News for hackers. Stuff that matters.

exrook

This is not quite an accurate telling of rockstar's reaction, there were actually receptive to it and paid out $10k for the discovery. Though it's an understandable mistake given rockstar's hostile history with the gta modding scene.

See the original post and discussion for the whole story:

https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... https://news.ycombinator.com/item?id=26296339

Re:Why Japan has such good railways on Saturday April 18, 2026 @11:20AM (#47816595)
It's a bit ridiculous to imply Tokuyama gets better shinkansen service than Hamamatsu, because it has Nozomi service.

Looking at the schedule towards Tokyo for Monday, April 27th: Tokuyama has: 4 16 car Nozomi trains to Tokyo 19 8 car Kodoma/Sakura trains to Shin-Osaka 9 8 car Kodoma/Sakura to Okayama

Hamamatsu has: 31 16 car Kodoma to Tokyo 19 16 car Hikari to Tokyo

Keep in mind the fastest Kodoma seems to only take around 1 hr 40 mins to Tokyo, and the fastest Hikaru is only 1 hr 20 mins.

I'm sure it's nice getting a 1 seat ride to Tokyo from Tokuyama if you can get on one of the 4 Nozomis, and unfortunate you can't get a one seat ride past Shin-Osaka from Hanamatsu, but the service levels seem pretty proportionate to me.

For those interested, the key takeaway from this IMO is that by issuing many sequential reads, the memory controller will hold a target row open for an extended amount of time to service the consecutive accesses.

This is in contrast to the original rowhammer attack, which issues accesses such that target rows are repeatedly opened and closed to trigger bitflips in neighboring rows.

By stretching out the row open time to 30ms (!), the authors claim they are able to reliably trigger bitflips with a single row opening in 13% of tested rows at 50 C[1]. Some rows in certain chips can be flipped with access times of under 10ms[2].

At more realistic row open times of 7.8 - 70us, there seems to be a 1/x relationship between row open time and number of activations required, they cumulative amount of time the row needs to be held open for to trigger a flip seems to remain fairly constant (around 50ms total from my very approximate estimations). Note that the attack needs to be executed in under 64 ms total, otherwise the automatic DRAM refresh will reset any progress made.

The authors demonstrate this attack with a userspace program that maps a 1 GB hugepage to be able to directly manipulate the lower 30 physical address bits[3], although they don't seem to provide the row open times they end up being able to achieve in practice.

The attack code itself: https://github.com/CMU-SAFARI/RowPress/blob/main/demonstrati...

https://arxiv.org/pdf/2306.17061.pdf [1] pg 5. obsv. 2 [2] pg 6. obsv. 6 [3] pg 11. sec 6.1

Re:Firefox may soon reject Cookie prompts automatically on Tuesday April 18, 2023 @06:31PM (#35621339)
Try adding the EasyList Cookie List[0] to your adblocker to block them all.

It's present in the uBlock Origin filter list settings under Annoyances but not enabled by default. HN readers may also find some of the other default disabled filter lists interesting such as the AdGuard URL Tracking Protection list which strips tracking parameters from URLs.

[0] https://easylist.to/#easylist-cookie-list

Re:Overwatch 2 will require a phone number to play on Friday September 30, 2022 @02:59PM (#33039163)
I'm not sure where your getting this from, a phone number is _optional_ for CSGO, adding one is said to improve your "trust factor"[0], theoretically improving your matchmaking experience.

I don't believe TF2 has any sort of phone number system that I'm aware of. If there is one, it doesn't seem to function very well given the bot invasion over the last few years.

I can't speak to dota 2 as I've never played it.

[0] https://help.steampowered.com/en/faqs/view/00EF-D679-C76A-C1...

I'm confused, have you found the try operator ("?") insufficient for your use cases? I believe it does what you are describing, ex:

    fn process_file(p: Path) -> Result<String, io::Error> {
        let file = File::open(p)?; //Return err if file can't be opened
        let mut out = String::new();
        file.read_to_string(&mut out)?; // Return err if read fails
        out
    }
If you want to handle the error case within the same function `try` blocks are available in nightly[0] and will eventually come to stable[1]

[0] https://doc.rust-lang.org/nightly/unstable-book/language-fea...

