News for hackers. Stuff that matters.

smush

> Folks should not underestimate the benefits of having a single primary common language everywhere.

Indeed, that's why I'm getting past my static HTML comfort zone and trying out the SAFE template for F# development on both client and server via .NET Core. Super new at it, but excited to learn.

Apparently there is this thing out there called Fable that lets you use the same domain types on both client and server, now THAT sounds like fun to me.

Re:How I built the best-selling BlackBerry app on Monday March 09, 2020 @09:59AM (#22525376)
Some do.

Portrait style ones are the BB Key2 or Unihertz Titan

Landscape keyboard is the Fxtec Pro1

Re:The case for limiting your browser extensions on Wednesday March 04, 2020 @04:03PM (#22488075)
This article could also be titled 'The Case for Limiting cautious about software you execute' and with a few tweaks in text could support the below sentence.

"If you go to a bad website, it might cause bad things" is ~=~ "If you use a bad extension, it might cause bad things"

I think that the advice to be wary of extensions adding permissions is quite astute and a good reminder to each of us to make sure we are using well-vetted (to our own satisfaction) software, in-browser and out.

But I'd posit on the whole that browser extensions do much more good than harm. uBlock Origin has stopped many a grandma from clicking a false download button-in-banner-ad.

Add to that the heavyweight tools of NoScript, uMatrix, Privacy Possum/Badger, absolute enable right click, SingleFile, Decentraleyes, and more that I've yet to learn about, and they greatly outweigh the drawbacks of the likes of extensions mentioned in the article and 'web of trust' etc. that have gone to pot.

I react so strongly to this not because I disagree with vetting software, but because I don't want browsers having yet another excuse to yank control and features away from me as a user. I'm already nervous that Mozilla will coyly refuse to support all extensions in their new browser, replace Fennec with a worse system and I will be stuck with it.

Chrome on Android supports no extensions, and is tightening the screws on extensions in desktop, so this is not a slippery slope I'd like to get on.

Re:WireGuard Gives Linux a Faster, More Secure VPN on Tuesday March 03, 2020 @08:57AM (#22474432)
I have, but I've not been able to VNC over them. I've made sure the FW rules let tailscale do anything and have even tried turning both firewalls off entirely but at least for TightVNC it doesn't like it, nor RDP (RDP enabled in System settings).

But this does give me hope that it can be done in the first place, I just have some setting goofed up somewhere. I will restart my tailscale stuff now that I know someone out there has done it.

Thanks!

Re:WireGuard Gives Linux a Faster, More Secure VPN on Tuesday March 03, 2020 @08:56AM (#22474424)
OK it defaulted to UDP, got nothing, changed to TCP, got nothing. Will change it back and try again.

I will also double check the port number.

Re:The Real Challenge Is Teaching AI to Play D&D on Monday March 02, 2020 @03:26PM (#22468539)
> If D&D is sufficiently complicated rules wise that it is actually more fun to have software take care of that so you can just focus on the tactical combat and scripted story choices, then the video game is probably your best bet!

No kidding. I've been writing a WinForms program that is basically a combination character progression tracking, inventory management and basic battle system for Star Wars Fantasy Flight Games.

Why? Do we not want the person-to-person experience? Hardly! We need more wetware space for strategy and thinking of creative ideas, so we need to free up the parts for calculating what number of ability vs proficiency dice and what talents may mess with the roll etc.

Re:WireGuard Gives Linux a Faster, More Secure VPN on Monday March 02, 2020 @01:38PM (#22467315)
TL;DR: Should I keep fussing with PiVPN or try something like TincVPN?

Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W.

But - my network lack of knowledge is probably hamstringing me. I opened the WG port on my router and confirmed the dns hostname I'm using corresponds to the public IP, but I'm not able to get the wireguard clients to connect. The tcpdump doesn't show any incoming traffic on the port at all.

Should I keep fussing with PiVPN or try something like TincVPN or Tailscale? I have not been able to get a VNC or RDP session going over tailscale even though all my machines are able to connect to the Tailscale network.

I want to use wireguard, everyone says it is so good, and OpenVPN does seem a bit boring, but ultimately I'm just hitting a wall when it comes to the use case of 'auth, you are on your home lan, connect as if you are at home connected to wifi'

All true points, but I'd rather risk being tracked by a company that would be completely cratered even more than they've already been by being bought by Privacy One than just go straight to the devil himself, so I use the !s and just mentally treat it as if its a slightly better form of !g rather than before where startpage was all the benefits of Google search without most of the drawbacks.
Is it OS and SDK bloat? Where do you think most of the cruft is coming from?

