News for hackers. Stuff that matters.

wolrah

Re:WTF Ubuntu? on Monday November 02, 2026 @07:44PM (#50346443)
I wonder how much Raspberry Pi's choice to use Debian as the basis for their default distribution helped here, because it certainly increased the demand for plain Debian packaging of software that was previously packaged for Ubuntu.
Timex DataLink. I had the Ironman Triathlon branded model of those, used the hell out of it in high school.

The screen flickering trick also only worked on CRTs under Windows 3.1/9x, so if you had a laptop, any other system with a LCD, or were running NT you had to get a special dongle that hooked up to your serial port and would blink a LED that you had to hold in line with the watch's sensor.

Re:WTF Ubuntu? on Monday November 02, 2026 @03:37PM (#50343360)
> None of which was a good reason to use it on servers. Even if you were familiar with Ubuntu there is very little difference between an Ubuntu server and a Debian one.

Something to keep in mind is that the term "server" covers a wide range from datacenter beasts pulling kilowatts per node to old desktops running headless to Pi Zeroes and repurposed cell phones, and some of those use cases do in fact benefit from access to proprietary drivers and even hacks like NDISWrapper.

Beyond that, I've seen two main reasons to use Ubuntu Server over Debian, and I say this as someone who has administered Ubuntu, Debian, and CentOS systems for years and always chooses Ubuntu or Debian when the options are open.

1. For a while there were commercial software vendors that would release Linux versions only for specific distros, and Ubuntu was on that list a lot more often than Debian, so if you liked Debian-style packaging and wanted to use commercial software there was a reason to use Ubuntu. Zimbra was one of those when I last used it in the late '00s.

2. There was a time where it seemed like every F/OSS project had a PPA which made it really convenient to install on Ubuntu with automatic updates as part of the system package manager while Debian had to manually load .debs or might not have even had a package due to older system libraries. For personal toy servers and "pet" dev servers this is wonderful, obviously far less important for well-managed "cattle" servers.

Docker, Flatpack, and to a much lesser extent Snap have pretty much eliminated these reasons though. My home server is still Ubuntu LTS because it's easier than changing it but when it next gets rebuilt things will be changing a lot. All of my work servers are migrating to Debian, we have one Ubuntu instance remaining that just had its last major service switched away and a bunch of CentOS systems on sites which are getting swapped out whenever our techs happen to visit.

Re:Ask HN: Which TV do you recommend for privacy? on Monday November 02, 2026 @10:25AM (#50338102)
If you put the model number in to your search engine of choice it should return a number of sellers focusing on the hospitality and B2B markets offering these products. Some are "call for quote" bullshit but others have a price listed and an "add to cart" button. I haven't actually tried to buy one, I have a CX that lives on an allowlist-only VLAN and I'm fine with that.
Re:Bidirectional Charging During Grid Outages on Monday November 02, 2026 @10:21AM (#50338025)
As others have noted, yes air conditioning an entire house takes a lot of power, but if we're talking about large scale disaster scenarios you don't need to air condition an entire house.

My car can power a windowshaker and a refrigerator for days between charges. It can air condition itself for about a week. If things are at a place where that's not enough why would I stay there?

Re:Ask HN: Which TV do you recommend for privacy? on Sunday November 01, 2026 @06:51PM (#50331195)
https://solutions.lg.com/us/hospitality-tvs/lg-55am960h0ud

Hotel TVs, same panels as consumer models with different supporting hardware and stock calibrations. These are actually dimmer than the consumer models to increase panel longevity.

They tend to lack gaming features like high/variable refresh rate but they're more functional as normal TVs than digital signage displays.

They have similar OSes as the consumer models and can run the same apps but don't have ads unless the operator wants them to and can be centrally managed, support internal IPTV networks, etc.

Re:Bidirectional Charging During Grid Outages on Sunday November 01, 2026 @04:35PM (#50330142)
To be fair, losing power in a winter storm can be equally dangerous because while the gas might still work your central HVAC system requires electricity to run its blower, power the thermostat, etc.

That said, you are still absolutely correct about the proportion of the population that's really at risk of extended blackouts being incredibly small.