[1] https://github.com/rust-lang/rust/issues/31436

Re:Nevada bill would allow tech companies to create governments on Saturday February 06, 2021 @01:08PM (#26048464)
Re:Ask HN: Favorite Music to Program To? on Monday January 11, 2021 @06:41PM (#25739850)
Liquid drum and bass mixes

https://youtu.be/YIWFNVb7whk

Re:Metal Monolith in Utah Gone on Sunday November 29, 2020 @02:32AM (#25243576)
> I bought the camera used recently and didn’t update the exif date in the camera. I uploaded it on Wikipedia and I’m cool with it without copyright. The image is for the people. Patrickamackie2 (talk) 05:39, 28 November 2020 (UTC)patrickamackie

https://en.wikipedia.org/w/index.php?title=Talk:Utah_monolit...?

Re:Sentimental Versioning on Monday October 12, 2020 @08:30AM (#24753727)
Could you expand on this a bit more? That's certainly the impression I have of semver.
I'd highly encourage anyone interested in this case to hear the oral arguments for themselves, you can listen to them here: https://www.c-span.org/video/?469263-1/google-v-oracle-ameri...

While I believe that it would be better for society if the court sides with Google, I personally think that APIs can be a creative work, and thus would have copyright protection under the law. However one of Google's arguments is that Oracle is trying to use copyright to acquire a patent-like right, referencing the case of Baker v. Selden[0]. Despite being from 1879(!) I found this case to be especially relevant and I'm quite interested to see how the court will consider it into their opinion.

In his arguments, Oracle's lawyer argues that declaring code is not distinguishable from implementing code and thus deserves all the same copyright protections. As a programmer I find this argument quite unconvincing, as there is clearly a technical distinction in many systems, see: .h files, dynamic linking, etc.

[0] https://en.wikipedia.org/wiki/Baker_v._Selden

Re:Linux kernel in-tree Rust support on Saturday July 11, 2020 @11:17AM (#23802771)
> That precludes GC

This isn't the case, there are tracing garbage collectors implemented as libraries [1][2], and there is consideration being made for supporting tracing GC in the language and stdlib [0]. As well as reference counted GC having been available in stdlib for a long time [3] (similar to C++'s std::shared_ptr)

[0] https://github.com/rust-lang/rfcs/blob/master/text/1398-kind...

[1] https://manishearth.github.io/blog/2016/08/18/gc-support-in-...

[2] https://boats.gitlab.io/blog/post/shifgrethor-i/

[3] https://doc.rust-lang.org/std/rc/index.html

Re:Port knocking on Friday May 15, 2020 @06:21AM (#23190598)
Nope, no support needed. SSLH will proxy SSL traffic to whatever other SSL service you have running (nginx, openvpn, etc.), and send the SSH traffic to openssh. It look like it even supports recognizing plain HTTP traffic as well and proxying it accordingly.
Why not instead modify the test so that it more accurately measures the capabilities of interest instead?

Such as in your elevator example, make it so that the operation of the elevator is tested with a heavy load approaching the desired safety factor, and evaluating the performance under this heavier than normal load? The idea being that the only way to "cheat" is to design a better elevator that can still meet the requirements.

Of course the reason this isn't done is because of the extra cost of performing a more comprehensive test, but given how much students are paying for education, surely we could make some improvements over the status quo.

I can't help but draw comparisons to SpaceX's starship development process vs that of the more traditional aerospace manufacturers. There isn't any way for the engineers to cheat because their work is tested under the target conditions and either passes[0] or fails[1][2]. The goal being to achieve the most efficient design that still meets requirements.

[0] https://twitter.com/elonmusk/status/1259344535991140352

[1] https://www.youtube.com/watch?v=QlDBjHa0NkU

[2] https://www.youtube.com/watch?v=wFXQ5SRCy74

Re:Safeboot: Booting Linux Safely on Tuesday May 12, 2020 @11:37AM (#23155124)
Well there is POWER[0], not that it's a very affordable choice, the cheapest motherboard + cpu costing $1,732.07

[0]https://www.raptorcs.com/content/BK1B01/intro.html

Re:Humans Not Invited on Tuesday May 05, 2020 @03:13PM (#23083669)
My first thought was that maybe this was some sort of anti-captcha where the images were adversarial examples that a neural network would classify as a shopfront?

