on the planet - and it's using application layer authentication, and no network isolation.

I don't need a vpn to get access to my gmail, my web banking or my nextcloud instance. I can access all those services over the most untrusted network of the world with a username and a password (and maybe a second factor auth token).

I think network layer isolation is overvalued. In the end, you still have to secure all your local lan resources anyway, because trusting your lan clients is never a good idea. So if your lan is untrusted like the wan network, and you secure all your stuff in your lan like you would secure them if they where exposed on the internet, there is no need for network level isolation at this point. Sure, it's an other layer of security and all that, but that comes with a high cost, that not always is worth paying for.

y0ghur7_xxx··on Ask HN: Alternatives to Reddit?
usenet
y0ghur7_xxx··on Web Authentication: Proposed API for accessing Public Key Credentials
It was discontinued and died.
y0ghur7_xxx··on Friendica – A Decentralized Social Network
> How would I get to know the new email address of my friend who we only talked using Gmail for example?

Call him up on the phone or message him on whatsapp or... whatever...

email IS decentralised. Even if we had ONLY gmail, a startup could implement a better email frontend and be successful.

y0ghur7_xxx··on Oblivious DNS: Plugging the Internet’s Biggest Privacy Hole
That could be a next step.

Having only the nameservers responsible for that zone see the query would already be a huge improvement to what we have now. And with tech that is already available and standardized.

y0ghur7_xxx··on Oblivious DNS: Plugging the Internet’s Biggest Privacy Hole
If the root servers and major .tlds would support dns-over-tls every home router could just run a full recursive dns resolver by itself, and we could be done with it. There would be no need for complicated architectures with proxies and stub resolvers, and nobody could see your queries. The root server would just see your NS lookup for .com, the .com would just see your NS query for google.com and the google.com NS would see your query for maps.google.com - but here you are in googles domain anyway, so it does not matter.

dns-over-tls would prevent your isp from snooping your queries to the .com/.org/.net/.club/... nameservers and we could close the case.

y0ghur7_xxx··on 1.1.1.1: Fast, privacy-first consumer DNS service
> Both DNS-over-TLS and DNS-over-HTTPS are open standards. And, at launch, we've ensured 1.1.1.1 supports both

I like this. Do the root servers support this too?

y0ghur7_xxx··on Thunderbird 52.7.0 released
Thunderbird is still the best crossplatform, multi account mail client around. Everybody migrated to webmail, but for those old grumps of us who still have multiple email accounts, and maybe even follow some newsgroups, tb is still the best player in town.

Thanks tb team for your work! I love you all!

y0ghur7_xxx··on 'Christianity as default is gone': the rise of a non-Christian Europe
The report the data is taken from: https://www.stmarys.ac.uk/research/centres/benedict-xvi/docs...
y0ghur7_xxx··on The Nightmare Letter: A Subject Access Request Under GDPR
Thank you.
y0ghur7_xxx··on The Nightmare Letter: A Subject Access Request Under GDPR
I don't know. It redirects me to https://www.linkedin.com/authwall?trk=bf&trkInfo=AQH_V0VMQls...
y0ghur7_xxx··on The Nightmare Letter: A Subject Access Request Under GDPR
Sorry, this is off topic, but I would really like to read the article but it asks me to create a linkedIn account to read it and I am not comfortable with that. Is that the only way to read it?
y0ghur7_xxx··on Firefox 59 released
I agree, this was bothering me too. But they implemented it all or nothing. If I disable it in preferences it is completely disabled, no way to activate it for a single site.

They should have disabled the popup, but still allow me to activate it on a per site basis by clicking on the ⓘ in the url bar. Same for location, webcam and mic. I don't want sites to nag me with the location sharing notification, but on google maps I would like to enable it manually by pressing the ⓘ and granting permission.

← PreviousPage 3 of 17Next →