In the US 80% of the population lives in urban or suburban areas, where for the most part power outages are measured in either seconds or hours and while extreme weather or bad drivers might sometimes cause enough damage that it takes a few days to get power back on to a specific neighborhood it's rare outside of large-scale natural disasters for the power to be out over more than a couple of neighborhoods.

I live in an older suburban neighborhood in Ohio and the one time we had power out for more than 12 hours the literal next street over still had power. Even if my whole neighborhood was out for a week, the nearest fast chargers to me in either direction are both technically in another city and on an entirely different section of the grid. If power is out for all of them for days on end stuff is really messed up to a point that FEMA and/or the National Guard would likely be involved, and that's beyond the level of disaster I'm really worried about.

Obviously those who live in low-lying coastal regions like Florida and the Gulf Coast where a disaster is pretty much a given or those living in extremely rural areas where restoring service is going to be deprioritized have different risk assessments and if I were in their position I'd be looking in to trying to be as grid-independent as possible, have enough battery power and solar generation to support living comfortably without requiring grid input under normal conditions and to support "emergency mode" operation with half your system or more destroyed in case of a major disaster.

> It looked like an office desk phone but instead of Ethernet, a SIM card goes only.

Eww, I hate that such a thing exists. Everyone involved in its development needs their decision-making privileges revoked for anything more consequential than breakfast.

There is no good reason for an internet connected device to be cellular-only unless it's intended to effectively never be in "home territory". Every other such device should at least have WiFi so it's useful in areas where there is no cell service and doesn't need to use limited cellular spectrum even wheb there is service.

There is also no good reason for an internet connected device that's not expected to move while in operation to not have an ethernet port. It's unfortunately common amongst consumer-targeted devices (e.g. Nintendo Wii and a surprisingly large number of printers) but it's bad nonetheless. If it can reasonably be wired it should be wired, period. If it doesn't move and isn't in a weird spot, you need to have a really good reason why it can't be wired to justify using WiFi and "I don't like wires" has never been and will never be such a reason.

> Right, so if I'm still rocking 4G only while 'everyone' else in the area is using 6G with some other stragglers on 5G, ...

You will keep receiving service until it becomes unprofitable to do so, same as always, but that time will be a lot further down the road than it used to be because there's basically no reason to care outside of congested cells where making the most of every bit of airtime matters.

If you're in a congested area, prepare for newer tech to be prioritized, often legitimately because the newer modes tend to be better at sharing the air and thus more users can be better served by prioritizing them on limited spectrum.

There are SIP to cellular gateways which have historically been very popular in regions where landline to mobile calls cost money but mobile to mobile do not, but they mostly don't exist in the US market other than high-density devices mostly used by SMS spammers.

The only actual VoIP phone with a SIM card I'm aware of is the Yealink T74LTE which for a long time was exclusive to Verizon's business phone service but has recently become available for general purchase, those can support both SIM over LTE data and VoLTE (which is also basically SIP but over a prioritized channel).

> Will LTE continue to work when 6G rolls out in 3 years?

A significant change that came with LTE is the use of OFDM as the base of the air interface, which means that cellular providers no longer need to allocate large segments of spectrum to one protocol or another. Towers that were upgraded from 4G to 5G didn't need to disable 4G or consistently split their spectrum between the two they way they did when upgrading from 2G to 3G or 3G to 4G, they can dynamically allocate subchannels in each mode based on the immediate needs of their users.

It seems unlikely that whatever technologies come in the future will regress in this way, so there shouldn't be a need for a hard cutoff at any point and I'd expect LTE devices to keep working for many generations to come.

Re:If IPv4 Were Land on Friday October 30, 2026 @12:51PM (#50306628)
> Only today we would have put everything behind something like NAT anyway because your devices would be getting hacked constantly.

So the security "provided by" common 1:many NAT comes from the fact that 1:many NAT inherently requires stateful connection tracking and by its nature traffic coming in from the "1" side without an associated connection or rule has nowhere to go, effectively denying any other traffic by default from the "1" side which is almost universally the untrusted side.

Do you know what else has stateful connection tracking and deny-by-default rules on untrusted interfaces? Every single firewall that's worth using or even was at one point worth using in a year starting with a "2".

