HNHacker News
TopNewBestAskShowJobs

yosamino

1,462 karma · joined January 20, 2017

submissionscomments
yosamino··on Open Source PC That Fits in Your Pocket
No. It's not a fantasy. The Nokia N900 was amazing.

It functioned as a phone with a touchscreen to deliver the experience that had now become the dominant one.

But also, by sliding up the screen, it had a fully featured keyboard, and essentially transmogrified into a "pc that fits into your pocket".

So you could with a one handed push go from the touchscreen-only experience back to edit documents by using a combination of the keyboard and the touchscreen (with a stylus if neccessary).

I stopped using it because it lost software support and then the touchscreen stopped working, but I have it sitting here at my desk.

Every phone I have used since has been worse.

yosamino··on Lessons from a Professional Password Cracker
> Of course, someone might be able to clone your head shape.

This is from 2005:

> Police in Malaysia are hunting for members of a violent gang who chopped off a car owner's finger to get round the vehicle's hi-tech security system.

http://news.bbc.co.uk/2/hi/asia-pacific/4396831.stm

I guess this is a question of threat model. I hope nobody would want to chop of my head just to unlock my iphone. But this always reminds me of the scene in "Demolition Man" where Wesley Snipes spoons out someone's eyeball to open the biometrically locked door of his prison.

yosamino··on Blocking Kiwifarms
I will be a "crybully":

- Cloudflare provides a service

- some "unsavory" people buy this service

- Cloudflare decides that they do not want to provide this service anymore so they terminate it.

The specifics of how exactly they terminated this service are really unsubstantial to the question of censorship. You might be right for kiwifarm to have a case here,

They did not terminate them for "being" a particular way, they terminated them for "doing" a particular thing. In other words, they were not judged for the color if their skin, but for the content of their character.

If anything, cloudflare should do this more often - they protect way too many people and gargabe contentewho do not and which does not deserve this kind of protection.

If people want to be an asshole on the internet - or in real life - that is their perogative, but they cannot reasonable expect to have the enthusiatic support of society in doing so.

The way you are wrong comes up here:

  "Surely, we will see many more websites go down"
These sites all chose to use cloudflare - not the other way around. cloudflare has zero control over these sites. If cloudflare stops to provide them with their service, they can just move somewhere else. cloudflare is not the internet, they just take themselves way to seriously. What they have built is not unique, it is just very large. They are not preventing kiwifarm from expressing themselves in any way shape or form. If kiwifarm wants DDOS protection, they can find a different DDOS protection service, and if they find out they are so despised that noone will take them, then they can make their own DDOS protection service. They aren't owed a platform for their shitty views. Just like I am not owed one for my arguably much less shitty views.

I would go as far as saying that beyond the allocation of IP address space and to a certain extent domain names - nobody is owed anything to participate on the internet. These are the building blocks. Go build things with them,

And if you have built them and someone ask you to share these things you have built, but then decides to use them to do shitty things, just tell them

"Hey this doesn't work for me, if you wanna say these things, please do so from your own space."

That is not censorship.

yosamino··on Things people blamed on bicycles
That's an angle I hadn't considered, thank you for bringing it up.

I bike around the city quite a lot, and usually I will have bike parking available, but when I don't, I find the nearest signpost or street lamp and lock it there. I try to be mindful of pedestrians by orienting the bike parallel to the walkway, but I have'nt probably given that enough thought.

Would you mind explaining the physics of how you interact with these or my misparked bicycles, and how they are causing you to hurt yourself ? Is it just that they are parked in your way, or is there something that makes bikes different from other obstacles you have to navigate ?

yosamino··on Ask HN: How did you increase your UX skills?
That sounds very interesting - do you have some tips about how you learned this skill and how to do these interviews ?
yosamino··on How fast are Linux pipes anyway?
> AFAIK, Firefox is not Chrome-based anywhere.

Not technically "Chrome-based", but Firefox draws graphics using Chrome's Skia graphics engine.

Firefox is not completely independent from Chrome.

yosamino··on Modern TUI calendar and task manager with customizable interface
I feel you, but to me it was worth the effort and now I have a setup that works.

I run a calendar server[0] that is my main calendar repository. And I use vdirsyncer[1] to sync to my laptop to use khal[3]. On the Android side I sync with davx5[4].

