Hacker News Reader

ytchon GPON FTTH networks (in)security (2016)

The article reminds me this Github project, which using 3rd party SFP ONU connecting internet with SLID, Model, SN and other parameters.

ytchon Xiaomi Home Integration for Home Assistant

Agree, I buy some Dahua POE cameras, It can be configured via browser locally with powerful AI feature, and work without internet access, although some drawbacks:

# Some of them are limited to 25 fps

# The model name are really a mess

# Some models are without hardware reset button, the only way to reset is register device to Dahua's cloud service with China phone number (although it is not enforced)

ytchon Intel and AMD form advisory group to reshape x86 ISA

As the news mentions, I hope it is the time pushing x86s Architecture[1] to real world.

[1] https://www.intel.com/content/www/us/en/developer/articles/t...

ytchon Concord had a dev culture of toxic positivity that halted any negative feedback

It already happened many times:

Fallout 76, No Man's Sky (at least they managed to improved after release).

The Lord of the Rings: Gollum, Redfall, Babylon's Fall (Dead after release?).

And many games just force player to do meaningless things (for example, cast one magic 100 times for an achievement or unlock an unique item). Do they actually think this is funny during QA or design stage?

ytchon iOS 18 breaks IMAPS self-signed certs

ACME DNS-01 Challenge doesn't need a public resolvable and reachable host, it just sets a temporary DNS record to verify.

ytchon Vue 3.5 released

Vue maintainer are using names from manga and anime all the time:

https://en.wikipedia.org/wiki/Vue.js#Versions

ytchon Intel: New Core Ultra Processors Deliver Breakthrough Performance

It seems like they didn't mention about process node.

Maybe all of its tiles are based on TMSC as some news revealed months ago, so they didn't want to discuss about this?

ytchon History of HTTPS Usage

I haven't subscribe such ISP in person, but there are many cases from Internet, it reminds me that never trust any ISP (or Gateway that could inspect data):

https://security.stackexchange.com/questions/70970/my-isp-is...

https://security.stackexchange.com/questions/157828/my-isp-b...

https://github.com/net4people/bbs/issues/19

ytchon History of HTTPS Usage

Other than eavesdrop, the biggest advantage of HTTPS for me is to stop nasty ISP that injecting advertisement or other code in HTTP page.

ytchon Intel confirms no recall for Raptor Lake CPUs,microcode won't fix affected units

and the microcode fix could means another performance impact.

ytchon Technical Details on Today's Outage

IIRC, there were some security software exploits, that trigger RCE (or DoS) of the scanning engine by malicious file?

ytchon Off-path TCP hijacking in NAT-enabled Wi-Fi networks

My bad, I forget about this.

ytchon Off-path TCP hijacking in NAT-enabled Wi-Fi networks

T̶a̶i̶l̶s̶c̶a̶l̶e̶: https://tailscale.com/blog/how-nat-traversal-works

Libp2p: https://docs.libp2p.io/concepts/nat/hole-punching/

B̶o̶t̶h̶ (update: Only Libp2p works with TCP) use similar method for hold-punching. Libp2p can use such method for establishing direct connection between hosts behind different NAT networks.

ytchon How to fix bugs in 24 hours or less

> It's crucial to note the difference between a bug and a feature. Our 24-hour pledge applies to bugs, not features.

It looks likes all of their bugs are labeled with "Cirtical" priority. It sounds really weird.

ytchon Apple Joins the SeL4 Foundation

A little bit unrelated, but reading through their member list:

https://sel4.systems/Foundation/Membership/

reminds me that Jobs explains why their company called "Apple Computer" is: "I worked at Atari, and it got us ahead of Atari in the phone book."[1].

Apple is the first one of all sel4 general member too.

[1] https://www.businessinsider.com/apple-archive-name-apple-201...

ytchon Ask HN: How to handle user file uploads?

https://github.com/google/magika

    Magika is a novel AI powered file type detection tool that relies on the recent advance of deep learning to provide accurate detection.

It's not a sliver bullet, but I use it recently for inspecting file type instead of magic file.

One advantage is that detecting composed files. Take pdf+exe file for example, the library will report something like 70% pdf and 30% pebin file.

ytchon Beware of fake beaches (Pokémon Go)

For Pokemon go, it could be once per year:

Aug 2023: https://old.reddit.com/r/TheSilphRoad/comments/1646shv/open_...