So yes, in a world without NAT we'd still have stateful firewalls blocking unsolicited incoming traffic that had not been specifically allowed. Those who wish to host public services will still need to configure rules to allow that traffic in unsolicited but those rules will be simpler than NAT port forwards because there's no address translation involved. Anything else wanting to generate on demand temporary connections between systems will be able to do so simply by having each system perform a basic hole punch, sending traffic at the other at the same time with the same pair of ports, and expect it to work again in ways much simpler than what's necessary for reliably doing the same in a 1:many NAT environment.

1:many NAT makes nothing better, it only makes things worse. It's a bad thing and needs to go away as quickly as possible.

---

1:1 NAT is an entirely different beast, it can be entirely stateless and thus has no has no negative impact on most protocols that don't try to communicate address info in-band but also that statelessness means it doesn't inherently provide a firewall effect.

Re:If IPv4 Were Land on Friday October 30, 2026 @12:12PM (#50305998)
You ignored the second half of that sentence:

> syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

In no way am I denying that people would like to solve the same problems easily. What I'm saying is that it would have been a much simpler problem requiring much less infrastructure. An application like SyncThing that works without any central infrastructure would have been an order of magnitude easier to implement in a world where every internet connected device had a unique routable address.

Re:If IPv4 Were Land on Thursday October 29, 2026 @07:47PM (#50297888)
> That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

Dropbox gained popularity *BECAUSE IT MADE IT EASY TO DO THIS WHEN YOU'RE STUCK BEHIND NAT TRASH*. By the time it was even a thought in anyone's brain the internet had already been ruined by that garbage.

It would never have existed in a world without NAT because it wouldn't have been needed, syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

Every ISP that has CGNAT v4 without providing full v6 needs to be shut down. They are either incompetent or actively choosing to make their users' service less useful to restrict them and/or encourage "upgrades". Internet service has a public routable IP address, period.

Re:MacBook Pro with PROLED XDR Display and Touch on Wednesday October 28, 2026 @11:32PM (#50284250)
That's not a justification for padding, it's a justification for scalable UI. A lot of those "classic" windows dialogs do not scale well on high DPI screens but they still work great with a mouse even if their scaling is ugly. The padding is just there for touch-friendliness.
It was more of the point that WiFi devices allow that to happen because basically every consumer/smallbiz WiFi network can be assumed to support internet access and most buyers won't care.

The easiest way to avoid that problem is to just skip retail WiFi devices altogether because having WiFi basically always means assuming internet connectivity which is not far from mandatory cloud bullshit.

Matter only sort of solves it because a lot of Matter devices (most in my personal experience) use WiFi and often intentionally neuter their Matter support to "encourage" you to use their app and/or cloud integration with a major voice assistant.

I have a pair of Govee ceiling lights that have a RGB+CCT primary downward facing light and an addressable RGB accent ring. The ARGB ring only exists in their app. As far as both their Matter support and their official API are concerned these units have a single element which is the downward light, the ARGB ring is not controllable from any third-party systems.

If these were using Zigbee, Z-Wave, or Matter over Thread they wouldn't be able to do this but because they use WiFi they can.

I'm going to be opening one up soonish to see how hard it'll be to just replace the controller with one running WLED (or even reprogram the controller already in it).

One of many reasons I prefer home automation hardware that uses ZigBee, Z-Wave, or Thread over using WiFi. If it uses WiFi it almost always wants to connect to or worse requires a cloud, where the dedicated home automation network tech is basically the polar opposite and requires that it work entire directly locally or with a local hub.

Other major reason being that "IoT" devices usually have the shittiest WiFi radios that usually don't even support 5 GHz and almost never support WiFi 6/7 modes where they aren't wasting a ton of airtime on their low-bandwidth communication.

Re:VMMouse for NT 3.x: QEMU/VMware mouse integration driver on Friday October 23, 2026 @10:58AM (#50210163)
Mouse "works" but it will require that the VM "capture" the mouse pointer and often doesn't move the same way it would on the host because the VM is having to translate the messages it's receiving from the host OS in to emulation of a classic PS/2 mouse.

A VM integration driver allows the host to just pass through to the guest the absolute position of the pointer over the virtualized display and the button/scroll events which allows it to not need to be captured and movement feels natural to the host system.

Newer guest OSes that support USB HID can generally support an absolute input mode which was intended for drawing tablets and it'll work well enough, but it's a bit of a hack and requires updating the USB descriptor any time the display resolution changes to keep them in sync so a VM integration driver is still nice to have.