This allows me to subscribe to webcal calendars, which outlook365 offers, and syncs them to my two main devices.

Not perfect because that means I can't edit my outlook calendar from within this system ( and a reminder why open standards and interoperability are important ), but it means that my private calendars and addressbooks are self hosted.

You are right though, that takes effort. And I want to snark at microsoft for not supporting caldav, but then I am waiting for gnome-calendar to support it as well. It doesn't seme to and that feels a bit strange to me.

[0] https://radicale.org/ [1] https://github.com/pimutils/vdirsyncer [2] https://github.com/pimutils/khal [3] https://github.com/pimutils/khal [4] https://www.davx5.com/

yosamino··on Home Made TPM2.0 Module
> Case in point: TPM is not required to implement UEFI Secure Boot. You can test yourself in a QEMU VM, if you don’t believe me.

I believe you, but doesn't that mean that there is nothing particular secure about this operation ?

But thank you for the correction, I was under the impression that secure boot neccessarily needs a TPM to store it's keys.

yosamino··on Home Made TPM2.0 Module
It's a "Trusted Platform Module". The high level summary is that it's a chip that sits inside your computer that is designed to only allow only signed code to run.

The computer's manufacturer loads it with a special certificate, so when the computer tries to boot, the bootloader has to include a signature signed with that initial certificate. This bootloader can in turn contain the next certificate to verify the operating system is signed correctly, the operating system in turn contains certificates that verify that user applications are signed correctly.

In theory this is a sound idea, in practice things and implementations are a lot more messy.

yosamino··on How to get kids to do chores: Does the Maya method work? (2018)
> That suppressed smile worries me.

https://www.gocomics.com/calvinandhobbes/1995/05/06/

yosamino··on If you’re not using SSH certificates you’re doing SSH wrong (2019)
One example also mentioned in the article:

If you connect to a ssh-server for the first time, ssh will give you a warning and let you know that you have to verify the fingerprint of the host key.

This becomes annoying when you connect to many different servers and I would not trust everyone (including me) to do this check correctly every single time.

SSH certificates solve this by having the ssh-host-key be signed in a way that your ssh-client can verify and you only have to add a key-signing-key to you known_hosts once.

Now you have to sign the ssh-host-key but you only have to do it once per server as opposed to having each user having to do it locally on every first connect.

yosamino··on Tell HN: Did you know you can negotiate price on many things?
> whose circumstances and needs you know nothing about.

I think the circumstances "tourist haggling with vendor" and needs "tourist wants to experice other culture" where very well established. Whether or not I know anything about this, is an assumption that you are making without knowing anything about me.

Of course how and why and where money is spent is stock-full of morality and ethics. That's not an idea that I privately came up with myself.

yosamino··on Tell HN: Did you know you can negotiate price on many things?
> they will dramatically increase the starting price if you're a Westerner.

The point is that due to the large different in wealth, the increase is "dramatic" for them, but probably neglible for you.

Why not make someone's life a tiny bit better by not pressuring some some small time vendor in a country with less than a third of the GDP per capita than yours into giving up their share of the wealth that tourism is supposed to bring. Otherwise: what is the point of tourism for a host country?

Imagine making 80k/year, paying $100/night for the hotel you are now stepping out of and then haggling with someone who maybe makes 10k/year over the price of a $30 hat that you would pay $59.99 for if you were to buy it in the US and that takes $5 to produce.

I personally don't just find it rude, I find it entitled.

Negotiating prices within "those cultures" make sense when the playing field is somewhat level. Don't exoticize and take advantage of it.

> You absolutely should haggle if for no other reason than to experience their culture a bit deeper.

That is just offensive. Go to a nice restaurant, enjoy their food, see a museum, enjoy the sights. Haggling is not at the core of anyone's culture.

Imagine a Thai person going to Olive Garden for the immersively american experience of tipping their waiters - and even that makes the tinies bit of sense, because at least in that transaction money flows in the right direction.

yosamino··on Deliberately optimizing for harm
Have you considered, though, that we (as in you and I) might be some of these bullies in the world and that these rough men aren't just standing by, but are actively doing violence on our behalf ? One needn't look much further past recent events to find examples aplenty.