Let's say I had a given LOB application written in vb6, c#.net winforms, heck, maybe even WPF. All single-threaded.

If I re-wrote the same application (features, UI, still single-threaded) in native Win32, would that improve the latency?

Maybe - but why not indicate clear password length requirements on the password entry screen and/or have the PWE text input HTML form only accept password characters up to that max length?

Additionally, silent trucation and 'maybe we do salt and hash after all' makes no sense IMO. That's not to say that I disagree that this is a possibility, only that the whole point of a hash is that it converts something of arbitrary length to a single length.

Therefore, truncating data that gets inputted into the hash would be computationally wasteful for no benefit, because the hash function will always result in a single length.

TransUnion does plaintext passwords.

Found that out when I typed in a (example) 25 character password, but at some point the field was truncated down and I somehow figured out that if I backspace IIRC 4 characters away, my saved password worked.

-_-

No kidding. Already, I've found some interesting articles to read.

I'm taking a look at https://dwheeler.com/essays/easy-cross-platform-gui.html, which has references to XULRunner etc. which since 2009 have fallen out of favor.

Would you continue to recommend those wanting to invest in (for the 80% of use cases) wxWidgets for FLOSS cross-platform GUI apps? BoaConstructor et. al look interesting.

Thanks for taking the time to look at this comment. If it helps give you some context, I'll throw in that I currently am most familiar with WinForms .NET apps or very small Win32 native applications, and have avoided JS successfully so far.

Re:Nintendo Play Station Super NES CD-ROM Prototype on Thursday February 13, 2020 @10:17AM (#22318326)
Semi OT -> Sometimes I'm baffled at how people don't know about rare things like this, but I wonder how long that can last.

Do you think the 'boxed up in a random lot, IDK what it is, some computer thing' behavior we've seen up to now with many rare electronics, games, computers, etc. will go away over time as more people grow up with internet access and web search?

Let's take something that is equally 'dead' in terms of not being made any more: the Samsung Taylor, a dev windows phone. A few devs got some, but otherwise it is gone to the wind. Just to look at it, it looks like a slate smartphone, pretty innocuous. But if you were to search its model number, you'd immediately know you had something rare and valuable to a certain niche (which I admit to being in).

OWS is working on foundations to allow people to use usernames and link them with FCM / push notifications without the central signal server being any wiser than currently with just phone numbers.

My hope is to be able to add ephemeral user ids so to my work folks I'm JustMe but family folks I'm FamilyMe and internet blog readers I'm MyProfessionalMe

Re:Critical Bluetooth vulnerability in Android on Friday February 07, 2020 @02:53PM (#22270145)
$300 but that got me a Samsung Galaxy Note 9. Headphone jack and all.
Re:Ask HN: What Skills to Acquire in 2020? on Tuesday February 04, 2020 @02:16PM (#22239745)
WRR has kept me through thick and thin.

My bookmark straight to the music streamer page is below uBlock a few of the banner ads and you are set.

http://player.listenlive.co/44461

Re:The text adventure game of exiting a Telnet session on Friday January 31, 2020 @01:17PM (#22203958)
Reminds me of being a first time user trying to get out of VIM while following a tutorial. How frustrating it was then!

If you have flailed around and messed with a file because when you type, it ignores your input until you use the 'i' character, suddenly you need to stop, close and reopen the file (because you don't know to hold the u key to undo). So, you do what works on DOS or nano, and hit Ctrl + C.

Someone coded it such that if you hit Ctrl + C to exit, instead of exiting out of VIM immediately, the editor writes a message that says "to exit vim, you must type :quit".

So you type that, and VIM responds with 'you have unsaved changes, please add ! to overwrite', so you type ! and it does nothing. After several seconds of confusion, you google how to get out of vim and the internet reveals the magic keystrokes ":q!" to finally get out of this dad blame file and get back to what you were doing.

All of that (probably, in my cynical mind) to avoid following the principle of least surprise and have Ctrl + C = close, discard changes.

Re:Why Kids Love Garbage Trucks on Tuesday December 10, 2019 @09:47AM (#21752911)
In your opinion, is that viewpoint shared by a plurality or majority of what we can loosely define as the feminist crowd and adherents?

Admittedly, I don't have a big world-shattering new point to add or logical argument to segue to based on the results of the question, I'm just curious.

Re:Why Kids Love Garbage Trucks on Tuesday December 10, 2019 @09:26AM (#21752686)
Wow, parent comment and this one summing up what often turn into X000 comment flame wars that dang has to bag up and send out to the flag truck, now that is a feat of summarization.

