News for hackers. Stuff that matters.

mileswu

Re:DMARC Secured Email Identities but Broke Mailing Lists on Wednesday January 18, 2017 @09:20AM (#13426421)
Forwarding email with outlook.com/Office365/Microsoft Exchange also breaks DMARC. Exchange Server sometimes modifies the headers of emails when forwarding them, invalidating the DKIM signature, so then a DMARC policy rejects the forwarded email. Apparently Microsoft have a fix in the pipeline for this, but it's been taking ages.

More info at: https://blogs.msdn.microsoft.com/tzink/2016/05/19/why-does-m...

Re:Neocities is implementing IPFS – distributed, permanent web on Wednesday September 09, 2015 @10:41AM (#10191715)
CERN still uses AFS extensively for all users' files. I believe they use a forked version of OpenAFS. My experience with it at CERN has been okay. It's been fine to use locally, but transatlantic over the Internet can be very slow (it does work eventually though).

I'm not sure if there are any alternatives that work any better over long distance. I suppose CERN also has CVMFS [1], which is a read-only caching filesystem that retrieves the files from upstream via HTTP. This works much better, but it is read-only so only satisfies certain use cases.

[1] http://cernvm.cern.ch/portal/filesystem

Re:BB84 – A quantum key distribution scheme on Saturday April 18, 2015 @01:54PM (#9400353)
Quantum Key distribution is different from classical ones in that it allows Alice and Bob to detect Eve. This is because a measurement in Quantum mechanics disturbs the state. In particular for BB84, a measurement by Eve in the wrong basis destroys the correlation of Alice and Bob in the correct basis.

Unlike classical key distribution, these guarantees derive from fundamental physics laws as opposed to, say, RSA that can be broken given enough computing power/time, and so are unbreakable.

Unfortunately there can be flaws in actual implementations of the BB84 scheme, such as side-channel attacks. E91 [1] (a newer scheme) addresses these flaws and prevents these attacks.

[1] http://journals.aps.org/prl/abstract/10.1103/PhysRevLett.67....

Re:Show HN: dokibox – an open source music player for OS X on Monday February 16, 2015 @01:26PM (#9058300)
Author here. Been working on this on and off for about 3 years now as a side project and it's my first 'large-ish' OSX app. Would love comments or suggestions! Thanks.
Re:The Worst Amazon Horror Story I Have Ever Heard on Wednesday September 03, 2014 @09:41PM (#8266377)
Previous HN discussion (~10 months ago): https://news.ycombinator.com/item?id=6751710
Just an off-the-top-of-my-head idea: Could you give people a bookmarklet or an extension that they can run when they are on their order history page that exports all the Amazon product IDs?
Re:Packed Pixels – An extra monitor for your laptop on Sunday July 20, 2014 @10:30AM (#8060374)
This is very similar to another product that you can buy today https://www.adafruit.com/products/1652. It's basically an iPad 3/4 retina display that connects via DisplayPort. The main differences seem to be that the Kickstarter one will run off USB power (instead of 9V) and attaches to your laptop screen.

I've been tempted to try it, but can't really think why I'd need it.

Re:Introducing a simpler, faster GitHub for Mac on Thursday July 10, 2014 @06:38PM (#8017797)
I used to use it just for the ability to individually stage chunks/lines, because I find "git add -p" incredibly hard to use. Now I tend to use GitX-dev for OSX [1] to do that instead, because I find it more powerful than Github for Mac. There's also a ncurses-based interface for git called tig [2] which can also do the chunk staging, but I only use it when I don't have a GUI.

[1] http://rowanj.github.io/gitx/ [2] http://jonas.nitro.dk/tig/

Re:The homogenization of scientific computing (2013) on Sunday May 11, 2014 @02:28PM (#7729414)
For high-energy experimental physics (HEP or particle physics), most tend to use a CERN developed C++ framework called ROOT[1]. It's not overly pleasant, but it gets the job done.

There are Python bindings to ROOT (pyROOT) but I've found Python in my experience to be a bit too slow when handling the large (10TB+) datasets.

As an aside, it's interesting how ROOT attempts to provide C++ with some basic reflection[2] and saving of C++ objects to dis. Unfortunately it doesn't necessarily do a very good job of it, but perhaps things will change with ROOT6 as it transitions to being based on clang, as opposed to in-house C interpreter.