I understand the point you are trying to make, but it's not as easy as pretending that the weapons "we" develop are purely for morally and ethically righteous purpose.

yosamino··on Tell HN: All .fj domains have gone offline
I vividly remember .de being offline causing trouble for a couple of hours in 2010.

https://www.theregister.com/2010/05/12/germany_top_level_dom...

yosamino··on Privacy in email communication: we should use encryption by default
There is a very good point about the difficult-to-impossibility of securing email.

BUT:

> Ordinary people don’t exchange email messages that any powerful adversary would bother to read,

This just one hundred percent incorrect and it completely misstates the problem.

The problem is not that Alice and Bob are the focus of intensely focused surveillance, in the sense that they are up against a powerful adversary themselves.

The problem is that Alice and Bob live in a society where those who can and want to make such decisions, are implementing drag-net surveillance at every possible corner of society that they can get away with.

There is a powerful adversary and it would very much like to to read any and all of our communication.

In almost all cases this is consequence-free for Alice and Bob - but this is not Freedom.

My communication is mine it's not there for google so scan for ways to sell me useless shit, and it's not there for Big Brother for training their precog-ML models on it.

The threat model is not "The CIA wants to rubberhose me into revealing information" it's "The NSA routinely opens all of my letters, just to make sure I am not a terrorist/commie/vagrant/etc".

yosamino··on F-Droid – alternative to Google Play store
I am now super curious how you are using Vimium on a handheld device, do you mind sharing ?
yosamino··on NewPipe: A lightweight YouTube experience for Android
The creator does not get money from you watching these ads, they get money from you buying the products or services advertized - if you're not going to buy any of these things anyhow then why subject yourself to it ? Skipping an ad for a VPN provider if your are not going to buy VPN services literally has zero effect.

This even holds for ads where views are counted - if I'm not going to buy the wares you are screaming at me about and I chose to not watch this ad, thereby reducing the view count, what I have actually done is make the advertizement more targeted.

I should be thanked and compensated for my free non-labour that I have given to the advertizement industry instead of vilified. Isn't this what they all want? Targeted ads ?

I am not going to buy any of these godawful services and products in the first place, so why bother bothering me.

yosamino··on Ask HN: What's your solution for SSL on internal servers?
I have a private CA for all internal hosts. It's a bit of a pain to run, but it's neccessary because "internal" includes VMs that run colocated servers and many services to mutual authentication.

It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites.

The alternative would be to depend on LE where neccessary, but this introduces an external dependency that I would rather avoid.

yosamino··on My cheapskate commenting system
Gmail configured it for you. This is implemented as an API[0] that can be called from a site's javascript code, like this:

  navigator.registerProtocolHandler("mailto", "https://webmail.example.com/handler=%s")



  [0] https://developer.mozilla.org/en-US/docs/Web/API/Navigator/registerProtocolHandler
yosamino··on Spam blacklisting is out of control
> CEPROTECT3 just lumps ISPs into the list even though an address has never sent spam.

But this is by design[0]

> This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email.

And it makes for a perfectly usable blocklist. If you use postfix, the postscreen_dnsbl_threshold and postscreen_dnsbl_sites parameters let you create a simple scoring system:

  postscreen_dnsbl_threshold      = 10
  postscreen_dnsbl_sites          =
    zen.spamhaus.org*5,
    bl.spameatingmonkey.net*5,
    dnsbl.sorbs.net*4,
    bl.spamcop.net*4,
    dnsbl-3.uceprotect.net*3
I made up the numbers, because you will need to monitor your system for a while to see if they make sense, but the principle holds. Also make sure that the dnsbl you are using are working for you.

But it isn't really a problem with uceprotect, it's about how DNSBLs are used.

[0] https://www.uceprotect.net/en/index.php?m=3&s=5 [1] http://www.postfix.org/postconf.5.html#postscreen_dnsbl_site...

yosamino··on Spam blacklisting is out of control
This is a complaint about "UCEPROTECT Blacklist Policy LEVEL 3" [0]

It's description is not subtle:

> This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email.

So if the mailsystem you are trying to reach employs it, is either experiencing spam levels that justify it's use - OR they made a mistake in using it, if this is the sole reason you are being banned.

