minitech

4 ms·

31.
by minitech 5mo ago
- CSP that allows cdn.jsdelivr.net/unpkg.com (which serve anything on npm, which anyone can publish to) indiscriminately is not effective (and I’m sure some cdnjs script in an Angular-style library executes arbitrary code in otherwise-
32.
by minitech 5mo ago
> in favor of some unlikely cloak and dagger interception scheme someone who definitely understands how crypto works, describing the most basic possible MITM
33.
by minitech 5mo ago
I know parameters don’t translate directly like that (and that linear and exponential aren’t the only types of growth) but a doubling as a go-to example of “not exponential growth” is pretty funny.
34.
by minitech 5mo ago
ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079
35.
by minitech 6mo ago
> Any TLS break delayed by more than 15 minutes would be worthless. It sounds like you’re talking about breaking TLS’s key exchange? Why would this not have the usual issue of being able to decrypt recorded traffic at any time in the fut
36.
by minitech 6mo ago
> Rather, an interactive window running under the user’s name has implied access to the user’s home folders, regardless of what’s been set under “Files & Folders” (which still applies for background/non-interactive processes). N
37.
by minitech 6mo ago
Npm and the other JavaScript package managers do generate and check lockfiles with hashes by default. This was a new release, not a republishing of an old version (which isn’t possible on the npm registry anyway).
38.
by minitech 6mo ago
Nobody is confused or disagrees about the `--hard` part. It was a minor tangent about contexts where these ASCII substitutions are established, like LaTeX (`` -> “, '' -> ”, -- -> –, --- -> —, etc.)
39.
by minitech 6mo ago
It’s about the top-level comment’s horror that ”--” was substituted with “an en dash, not even an em dash”. If you’re picking a substitution for “--”, en dash makes more sense. The comment you originally replied to had already agreed “tha
40.
by minitech 6mo ago
No, the comment was pointing out that the HN platform automatically replaces `--` in titles with `–`. (I don’t know if that’s true, but that was the intent. Nothing to do with AI.)
41.
by minitech 6mo ago
They meant “more appropriate [than an em dash]”. And that minus sign usage of hyphen-minus isn’t unique in Unicode either – see U+2212 MINUS SIGN.
42.
by minitech 6mo ago
People are using Firefox intentionally, vs. using IE because it was preinstalled. Firefox is a maintained browser. IE was hard to support, and Firefox is not. There are a lot of differences.
43.
by minitech 6mo ago
That’s what rot13 is for.
44.
by minitech 7mo ago
What changed about the ending?
45.
by minitech 7mo ago
Not that that isn’t a practical concern, but that’s not the level at which the network claims to be decentralized. Your account was banned by one participant in the hypothetical decentralized network.
46.
by minitech 7mo ago
- “yellow” is a racist adjective for asians, “black” is not a racist adjective for black people - there is no “white community” in the US to make the equivalent to “black community” so you can’t really draw any useful conclusions from how s
47.
by minitech 7mo ago
That’s mostly a Dockerism (and even Docker has `COPY --link` these days). The underlying tech supports independent layers.
48.
by minitech 7mo ago
What they point to are capabilities, but the integer handles that user space gets are annoyingly like pointers. In some respects, better, since we don’t do arithmetic on them, but in others, worse: they’re not randomized, and I’ve never com
49.
by minitech 8mo ago
Maybe vibe-coding Show HN apps is correlated with low effort and bad taste.
50.
by minitech 8mo ago
It couldn’t, but it tried.
51.
by minitech 8mo ago
There is. Signal uses it, for example. https://signal.org/blog/building-faster-oram/ For another example, IntegriCloud: https://secure.integricloud.com/
52.
by minitech 8mo ago
AI slop? Most egregiously nonsense part: > **3. The Layer 7 Limitation** Cloudflare operates primarily at the application layer. Many failures happen deeper in the stack. Aggressive SYN floods, malformed packets, and protocol abuse strik
53.
by minitech 8mo ago
You pay a cost either way: live in a world with better funded and incentivized scammers and in a community less wealthy by a corresponding amount, or have a slightly less convenient sideloading experience. I guess if you take the old saying
54.
by minitech 9mo ago
There’s a whole field’s worth of really cool stuff about error correction that I wish I knew a fraction of enough to give reading recommendations about, but my comment wasn’t that deep – it’s just that in hashes, you obviously care about di
55.
by minitech 9mo ago
Uniformity isn’t directly important for error detection. CRC-32 has the nice property that it’s guaranteed to detect all burst errors up to 32 bits in size, while hashes do that with probability at best 2^−b of course. (But it’s valid to ca
56.
by minitech 9mo ago
> What would be an issue, if they used 128 bit xxhash instead of 128 bit cryptographic hash like they do now (if we assume we don't need to protection from tampering)? malicious block hash collisions where the colliding block was in
57.
by minitech 9mo ago
> Are we saying that we are okay to cut trees to make straws when we could make them out of petroleum ? It’s more okay to make things out of paper than plastic, yes. Plastic waste and microplastics are a huge problem. Trees are a renewab
58.
by minitech 9mo ago
That doesn’t look like a counterexample to “we formalize the statements by hand and inspect the proofs carefully to ensure they capture the full spirit of the problem”.
59.
by minitech 9mo ago
(nicer reply to this) Yes, I’m aware of the readability benefit of named arguments, and made the original comment with that awareness too. > Make a named pipe then. Shells have built-in primitives for that. I.e. <() and >() subshel
60.
by minitech 9mo ago
You’ve misrepresented or ignored all of my arguments, which are fairly complete as written. You can reformat them into a table for your personal use if it helps; I haven’t seen evidence that continuing into “an actual discussion” with you o

More ›