[1] http://root.cern.ch/ [2] http://root.cern.ch/drupal/content/reflex

Re:We scraped the World Bank's website on Saturday May 10, 2014 @02:47PM (#7726477)
An interesting and somewhat related (but only tangentially) article I read a couple of days ago found that nearly 1/3rd of World Bank reports are never read, not even by a single person: http://www.washingtonpost.com/blogs/wonkblog/wp/2014/05/08/t...

It was submitted to HN (https://news.ycombinator.com/item?id=7715881) by another user, but probably never got traction because the title of the article is very vague.

Re:Git add -p on Monday January 20, 2014 @09:14AM (#7089561)
There's also a ncurses-based interface for git called tig[1]. I find it a bit easier to stage chunks/lines than git add -p as it's interactive. When I'm not on a command line, gitx-dev for OSX [2] also makes it very easy too.

[1] http://jonas.nitro.dk/tig/ [2] http://rowanj.github.io/gitx/

At least on the experimental LHC side, we process/analyse each event independently from every other event, so it's an embarrassingly parallel workload. All we do is split our input dataset up into N files, run N jobs, combine the N outputs.

Because we have so much data (of the order of 25+ PB of raw data per year; it actually balloons to much more than this due to copies in many slightly different formats) and so many users (several thousand physicists on LHC experiments) that's why we have hundreds of GRID sites across the world. The scheduler sends your jobs to sites where the data is located. The output can then be transferred back via various academic/research internet networks.

HEP also tends to invent many of its own 'large-scale computing' solutions. For example most sites tend to use Condor[1] as the batch system, dcache[2] as the distributed storage system, XRootD[3] as the file access protocol, GridFTP[4] as the file transfer protocol. I know there are some sites that use Lustre but it's pretty uncommon.

[1] http://research.cs.wisc.edu/htcondor/ [2] http://www.dcache.org/ [3] http://xrootd.slac.stanford.edu/ [4] http://www.globus.org/toolkit/docs/latest-stable/gridftp/

Re:Panasonic Toughbook Tablet on Saturday November 09, 2013 @11:20PM (#6705177)
If they can make a 20" 4K display and put it in a tablet, then why can't they just mount it in a desktop display and I'd be interested in buying it (though whether I have the money is a completely different question). I'm sure it would be easier to manufacture if they didn't care about weight/power consumption and there might be a bigger market.
Re:Generating a private key I can trust on Saturday September 14, 2013 @10:22AM (#6385613)
> First of all I do not trust any hardware. It’s impossible to verify that the hardware doesn’t have a backdoor and randomness looks random even if tampered with.

Well if you can't trust any hardware, how can the author trust any off-the-shelf computer and CPU to generate the private key even if he is using Linux+GPG? For all he could know the CPU could contain a backdoor that performs the necessary arithmetic and operations incorrectly (in the process making the key weaker).

He is also trusting his CPU to do the session encryption correctly (even with his external smartcard). Perhaps the CPU could leak information about the session key to another processes, allowing people to decrypt your communications?

Now I trust my CPU and hardware, especially because we have little alternatives. Perhaps it would be better to use an external smartcard to generate the private key too, because the physical hardware is orders of magnitude less complicated than a CPU/computer, so you could verify the hardware contains no backdoors by examining the physical circuits using a microscope (I presume this would still be very hard to do but millions of times simpler than that for a modern CPU).

Re:EFF's HTTPS Everywhere removed from Chrome app store on Saturday August 17, 2013 @08:51AM (#6228959)
It was asking me which SSL client cert I wanted to present to identify to beta.bbc.co.uk. In my case I have my StartCom one and a OSG science one.
There are many rendering filters and pipelines available for DirectShow (and therefore MPC-HC) that VLC does not have. For example MadVR[1] improves upscaling and display rendering quality dramatically and xy-VSFilter can render subtitles many times faster than libass which is used in VLC.

These are just two examples that I came up with off the top of my head, but there are countless more. The advantage of VLC is that it's simple and just works out of the box for 95% of stuff, but MPC/Directshow gives you far more flexibility as you can construct a very custom filter chain (eg. using different decoders and renderers).

[1] http://forum.doom9.org/showthread.php?t=146228 [2] https://code.google.com/p/xy-vsfilter/

Re:Desert Bus: The Worst Video Game on Wednesday July 10, 2013 @10:08PM (#6024092)
How about Big Rigs: Over the Road Racing?