The first order of business is of course to complain to your hosting provider. Nobody wants spammers on their networks - but if they do: then this is kind of exactly the reason for this list. The policy describes in detail what made it possible for this netblock to end up on the list, that should be enough for them to take action either pre-emptively or by notifying their offending customer, and if neccessary kicking them off the network.

The next thing you can do, instead of paying for whitelisting, ist to contact the mailserver-admin at system you are trying to deliver mail to. This can be a bit of a hassle - seeing that your mailserver just got blocked - but it usually works. The same way systems don't want to receive SPAM they also don't want to overblock, after all they want their users to receive emails as well. If you are the mail admin of a sending system and you're reaching out to the receiving system this is usually a pretty good indicator that you don't want to spam them.

I have had success doing this even at some larger ISPs, where you would expect this to be more difficult.

I very much enjoy these blocklists - simple, transparent. Loads better than the kafkaesk black holes that are the major mail providers who barely care, and who do not give you easy recourse if you are mistakenly blocked.

[0] https://www.uceprotect.net/en/index.php?m=3&s=5

yosamino··on Datawrapper: Create charts, maps, and tables
This complaint is a bit strange given that they have an entire free tier for you to use and that their custom package includes them doing actual design work for you, not just more and better hosting options.

Every service can be replicated by just doing it yourself - the proposition here is that it might be - or might not, depending on your needs - more cost-effective than hiring a designer yourself do apply your branding to your data visualizations.

yosamino··on mmWave radar, you won't see it coming
There is nothing odd about it, and it has nothing to do with being "important enough to be tracked".

It has become almost impossible to participate in society, without every aspect of your life being recorded in some way.

My Bank sells my transaction data to third parties to track my credit history and sell advertizing - they do this without my consent, or rather if I disagree, they will not have me as a customer. I could switch banks but it's basically the same everywhere. All I wanted was a place to store and transfer money.

My phone company sells my location and call data the government and to marketing companies - they do this without my consent, or rather if I disagree, they will not have me as a customer. I could switch providers but it's the same everywhere. What I actually wanted was to be able to make phone calls and have data connectivity on the go.

My ISP sells which websites I visit to marketing companies - they do this without my consent, or rather if I disagree, they will not have me as a customer. I could switch ISPs but it's basically the same everywhere. All I wanted was to have data connectivity at my home.

My airline sells my flight data to the government. They do this without my consent. There is no alternative. I just wanted to visit some relatives.

The government tracks all my phone calls. They do this without my consent. There is no alternative. I just wanted to call my friends.

The government tracks where and when and whom I send emails. They do this without my consent. There is no alternative. I just needed to communicate for my business.

When I go out in public, my image is records by a multitude of cameras, by a multitude of actors. They do this without my consent. There is no alternative.

My licenceplates are scanned, depending on my locality, more or less regularily. What I wanted was to make going around a bit easier over longer distances. There is no alternative.

My medical records are ... well there's something called HIPAA, but the reason it has to exist in the first place is that some seedy actors are trying to get their grubby little hands on this most private information of mine. I do not consent to this. I am sick. There is no alternative to medical care.

I go out in public and depending on where I go, cameras are being equipped with all sorts of biometric detection capabilities. All I wanted to go out for a drink, suddenly I am in some database.

I go online to browse the internet. No further explaination needed.

All I wanted was to have wifi connectivity at home. Some asshole has crammed functionality into the standard for wireless connectivity, that makes it possble to track where my body is. There is no alternative.

And so on and so on and so on.

All of these things taken together create an information asymetry. One by one they aren't neccessarily that terrible, but by accumulating all this information - for which there is constant pressure by the more authoritarian elements of our societies - creates a digital me, that absolutely has an effect on my day to day life.

Easiest example is my credit score, I am sure one can think up reasons to justify it's existance. But the point is, that this device exists as an incarnation just for me - without my consent at all. It's not that I need to be very important to have a credit score. I just have one by default.

It does not make me feel "important" to be tracked. It makes me feel oppressed. It's the opposite of important. Being treated like this, decisions being made about me by some usually invisible faces, makes me feel like cattle. I am being treated as a good that can be sold, and from which value can be extracted, in other ways than the exchange for goods and services for money. I am the commodity itself. By default I am presumed guilty, and evidence is being collected against me, even if I will never violate any law of society.