Re:eMudhra to Exit Global SSL/TLS Certificate Business; on Friday October 23, 2026 @10:10AM (#50209334)
As Wayne points out later in the thread, it's because those who are paying attention already know the answers but the questions are specifically designed to both confirm that eMudhra actually understands what they've done wrong and are willing to publicly acknowledge it, which is a critical factor in how an incident will affect trust going forward.

Obviously in this case eMudhra has decided they don't want the responsibility anymore which I actually respect to some extent.

Re:eMudhra to Exit Global SSL/TLS Certificate Business; on Thursday October 22, 2026 @09:29PM (#50203445)
> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.

Re:Plex laid off the whole player team on Wednesday October 21, 2026 @03:58PM (#50186743)
The actual thread the post being referenced is in is about Dolby Vision and HDR10 playback on Apple devices, so I can see where a rant might come out I guess...

edit: Yup just saw GP's reply and they clearly have opinions about HDR.

> sometimes due to real constraints

IMO this should always be pushed back against, because it's not a valid excuse. If the hardware is too constrained to support appropriate security then that hardware is not appropriate for the application (or no longer appropriate for the application, as the story often goes).

The element of limited choice between multiple tracks makes me think of the Viewmaster Interactive Vision which implemented a much more limited version of the concept.
Re:Wine Ported to OpenBSD on Monday October 19, 2026 @05:01PM (#50157996)
There was a whole era of mid '90s Microsoft games where they were still competing with "Exit to DOS to get the best game experience" so they went out of their way to make sure you were aware you were running in Windows while playing their games. Aside from the early Age of Empires games I also recall the "Madness" family of racing games had different takes on the same idea from a variety of different developers. I actually just reinstalled Monster Truck Madness 1 the other day and have been working my way through trying to bodge it in to being an acceptable experience for this exact reason. The game itself runs fine but the UI does a lot of weird things that may have worked on Windows 9x with a low-res CRT but are very annoying on a modern system.
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.

Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.

Re:An Apology on Monday October 19, 2026 @03:03PM (#50156526)
"No Problems" isn't exactly a comparison.

Apple's network has the majority of iOS and iPadOS devices on the planet tracking for it.

Google's network has whatever subset of Android devices are running a new enough version of the OS and have opted in tracking for it.

Tile's network has whatever subset of both iOS and Android devices where the device owner either has/had or is close with someone who has/had a Tile device, installed the app, hasn't uninstalled it, and the app hasn't had its permissions revoked automatically due to lack of use.

It's just not comparable. Tiles are fine around the house or in densely populated areas where you can generally assume someone with the app is going to be nearby pretty regularly, but if you lose your keys on a hiking trail and someone else picks them up so they're not wherever your phone last saw them you're probably not getting any updated info any time soon.

> This is terrifying. Who runs things like this open to the outside?

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

Re:An Apology on Friday October 16, 2026 @09:05AM (#50117910)
I bought my partner a few of those years ago before Google had even announced an intent to get in to the tracker market, and they work great for an individual looking to find their keys in the house, but as far as tracking things in the real world they're significantly less useful because their tracking network is basically only other Tile users who have the app installed and haven't let its permissions expire.

A tag like this is only as strong as its network, and Apple absolutely dominates that with Google a distant second and Samsung still pretending they have a chance in third. Tile isn't even in the competition.

Re:Tesla Roadster on Friday October 16, 2026 @08:47AM (#50117696)
> Mobileye is no longer a Tesla supplier because Tesla insourced their ADAS.

Mobileye is no longer a Tesla supplier because Tesla wouldn't stop using their tech in ways they did not approve of, turning back all the safety limits to allow the public to do things Mobileye knew were unsafe. Mobileye publicly called them out, saying that Tesla was "going to hurt the interests of [Mobileye] and hurt the interests of an entire industry, if a company of our reputation will continue to be associated with this type of pushing the envelope in terms of safety".

This is one of the reasons why S/X ADAS performance famously got significantly worse in late 2016 with HW2, they had of course been working on their own tech but because they'd already built their brand around ADAS they felt compelled to put it out unfinished when they no longer had the Mobileye system to sell.

Older »