News for hackers. Stuff that matters.

Ellipsis753

Re:Stop Using JWTs on Wednesday June 17, 2026 @08:36AM (#48569563)
Yes! JWTs in the browser are a total pain. You need a way to revoke them (when a user is fired, etc). Or you need to make them crazy short lived (5 minutes). Users need to stay logged in without the tab open for a lot longer than 5 minutes, so you need a way to make that work. They tend to be really large, which slows down your load times a lot due to TCP slow-start and people just having weak upload speeds. And they can easily get too large to store as a cookie. Also, people forget that anyone can read the data stored in the JWT. They just cause more problems than they solve and there's a lot of edge-cases and footguns.
Re:HTTP Strict Transport Security (HSTS) on Tuesday December 30, 2025 @02:38PM (#46437077)
Old links to your site might still be http - HSTS prevents that request being in the clear. Also, if you have a man-in-the-middle attack, it doesn't matter if you return a redirect or not as the attacker has already replaced your site with a phishing attack instead of a redirect. HSTS prevents this.
It should be able to factor 15.
I was amused but unsurprised to see that this article was deleted when I looked it up...
Re:Unlocking Free WiFi on British Airways on Saturday October 25, 2025 @04:10AM (#45702150)
Looks like you were rate limited at the end. They don't rate-limit britishairways.com which is a SNI that you can always access. Lolz.
Re:Valorant's 128-Tick Servers (2020) on Monday October 06, 2025 @05:35PM (#45496582)
It does sound like each server is its own process. I think you're correct that it would be a little faster if all games shared a single process. That said, then if one crashed it'd bring the rest down.

This is one of those things that might take weeks just to _test_. Personally I suspect the speedup by merging them would be pretty minor, so I think they've made the right choice just keeping them separate.

I've found context switching to be surprisingly cheap when you only have a few hundred threads. But ultimately, no way to know for sure without testing it. A lot of optimization is just vibes and hypothesize.

Re:Redis is fast – I'll cache in Postgres on Friday September 26, 2025 @11:01AM (#45387320)
Great article. Not understanding the hate.

I think the jist of it is, you probably have sufficiently low requests/second (<1000) that using postgres as a cache is totally reasonable - which it is. If your hitting your load tests and hardware spend, no need to optimise more.

Is this saying that intel will support _only_ 512 instructions? (And not 256).

Or that it'll support _both_ 256 and 512 instructions going forwards (and stop doing the nonsense where some cores support 512 and others don't?)

Re:Advent of Code 2024 on Monday December 02, 2024 @05:42AM (#42294871)
This is how most of the top of leaderboard works.
Re:Please do not write below the line on Monday October 21, 2024 @04:30PM (#41908216)
Weirder still, the discounts stack! So blind people can benefit from buying a black-and-white TV for an additional discount.

I've given this a lot of thought in the past. The best I could come up with is that "legally blind" could still allow for someone with _very poor_ (colour) vision...

Re:Beating the CAP theorem checklist (2013) on Saturday July 27, 2024 @06:52AM (#41085702)
Ehhh. Feel like CAP theorem is a bit overrated. It's correct from a theoretical purist point of view, but you can still solve many of these kinds of issues in practice. (Similarly, people overstate the halting problem - which can be solved for computers with finite memory.)
Re:Bollards: Why and What on Monday May 06, 2024 @12:56PM (#40276710)
Let's plug my own "joke" website about my love of Bell Bollards: https://bellbollard.com/

We have bell bollard t-shirts: https://www.zazzle.co.uk/be_more_bollard_t_shirt-23500842774...

And we like to take photos pretending to be bell bollards: https://twitter.com/search?q=%23bellbollard

If anyone else wants to get in on this action, you're more than welcome. :D

Why would this be easier than just making a diamond?
Gutted to hear this.

I used these in London and they were magical and extremely convenient. I would show them to visiting friends as if they were one of London's main tourist attractions!

I knew they relied on some manual labor (bills were delayed), but assumed this was only an intermediate step to collect more real-world training data (until they sorted out the AI).

I still think this is the future though. They could reduce staffing costs and free-up floor space that would otherwise be used for self-checkouts. All the while actually drastically improving the customer experience too.

If someone cracks it, it may make it impossible for other supermarkets to complete economically.

As a fun aside, all the stores were incredibly over-staffed and helpful. If you couldn't install the app they had a browser-based fallback (type "fresh code" into the amazon searchbar on a mobile). They could also lend you a battery bank if you were low on battery. I think they even had phones to lend out to those without smartphones. It was all very optimized around customer experience first and foremost and with no real attempt for the stores to be profitable.