> Overwhelmingly the feminist position that's pushed to the fore is "any lack of equal representation of females in a roles that're desirable is down to patriarchal actions and unrelated to any natural differences between the sexes; which differences are an illusion".

How do we as a society address this point? Whether one argues that the above statement has merit (me) or not, many people on both sides (and probably me in many cases) have such emotional investment in their points that attempting to soberly look at where society is and where society should be on the spectrum between 'the above statement is categorically true globally in 100% of cases' and 'the above statement is categorically false globally in 100% of cases' can feel to me like trying to do laproscopic open-heart brain surgery.

I agree with you 100% and will amplify your comment with one of my own.

I suspect this won't be immediately possible as I'm not certain what languages OP is allowed to use, but if OP has some wiggle room in what PL to use, then I would recommend that he look at the Domain Modelling Made Functional book by Scott W.

Like you say, the principles in the book apply to other languages as well, but it can be a faster feedback cycle to learn these lessons in a language that has first-class support for them. He will be able to use F# or its close syntax cousins OCaml, ML to model new features as domains and employ option types, pattern matching, railway-oriented-programming, and functions as interfaces to make his code more resilient, like you mention.

The bonus is that if OP uses the likes of F# or Scala, it can interop with C# or Java respectively within the same codebase.

Re:No to Chrome on Friday December 06, 2019 @11:28AM (#21723274)
I have also hopped to Qwant / DDG for their proxied Bing search.

Keeping that in mind, doing a !s bang is probably better privacy-wise (bonus - you get the same results) vs a !g bang, even if it is no longer as good as it was.

> especially the affordance for a physical keyboard,

I'm considering an Fxtec Pro1 or Blackberry Key2 exactly because they have hardware keyboards.

I still don't have muscle memory with on-screen keyboards, or if I do, it doesn't work properly due to the lack of physical cues.

> we need to crack down on tax evasion

Corporations, small businesses, private citizens all benefit from state funded systems. That's part of the point of having a state in the first place.

It could be seen as hyperbolic to conflate paying the minimum legal amounts with tax evasion. Corporations pay payroll taxes, VAT in relevant countries, capital gains, etc. as required by law.

Whether our laws have large wiggle-room is another matter, but they are not evading taxes. People go to jail for tax evasion.

I own zero Apple products so am not the customer for this, but I do like being able to support people, not a faceless corporation.

That said, I swapped to Mullvad VPN recently due to the Private Internet Access controversy.

Re:When will Google shut down Stadia? on Thursday November 21, 2019 @01:31PM (#21597593)
It's probably the HN filter bubble, but I feel similarly. I am excited about the return of 'dead' formats like landscape slider Android phones (Fxtec Pro1) or 'open source' hardware (PineBook/Phone/Time), but for most of the big companies out there, not much is new under the sun.

I could be wrong, but this reminds me a lot of 2006 or so when smartphones existed but were mostly Blackberry / Windows Mobile 5 Pocket PCs. We were ripe for a technology revolution but didn't know it at the time.

Either that or we are progressively turning into grumpy old people who don't like new technology?

Note that PhotoStructure on Windows IIRC Windows 10 only.
Re:AI Clones Your Voice After Listening for 5 Seconds (2018) on Wednesday November 13, 2019 @01:35PM (#21527661)
Hypothetically, if we were interested in donating some voice samples, where would we look to see what lines were needed?
Re:How Ambient Chill Became the New Silence on Monday November 11, 2019 @02:35PM (#21508079)
YMMV but at least here in the southeast USA, the default GSTV signal can be turned off by pressing a combination on the 4 soft touch keys on the outside of the screen. If your buttons are like so,

1 | CONTENT | 5

2 | CONTENT | 6

3 | CONTENT | 7

4 | CONTENT | 8

try the sequence 5 6 5 . Here where I am at, that mutes the sound. Sometimes 7 8 7 also turns the screen off.

But! You need to put it back to screen on, sound on, or the staff will notice and you risk them changing the combination on you.

Ironic, here I am thinking that GT is TopGear with the boring stuffy old parts removed. No, I don't care about Star in a Reasonably priced car or the Cool Wall.

I do care about the new car reviews, The News, 'what would happen if we made a car...out of spaghetti noodles', on-location shoots etc. GT has its own take on each of those.

Exactly. But glass is glass, so the amount of believing we have to do with a pane of glass / quartz with this system is much less of a leap than with a pressed circle someone made in cheap-as-possible-for-profit-margins-increases factories, organic dye or not.

Older »