News for hackers. Stuff that matters.

GormanFletcher

Re:The Drunken Bishop Algorithm on Friday August 06, 2021 @07:04PM (#28093786)
I think that would work well. A high-quality hash is designed such that changing a single input bit will flip approximately half of the output bits. So hashing both values will make it very easy for a human to spot whether the input values were different.
> Just curious, but in your opinion, how does the composition API improve on React hooks?

I'm a fan of how Vue's composition API executes exactly once during a component lifetime (during `setup()`), whereas React hooks get set up again on every render. I find it I find Vue's approach easier to mentally model, and thus easier to write correct code (especially when doing something complicated where state changes / effect executions trigger each other). Since `setup()` is only run once, I can also do things like store non-reactive state in closure variables without wrapping those variables in hooks.

Re:Faster CRDTs: An Adventure in Optimization on Saturday July 31, 2021 @09:46PM (#28023067)
> There's another approach to making CRDTs fast, which I haven't mentioned here at all and that is pruning.

Pruning is a key thing I appreciate about Yjs, because it's not just a performance optimization - it's a privacy feature. Users often expect that if they delete something from a document, it's gone unless they have explicitly turned on document revisioning. A CRDT without pruning leaves every accidental paste or poorly phrased remark in the permanent record.

Some lefties learn to write by either hooking their hand above or angling it below below the line being written, sometimes complemented by slanting the page toward or away from their writing arm.
Re:AWS Cost Saving Recommendations on Tuesday July 13, 2021 @08:17PM (#27827851)
Wasabi has an important 'gotcha': they charge you for a minimum of 90 days of retention, even if you delete an object seconds after creating it.

https://wasabi.com/paygo-pricing-faq/#minimum-storage-durati...

That detail isn't mentioned anywhere on their pricing page or cost comparison calculator: https://wasabi.com/cloud-storage-pricing/

I don't find that pricing objectionable on its own, but I'm wary of shopping with a vendor that advertises price as their main selling point, but buries such a potentially costly pricing detail.

I'm in Raleigh/Durham, North Carolina, USA.
Before everything shut down last year, my local theaters played a showing of a classic film each month, often Hitchcock. The few I went to had plenty of attendees.

Another local theater took the lockdown as an opportunity to do outdoor socially-distanced showings of previous blockbusters, like The Dark Knight. Plenty of attendees there, too.

I'd be happy to have more showings like that.

Re:Show HN: Connect your bank account to Google Sheets on Thursday July 08, 2021 @06:22PM (#27778337)
Another option in this space is Tiller (https://www.tillerhq.com/). They seem well-established, and offer some spreadsheet templates for plug-and-play solutions to some common budgeting scenarios.

If you don't care about spreadsheets specifically -- if you're just looking for scriptable access to your financials -- Lunch Money (https://lunchmoney.app) has a public API. They'll also be opening the beta of rollover budgeting any day now, which has me excited!

Re:Suppose I wanted to kill a lot of pilots on Saturday July 03, 2021 @10:14AM (#27721749)
I interpreted it as brainstorming ways to actively sabotage success. "Solutions" that appears superficially plausible, but undermine the outcome in real world situations.

So for the dust filter, maybe selecting a material that's only rated for high temperatures in short bursts. Or one that needs frequent, labor-intensive replacements in that dangerous environment. Or test that your filter survives at high temperatures, and test the filtration efficacy, but forget to test the efficacy at high temperatures.

The GP's example doesn't involve invalid datetimes. The datetimes aren't out of bounds or invalid in any way that a check constraint would detect. They've just become factually incorrect ("bad data"), because they are derived data that wasn't updated when the derivation rules changed (i.e., regulatory changes).

If you're storing future datetimes that semantically represent wall clock time, you need to store the locale time plus the full time zone (such as America/New_York) so that your program does the right thing in response to any common regulatory changes that happen after you store the value. Storing the time zone abbreviation (e.g., EST) is inadvisable, as computers sometimes care whether you asked for EST vs EDT. Storing the time offset (e.g., -500) is incorrect, as it has the same pitfalls as storing UTC - you're precomputing the locale's expected time offset at storage time, and your data won't automatically be corrected if time regulations change.

If you're storing historical timestamps, UTC is fine because you can safely convert it to whatever time zone you want to display, knowing that changes to time zone / DST regulations tend not to affect the past.

There is a material difference to users between a single attacker having (and possibly ignoring) a data dump, and that attacker publishing that dump publically, or selling it to someone who plans to exploit its contents.

The attacker has offered to not publish if they are paid. Their word probably isn't worth much, but $1,000 seems like an affordable sum for a business to gamble on them being honest about it. And if Newsblur doesn't fix their security problems they'll be targeted again either way.

As someone who has a decade of data in Newsblur, if there's any chance that an affordable ransom will keep my data from spreading further I want Samuel to take it.

Re:A New Future for Icanhazip on Sunday June 06, 2021 @07:23PM (#27417308)
Having lived through the debut of Firesheep, which prompted the industry to get serious about using TLS, its an amusing triumph of cybersecurity that today a site has to be careful to not accidentally get issued a certificate. Back in 2010, when certificates cost substantial sums and needed some expertise to apply for and install, I wouldn't have guessed we'd ever get to this point.
Re:Ask HN: Favorite purchases of last two years? on Thursday May 20, 2021 @08:51PM (#27229313)
My Aftershokz are good for spoken word in noisy/trafficy environments unless I'm inside a car at freeway speeds, or operating a lawn mower. They could work in a car if they got a little louder.

