News for hackers. Stuff that matters.

tkw01536

Re:ZuckOff Know when a camera is in the room on Monday September 21, 2026 @07:31AM (#49785872)
And even if not - could always make another device with the same company ID and flood everyone with false positives.
Re:Go 1.27 on Thursday August 20, 2026 @03:08AM (#49371401)
I’ve been able to run golangci-lint locally just fine.

However I’ve not had much success running it on CI, with at least the 1.27rcs. I encountered some panic deep within staticcheck, and ended up turning off that specific linter on CI (better than not running it at all).

There was a tracking issue for go1.27 support at [1]. However that is now closed, which might imply that it should be working.

[1] https://github.com/golangci/golangci-lint/issues/6643

Re:SSH has no Host header on Thursday March 19, 2026 @02:19AM (#47435615)
I ended up doing something like this for a separate use case (had to host a bunch of Drupal instances, and for some reason end users needed shell access).

For the proxy I did not rely on a “proper” ssh daemon (like openssh), but wrote my own using a go library called gliderlabs/ssh. That in particular allowed me to implement only a tcp forwarding callback [1] , and not provide any shell access on a protocol level. Also made deployment nicer - no need for a full VM, just a container was sufficient.

It is also worth nothing that the -j can be moved into .ssh/config using the ProxyJump option. It does mean end users need a config file - but it does allow typing just a plain ssh command.

[1] https://pkg.go.dev/github.com/gliderlabs/ssh#ForwardedTCPHan...

Re:Typst: A Possible LaTeX Replacement on Saturday September 27, 2025 @01:25PM (#45397702)
I already did [1]. It got moved into hayagriva, which appears to be the library used to implement citation in typst.

[1] https://github.com/typst/hayagriva/issues/255

Re:Typst: A Possible LaTeX Replacement on Saturday September 27, 2025 @01:07PM (#45397535)
Like other commentators, I have worked with LaTeX for a long time (> 10 years) and have to say that it very much shows its age.

For once, the compilation time is terrible - it can take several minutes to compile a typical document. I recently tried to create a poster for a conference - a single A0 page - and even this took more than a minute to compile. Because positioning in images and figures in LaTeX is not obvious, this made iteration extremely slow.

Additionally, by forgetting a single bracket, one can easily encounter cryptic error messages relating to boxes. In the past, I have also worked on LaTeXML (the LaTeX-to-HTML "converter" amongst other things being used to power ar5iv [1]). Even though this exposed me to some of (La)TeX's internals, it is still extremely difficult trying to decipher error messages.

Typst, on the other hand, is much faster when compiling and provides much clearer error messages.

For this reason, I also decided to write my 130-something PhD dissertation in Typst [2]. My university only provided a LaTeX and a Word template, but I ended up copying that in Typst extremely quickly. My thesis compiles in about 7 seconds on my laptop - I cannot imagine how long it would take had I chosen LaTeX instead. Not only that, when I showed an initial draft of my dissertation to my supervisor - also a decades-long LaTeX user - he could not tell that I wasn't using LaTeX.

I only really encountered one problem with Typst so far - citation styles. In particular, the alphanumeric style preferred by my field produced duplicate citation keys, making the output unreadable in printed form. But given all the other benefits Typst offered, I ended up switching to IEEE's citation style instead.

I am also hoping that Typst improves its HTML export - it is very barebones at the moment - but that seems to be in the works [3].

[1] https://news.ycombinator.com/item?id=36947004

[2] https://doi.org/10.25593/open-fau-1825

[3] https://github.com/typst/typst/issues/5512

Re:Show HN: HackerNews but for research papers on Thursday May 23, 2024 @06:09PM (#40460476)
I'd second this - linking directly to `https://arxiv.org/abs/{{id}}` maybe even include the formats in the `Access Paper` box on the RHS of that interface would be a neat feature.
I believe the questionable legality also extends to any kind of video calls taking place on systems with this turned on. If Recall indeed "does not perform content moderation", then having it on would include having screenshots of all video calls.

Especially in many-party consent jurisdictions recording video calls by taking screenshots at a sufficiently high frequency without the explicit consent, or at least option to opt out, of remote parties is probably illegal.

Disclaimer: IANAL and this isn't legal advice.