Re:Ask HN: Who wants to be hired? (April 2024) on Wednesday April 03, 2024 @06:21AM (#39915549)
Location: London, UK

Remote: Yes, but hybrid/in-person preferred

Willing to relocate: No

Technologies: Rust, C, C++, Linux, AWS, TypeScript

Résumé/CV: https://istherecake.com/Shanee-Vanstone.pdf

Email: [email protected]

Re:Ask HN: Did you encounter any leap year bugs today? on Friday March 01, 2024 @06:00AM (#39560613)
We had a bug on the 1st of this month. Some billing code liked to invoice on the last day of the month and failed to account for this month having an extra day. Interesting it happened as soon as the "leap month" started. Easily fixed though.
Re:Building a Password Cracker in 2024 on Saturday January 27, 2024 @06:41AM (#39154745)
This is for cracking password _hashes_. Most websites won't store a user's plain-text password but will only store the hash of it. Then a hack/exploit might later reveal the website's password hashes. This program helps you turn the hash back into the original password. Assuming you have a hash already, you own the hash, so it's not possible for anyone to impose a rate limit on how quickly you can attempt to break it.
Re:Where Have All the Websites Gone? on Tuesday January 09, 2024 @11:49AM (#38928340)
My cousin runs a very small home-made html blog. I really like it and it gives me that early 2000s nostalgia. I'm sure he'd be psyched if some people here were to read it.

https://deadvey.com https://deadvey.com/blog/index.html https://deadvey.com/blog/feed.xml

I doubt it. My guess is that you have speakers/headphones connected to your dock and they're picking up some kind of transients when you plug it in. Capacitors charging can also have some sound, but it's usually quite high pitched. If you're docking station has an external power source, you might find that adding/removing/changing it helps. Or connecting speakers/headphones via a usb DAC.
Re:The One Billion Row Challenge on Monday January 08, 2024 @06:34PM (#38920067)
Interestingly, because your program runs on Linux and is run 5 times, Linux will almost certainly cache the 12gb file to RAM on the first invocation.

This means that future invocations don't have to load the file from disk. This also makes it pretty critical that your program doesn't use more than 16gb of ram itself (out of the server's 32gb) or it'll push the file out of cache making future invocations of your program slower.

Yep. I've seen Bluetooth be affected by microwaves. Also seen WiFi be affected by Bluetooth. It doesn't mean your microwave is unsafe.
Re:It’s time to leave the leap second in the past on Monday July 25, 2022 @01:46PM (#32228153)
When the sun is directly overhead it's meant to be 12:00 - IN THEORY! However as Timezones are pretty wide, most of the time you'll be at least 15 minutes out. Sometimes you'll be out by as much as 3 hours - and you've probably never even noticed! Telescopes already have to compensate for this (as well as for summer time). Leap seconds make a shambles of book keeping too. What is "2022-07-17T12:00:00" + (60 x 60 x 24 x 365 x 5) seconds? No one knows! And the answer to that question will change depending on when you calculate it and which updates you installed! So I say ditch the leap second and let it drift. In a few hundred years we could update our timezones if we _really_ want to (timezone changing is actually pretty common, so code should already be handling this edge-case).
Re:Captive Portals on Thursday July 14, 2022 @06:00AM (#32094006)
Let's plug one of my "joke" domains:

http://amibehindacaptiveportal.com

If you get any response other than "No" then you're behind a captive portal.

Re:Loudness War on Monday March 07, 2022 @08:11AM (#30587297)
People can simply set the volume on the player louder if there's more background sounds. The trick to the loudness wars is to sound louder (than other songs) at the _same_ volume. If a bar or radio is in the background at a fixed volume, the loudest songs stand out.
Re:Cave-Link: Underground text communication system on Wednesday November 10, 2021 @07:05AM (#29173753)
This site is a bit scarce on details. There's more details and some photos here: https://de.wikipedia.org/wiki/Cave-Link http://www.hoehlenverein-blaubeuren.de/index.php/cavelink-te... (Use Google Translate)
I think "1 million" means 1e6 everywhere. But the confusion might be because "1 billion" means 1e9 in USA but 1e12 in UK/Ireland. "1 trillion" similarly is 1e12 in USA but 1e18 in UK/Ireland. This is called the short/long scales. It's a headache.
Re:Cookie Consent Speed Running Game on Friday March 19, 2021 @10:22AM (#26513656)
You _can_ deny cookies. It's just that this breaks almost every website. This was true before Chrome existed.
Tangentially related, but does anyone have a trick to Google search for holograms without getting pages of lenticular/pepper's ghost items instead?

I'd like to buy a couple of pre-made holograms just to get a feel for them, but can't find anywhere selling them?

Re:Adobe Photoshop ships on Macs with Apple Silicon on Friday March 12, 2021 @06:24AM (#26434568)
> I would jump on an optimised version of Illustrator with the feature set from 10 (or more) years ago.

Genuine question, can't you just install an old version of Illustrator?

Older »