Just be aware that they make it practical to tell that something is happening around you, but with spoken word you'll usually have to pause to tell what is happening around you. I.e., I can't understand what someone is saying to me if a narrator is already speaking into my ear.

The external auth service's API would receive textual input (expecting a string read from a textbox), not binary. A hash that included null bytes would output those in hex as ASCII zeroes, which wouldn't cause the same problem when the external service received the value.
Re:Persuading the Body to Regenerate Its Limbs on Thursday May 06, 2021 @12:43PM (#27065909)
There was an excellent breakdown about the challenges with growing teeth recently on HN:

https://news.ycombinator.com/item?id=26854080

I'm curious why you feel that way?

The DevOps mantra is that you shouldn't be trying to manage deployments at all, except in aggregate. They should be seamless enough to become non-events that happen frequently and with maximal automation. Time spent doing deploys becomes irrelevant since it's a hands-off, low-risk process.

The DevOps philosophy advocates that the process of developing code and infra to that point produces many benefits to the business: first-order benefits to code and infra quality since you're demanding more from them, and second-order benefits to the business that come from releasing many times per day and going from ticket to prod quickly.

Under this philosophy, 125k annual deployments predicts the engineering department likely is exemplary rather than disastrous, since only an exemplary engineering department should be able to pull this off without frequent/severe mistakes damaging the business.

Re:OnePlus Watch: The Worst Smartwatch I've Ever Used on Monday April 19, 2021 @11:44AM (#26864055)
Pebble 2 is still the #4 most funded Kickstarter ever, with Pebble 1 taking first place.

Every smartwatch I've tried in the years since the buy-out just reminds me how much I miss my Pebbles.

A surprising number of limited-access networks only do port blocking, not protocol sniffing. This means many will cheerfully let you connect to an SSH server over port 443 (useful for a SOCKS proxy).
Re:SQLite the only database you will ever need in most cases on Thursday April 15, 2021 @09:09PM (#26828164)
Using SQLite databases as an application file format is encouraged by the SQLite team:

https://sqlite.org/appfileformat.html

Re:Yahoo Answers to shut down May 4, 2021 on Monday April 05, 2021 @06:11PM (#26705311)
For read-heavy content sites like Yahoo Answers, I wonder why they get shut down instead of getting compiled into pregenerated static HTML and hosted as read-only.
The current state of webapps on Android has made good progress on these issues:

Supported on all major Android browsers:

- Progressive Web Apps can be added to your home screen - Web Push lets web apps receive push notifications (Brave's implementation is broken, but they try to support the feature)

Experimental APIs supported by Chrome for Android:

- Web Share Target API, which lets homescreen'd web apps receive shares from other apps (the share pane makes no distinction between sharing to a web app or a native app) - Contacts APIs to read the user's contacts list

I think PWA's competitiveness will get a lot better once other browsers adopt the Web Share Target (or something like it), but I'm skeptical that they'll really take off as long as Apple continues hold off on implementing features that would make PWAs competitive with native apps.

Re:The Two Classes of Software Engineer on Friday March 05, 2021 @11:25AM (#26358634)
During college I got to see both sides of this play out.

I started out majoring in Computer Engineering, an embedded systems oriented curriculum. They started us with assembler, then C, and worked our way up. I switched over to Computer Science, which came from the other direction: Java, then C, then assembler.

I learned in myself and saw in my peers that both ways can work great, just for different people.

I struggled to understand how to apply C's pointers and memory management in homework without the context of how that fit into solving a problem in a program, because we hadn't yet written code that really did anything, just one-off tiny functions that demonstrated a mechanic without any purpose. Class tests felt like writing an essay about the applicability of the 4x2 Lego brick without having ever assembled a Lego set. I needed top-down learning to grasp the "why" before I could tackle the "how".

Some peers expressed the same difficulty as me, but others commented that they found their Computer Science courses challenging until they dug deep enough to understand the underpinnings of the computer. They struggled with their Java courses, but got much more confident once they progressed to C and then assembler, because all the unexplained high-level incantations suddenly started making sense.

Over my career, and in my hobbies, which of these approaches I need has come to vary depending on the task. When I'm learning a new way to do an old thing, I jump straight for the bottom-up information. If I'm learning something totally new, I still need to go top-down.

Re:Square acquires majority of Tidal in $297M deal on Thursday March 04, 2021 @02:05PM (#26346669)
As much as dislike Spotify's UI, I listen to a mountain of fringe content that no other streaming service carries but Spotify has in spades, because all of the indies make sure to upload to Spotify.

I'm sorely tempted to build my own library/playlist management front-end on top of Spotify's API. They're the only streaming service I've found with an official streaming/remote control API, and with upcoming lossless support (albeit only CD-quality), their library with a tailor-made UI seems like the best trade-off I'm going to get in a music service.

Re:Square acquires majority of Tidal in $297M deal on Thursday March 04, 2021 @09:54AM (#26343156)
It's certainly striking, but the world is full of surprises like that. Goldman Sachs' CEO is an EDM DJ with 550,000 monthly Spotify listeners. He performs at nighclubs and music festivals, gets plays on Sirius XM, and his tracks chart on Billboard.

https://en.wikipedia.org/wiki/David_M._Solomon