- Description talks about outrunning cops to deliver illegal goods, but there are no cops in the game

- AI opponents never move

- No collision detection

- Infinite speed in reverse gear

- Sometimes says you've won before you even left the start line

- The fifth (out of 5) map doesn't load and crashes the game

- A patch to fix the fifth map just turns it into the first map but mirrored (so I guess they couldn't work out how to fix it)

Weirdly somehow I think tens of thousands of copies of this were sold. I pity the people who wasted money on this.

I get my SSL certificates from Namecheap[1]. Here the cheapest ones are $9/yr (they are the same certificates as the OP's cheapest ones) and they're I suppose a well-known domain registrar.

[1] https://www.namecheap.com/ssl-certificates/comodo.aspx

Re:How To Split A Pizza on Saturday April 27, 2013 @10:01PM (#5619865)
There is also the Pizza Theorem[1] which says that even if you don't cut the pizza through the middle but so long as the slices are of equal angles, you can divide it equally by area by choosing alternating slices.

[1] https://en.wikipedia.org/wiki/Pizza_theorem

> In my case the hacker asked to all my contacts with an automatic message for some Liberty Reserve money. Most of them trust me and my account, so they were inclined to accept.

I'm not sure why anyone would give money to a friend via Liberty Reserve, just because a friend requests some via an instant message. The average person has probably never heard of Liberty Reserve either. Before sending any money of any kind, wouldn't one ask the friend what's wrong whereupon it would become obvious it's not them?

Maybe I'm just deeply skeptical and distrusting and the rest of the world is more optimistic.

Re:University of Reddit on Wednesday March 13, 2013 @11:50AM (#5369219)
Have you obtained a license to use the reddit name/brand along with the mascot/logo?

"For all of the above reasons, we require a license if you want to use the reddit brand in anything you do, both for free and for profit."[1]

[1] http://www.reddit.com/wiki/licensing

Re:Have Scientists Found Two Different Higgs Bosons? on Friday December 14, 2012 @04:32PM (#4923477)
This is how I lean too. A few percent in a mass measurement is a pretty small systematic error and could easily come from something that has been overlooked or miscalibrated. There are a tens and hundreds of calibration and corrections that go into these detectors and analyses and it's all too easy to miss something.

What really makes me convinced it is an experimental error is that CMS does not see the same mass discrepancy. If both independent experiments saw the same discrepancy then this would truly be really interesting new physics.

Disclaimer: I am on ATLAS myself, though not associated with the Higgs groups. I can only comment on public results due to much information being confidential.

Re:Why the Amazon App Store sucks and you should stick with Apple on Wednesday December 05, 2012 @10:38PM (#4880156)
He could always sell his software via his own store, as Kindles are not restricted to Amazon App Store sold software (which is one difference between the Kindle/Android ecosystem and an iOS one).
Re:New 25 GPU Monster Devours Passwords In Seconds on Wednesday December 05, 2012 @02:44AM (#4875371)
It encrypts all your passwords using AES with a 128 bit key derived from your master password (PBKDF2) [1].

This is very different to what the article is talking about, since it encrypts your passwords, but the article talks about hashing which is one-way.

[1] http://help.agilebits.com/1Password3/agile_keychain_design.h...

Re:New 25 GPU Monster Devours Passwords In Seconds on Wednesday December 05, 2012 @02:42AM (#4875367)
“I was extremely disappointed that setting up a clustered VMware instance wouldn’t allow me to create a VM that spanned all the hosts in the cluster. E.g. if i had five VMware ESX hosts with 8 processor cores, I wanted to be able to create a single vm with 40 cores and use all nodes in the cluster,” he wrote.

Not sure why he would have thought this would be possible. This would be an extremely hard problem given the latency involved between different nodes.

Then he came across VCL, or Virtual Open Cluster... “It did just what I wanted, not with an entire OS per se, but with an entire OpenCL application. and that’s good enough for me.”

A similar (but far older) system is MPI[1], which enables parallel computation across many compute nodes for your code by providing message passing. It's kind of a pain to use in my limited experience since you have to adapt your code (it seems like VCL is transparent for OpenCL programs), but it does work. No need for OpenCL, tho of course you could always use OpenCL + MPI. A common thing I see is MPI+OpenMP (for parallel cpu computation).

[1] https://en.wikipedia.org/wiki/Message_Passing_Interface

Older »