My right to live as a free interdependent member of society are being violated by the people who think they can use me and the data they can glean about me for whatever their purpose is - and they do this without even considering my consent.

Information asymetry enables control. It's the anti-thesis to freedom.

It has nothing to do with feeling "important" and the choice you are implying people have is not a free choice. It's forced.

yosamino··on Adblocking people and non-adblocking people experience a different web
Advertizement uses your brain power to process stimuli for the purpose of trying to sell you things that you do not need.

You did not ask for your brain to be stimulated like this - what you did ask for is the content that comes after ad. That's the thing you consented to.

Ads abuse your desire to watch something that you want to watch, by cramming in something that you did not want, leeching your precious time and brain-processing energy, in order to sell you something that you did not want to have in the first place.

yosamino··on Autonomous battery-powered rail cars
I haven't watched the video, but based off of the title "Pod train" the argument is probably along the lines of this:

There is a futuristic theme in logistics that envisions humans or cargo to be shipped in "pods". This is in contrast to the more efficient way of shipping humans or cargo in larger vehicles like trains or busses.

These pod-ideas inevitable run into some bottle-necks or have to make trade-offs that in the end give them so much lower efficiency than the "traditional" way which is already the (almost) optimal solution to a given problem.

Examples of this are various incarnations of hyperloop, that do not actually solve all real-world problems existing solutions have to deal with, but rather only a subset of them - but they are better at this subset plus they look fancy in their renderings.

This makes it so these impractical solutions get a lot of hype, and money is spent on prototypes, but there is a lot of hot air and little substance.

yosamino··on Mozilla Rally
Dear Mozilla,

We want you to make a browser that is so good, that it can function independenty of Google and Chrome financially and technologically. This is not an end in itself. Google is just not a very trustworthy steward of the marketshare that they have on the browser market.

You are in a unique position to make this possible. Please double down on it instead of throwing away your hundreds of millions of monies that you have on unfocused, irrelevant bullshit that noone will remember in two years.

You made a whole browser engine that actually improved on current engines in Rust and then you basically threw it away. What on earth was that about ?

Mozilla we want you to make Firefox without any tracking, and without and advertizing shit in it , and we want it fast and secure, and we love your extensions. Some of us here are even willing to pay you subscription fees to support the browser! But keep in mind that you have millions of dollars already.

We loved you all the way from when your product was still called phoenix, Mozilla suite even, and everyone was so excited to have this excellent browser. We pooled money to take out full page ads in a paper newspaper for Firefox. Because we believed in your product so much. I still have the page here. Do you remember ?

Please. Stop with this stupid bullshit.

Focus, Mozilla, Focus!

From the depth of our hearts,

PS: and if you find some time, go fix that bug that makes the active tab so difficult to differentiate if lighting conditions or eyesight aren't perfect.

yosamino··on The control group is out of control (2014)
A critique of conspiracy theories is not a denial that conspiracies exist. It just means that the concept of a "conspiracy theory" as basis of trying to understand reality is flawed, because it relies on no or bad evidence, and very often seeks to simplify a very complex reality in a way that doesn't do that reality justice.

But I am not sure if we both mean the same things when we use the word "conspiracy". It's not a secret, for example. that cocolate has a slave labor problem. Planned obsolescence is not a secret (but it's more complex than just someone trying to screw you over). I don't think I understand the conspiracy aspect of the rest of your examples, save for the obvious JFK conspiracy theories.

> about shortcuts to making a lot of money being kept rather well secrets: dark budgets, secret and hidden inflation, supply fudging

I would put to you: If the chances of this blowing up is rather close to zero, how do you know about it ?

yosamino··on The control group is out of control (2014)
This argument has the structure of a conspiracy theory: "A small group of people being able to keep an enormous secret, in order to manipulate the rest of us."

The more enormous the secret and the larger the group of people who supposedly are in on it, the more the probability of the secret not being a secret very long approaches one.

I find it very unlikely that a shortcut to making a lot of money would be secret for very long.

yosamino··on Entropy isn't sufficient to measure password strength
While technically correct, a private key will usually need to be encrypted to provide adequate security.

From the user point of view, they will still need to remember the password to unlock this private key.

← PreviousPage 3 of 11Next →