However from the comments here it seems to be less involved than that to get past the challenge, does anyone else know what the actual test is?

Re:OFFSystem on Friday May 01, 2020 @04:03PM (#23045970)
I don't think we are in any disagreement that whoever is uploading the data "owns" the data. The interesting idea is that the entity storing the bytes has 0 information about the data they represent, in the information theoretic sense, since they can decrypt the data to any value by choosing a sufficient key. This is not true for most other encryption schemes where the encrypted data has enough structure to it that theoretically it could be retrieved without the key, although the whole point of the encryption is that this isn't a practical undertaking.
Re:OFFSystem on Friday May 01, 2020 @11:05AM (#23042663)
I think the distinction this protocol makes is that by using XOR as the "encryption" method, given any input block you can choose a "key" to decrypt with to produce any other output block. A block in isolation provides zero information to the downloader. I think it could be argued that it is the knowledge of which blocks to combine is where the actual data is being stored, and maybe that's where the copyright owners could stake a claim.
Re:TRRespass: Rowhammer against DDR4 on Wednesday March 11, 2020 @07:15PM (#22551828)
Check out Permutation City by Greg Egan for some inspiration ;)
This is why many new reactor designs do not use water as coolant but instead molten salt[0] or inert gas[1], to avoid the risk of steam explosion. This alone does not make those reactors inherently safe but it can help keep radioactive material from being violently spread outside the reactor in the event of catastrophic failure.

[0] https://en.wikipedia.org/wiki/Molten_salt_reactor

[1] https://en.wikipedia.org/wiki/Gas-cooled_reactor

Re:Two new ways to read a file quickly on Saturday March 07, 2020 @01:31AM (#22510163)
I don't know if this is what you were thinking of, but capnproto[0] does exactly that with a promise like interface.

Actually this may be the paper you were referencing, from the bottom of the capnproto page:

> Cap’n Proto’s RPC protocol is based heavily on CapTP[1], the distributed capability protocol used by the E programming language[2]. Lots of useful material for understanding capabilities can be found at those links.

[0] https://capnproto.org/rpc.html

[1] http://www.erights.org/elib/distrib/captp/index.html

[2] http://www.erights.org/index.html

Re:Anxiety as an algorithm on Wednesday March 04, 2020 @05:33PM (#22488890)
Personally, I like that as a human, I have the capacity to use tools as an extension of my being to improve myself and my place in the world. I don't think applying the same tools I use to solve problems in the physical world to solve problems in my mind makes me any less human. Sure, those tools may not be a perfect match for the problem domain and provide the wrong answers sometimes, but it doesn't hurt to try applying them. I don't think this makes me a cyborg any more than lighting a fire or driving a car does.
Just to add to this, the satellites can still cause problems during the night after sunset, as they can occlude other objects being observed as they pass overhead.
Re:Synchronous Messaging at Mozilla: The Decision on Friday December 20, 2019 @09:17AM (#21844250)
Cargo workspaces are more of an optimization in that they let all the crates in your project share the same output directory[0], so built dependencies can be shared among every crate, as opposed to each crate needing to (re)build all of its dependencies independently.

This helps to reduce compile times when working on projects where you frequently switch between crates.

[0] https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html

More information from Jim Bridenstine's (NASA Administrator) twitter[1]:

Update: #Starliner had a Mission Elapsed Time (MET) anomaly causing the spacecraft to believe that it was in an orbital insertion burn, when it was not. More information at 9am ET:

Because #Starliner believed it was in an orbital insertion burn (or that the burn was complete), the dead bands were reduced and the spacecraft burned more fuel than anticipated to maintain precise control. This precluded @Space_Station rendezvous.

We are getting good burns and are elevating the orbit of the spacecraft.

There will be a press conference on NASA TV[0] at 9:30am ET (29 minutes from now)

Also some speculation from Scott Manley[2][3] that the spacecraft may have fired it's engines 90 degrees from prograde during orbital insertion, based on mission control displays seen during the launch livestream

[0] https://www.nasa.gov/live/ [1] https://twitter.com/JimBridenstine/status/120802259102746215... [2] https://twitter.com/DJSnM [3] https://twitter.com/DJSnM/status/1208006636746330120

Older »