Oct 2022: https://pokemongolive.com/en/post/mapupdates-2022/

Pikmin bloom updated once at Feb 2024 after launch at Oct 2021:

https://twitter.com/NianticHelp/status/1760694331466224078

ytchon TSMC Gets $11.6B in US Grants, Loans for Three Chip Fabs

The Information Technology Agreement of WTO[1] eliminates taxes and tariffs for IT products, I'm not sure if chips belongs to this agreements?

[1] https://www.wto.org/english/tratop_e/dtt_e/dtt-ita_e.htm

ytchon Network Tunneling with QEMU

I've use this method recently. Our VM service is based on libvirt, which doesn't support QEMU socket type interface natively, so I need to add the following to the XML:

  <qemu:commandline>
    <qemu:arg value='-netdev'/>
    <qemu:arg value='socket,id=mynet0,listen=10.6.0.1:12200'/>
    <qemu:arg value='-device'/>
    <qemu:arg value='virtio-net-pci,netdev=mynet0,id=net1,mac=58:a4:c0:a8:bf:51,bus=pci.0,addr=0x3'/>
  </qemu:commandline>

On the other endpoint, a Linux TAP tunnel daemon is responsible for encapsulating packet to the Length-Value data as the article said.

In this way, I can create a L2 tunnel from remote site to the VM, also keep the VM untainted.

ytchon Sergey Brin says in rare appearance that company 'messed up' Gemini image launch

So will they bring back "Don't be evil"?

ytchon How to copy a file between devices? (2022)

I like it too. Croc is easy to install/use in almost all network environments.

ytchon Tell HN: Russia has started blocking OpenVPN/WireGuard connections

China uses statistics, entropy of packets and other DPI-like methods[1],

also HN discussions of it[2]:

[1] https://gfw.report/publications/usenixsecurity23/en/

[2] https://news.ycombinator.com/item?id=36531485

ytchon TSMC 2nm Update: Two Fabs in Construction, One Awaiting Government Approval

https://focustaiwan.tw/business/202311100005

> At this rate Taiwan will be all TSMC fabs.

It's almost in every big cites, but there are still some regions in Taiwan that don't welcome TSMC to set up factories.

ytchon Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

It's a TLS termination proxy that decrypt and re-encrypt your TLS packet. Technically Cloudflare can read anything unless you add your own crypt layer on top of TLS.

ytchon Your last name contains invalid characters (2010)

Thanks for your explanation. It reminds that the "onamae" name for Japanese people could contain hiragana or katakana. I almost forget it.

ytchon Your last name contains invalid characters (2010)

https://news.ycombinator.com/item?id=37332126

> Ask HN: How to handle Asian-style “Family name first” when designing interfaces?

the discuss shows it's so hard to handle name of people from any countries.

ytchon Your last name contains invalid characters (2010)

> Do they actually block hiragana and katakana? If they do that's probably grounds to sue.

many websites in Japan has two name field: one is kanji, another is katakana.

https://shinkabukiza.pia.jp/membmng/RegisterNormalAction.do

Take this for example, the field in first row is full-width kanji, second one is full-width katakana.

ytchon Push notifications – What to push, what not to push, and how often

It is worse on web push notification. I don't know why anyone expecting clients are happy to watch random ADs popup on their computer.

ytchon Push notifications – What to push, what not to push, and how often

https://support.apple.com/en-ke/108302

iOS has a "Time Sensitive notifications" type that will popup immediately, even when user assign the app to summary view. But the type is assigned by sender alone. It is still possible to spam it.

ytchon IDEs we had 30 years ago

In the early 2000s, back in my homeland, high schools were still stuck using Turbo C for programming classes. This was mainly because there weren't many free and lightweight C IDE options available for Windows (I know Turbo C is not a free software technically).

While Dev-C emerged as a possible alternative for console programs and programming contests, it wasn't enough for developing native Windows GUI applications without shelling out for Visual Studio.

This limitation ultimately led me and some friends to explore development on alternative platforms like OS X and Linux. Ironically, even to this day, none of us mastered the WIN32 API.