I usually interpret the “we” in scientific papers as “you (the reader) and me (the author)”.
Re:Online Encyclopedia of Integer Sequences on Friday April 05, 2024 @04:41PM (#39946939)
At one point a project in a research group I'm part of did automatic parsing of the entire OEIS to find relations between different existing sequences. Using a very simple approach, they found ~300 000 000 relations (e.g. meaning one sequence can be expressed as some combination of other sequences); see section 4 of [1].

However they submitted only three (!) of those back to OEIS. Even with 130 reviewers on the OEIS side, submitting all of those relations would have basically been a Denial-of-service attack on the review process.

[1] https://kwarc.info/people/mkohlhase/papers/icms16-oeis.pdf

You can actually also use the latexmlc omni-executable [1] (that is part of the latexml distribution), which can convert to html in one command:

    latexmlc --dest=mydoc.html --format=html5 mydoc.tex

[1] https://math.nist.gov/~BMiller/LaTeXML/manual/commands/latex...
Re:Doom Released Under GPLv2 on Wednesday January 17, 2024 @02:55PM (#39032600)
Wouldn't the grant given through section 5 of GitHub TOS [1] apply here?

That says "you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality".

In other words, without an explicit license you can do whatever you like with publically viewable content as long as it runs via GitHub.

[1] https://docs.github.com/en/site-policy/github-terms/github-t...

Re:Arxive Gets HTML Running on Thursday December 21, 2023 @10:42AM (#38721840)
Yes it does, e.g. compare the pdf [1] and corresponding html [2].

[1] https://arxiv.org/pdf/2312.12451.pdf

[2] https://browse.arxiv.org/html/2312.12451v1

Even if the official tool does shut down, a quick search shows several projects on GitHub to replace the official flashing utility. This seems to include a backup of the original site [1], an extended version [2] and a dump of the firmware [3].

[1] https://github.com/bestadamdagoat/stadiaupdatetool

[2] https://github.com/luigimannoni/stadia-controller-flasher

[3] https://github.com/Scyne/stadiaRawBtFw

Re:Please don’t upload my code on GitHub on Tuesday May 09, 2023 @06:53AM (#35872419)
However D4 also explicitly says "This license does not grant GitHub the right to sell Your Content". One could argue that because Copilot is a commerical product it is in fact selling (a derivative of) user code, and thus the grant in D4 does not apply.
IANAL but I don’t think that GitHub is violating their ToS here.

L4 says ”GitHub has the right to suspend […] your access […] at any time […]. GitHub reserves the right to refuse service to anyone for any reason at any time.”

I’m wondering what prevents network operators from just disabling the use of Private Relay on their networks.

This could be achieved both via legal means (in e.g. their terms of service to prohibit use of any VPNs or similar software) as well as on a technical level. As per [1]:

> The fastest and most reliable way to do this is to return a negative answer from the network’s DNS resolver, preventing DNS resolution for the mask.icloud.com and mask-h2.icloud.com hostnames necessary for Private Relay traffic.

These ISPs surely operate some DNS resolvers - just make them return NXDOMAIN results. This doesn’t require consent or collaboration from Apple.

[1] https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over...

Re:Linux's GPLv2 licence is routinely violated (2015) on Sunday February 20, 2022 @01:52AM (#30403776)
In its’ very basic form a license has two distinct purposes:

a) limit whatever rights are granted by copyright law b) grant new rights that go beyond copyright law

> Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted

I don’t see a contradiction here.

The first part states that anything being granted by this license (purpose b) only applies to copying and distributing.

The second part simply states that no new restrictions (in the sense of purpose a) are made.

To be more explicit, the paragraph should be read as:

> The act of running the Program is not additionally restricted

Re:All Bitcoin private keys are on this website on Tuesday December 21, 2021 @05:52AM (#29636097)
Re:QOvery Engine: We lost 3800 stars on GitHub on Friday December 03, 2021 @07:19AM (#29429163)
> We lost 3800 stars on Github in 1 click

Last time I checked changing repository visibility required confirmation and manually typing in the name of the repository to confirm. So it's not exactly "one click".

I also just reviewed the message being shown, it does state that stars are lost:

> You will permanently lose: All stars and watchers of this repository.

A screenshot is at https://i.imgur.com/eGNROtG.png.

I was missing an example of an async operation with Connective. Like fetch()ing something from an API based on a username.