mtlynch

49 ms·

1. 631.▲
   by mtlynch 2y ago

   > Doing a page fault where you can't in the kernel is exactly what I did with my very first patch I submitted after I joined the Microsoft BitLocker team in 2009. Hello from a fellow BitLocker dev from this time! I think I know who
2. 632.▲
   by mtlynch 2y ago

   HN explicitly allows reposts: > Are reposts ok? > If a story has not had significant attention in the last year or so, a small number of reposts is ok. Otherwise we bury reposts as duplicates. > Please don't delete and repos
3. 633.▲
   by mtlynch 2y ago

   Great write up! Thanks for putting so much work into this investigation and report.
4. 634.▲
   How insecure is Avast Secure Browser?(palant.info)

   15 points by mtlynch 2y ago|0 comments
5. 635.▲
   by mtlynch 2y ago

   You're right. I misread "working for" as "working with."
6. 636.▲
   by mtlynch 2y ago

   I'd imagine it's more complicated than that. If you use iOS or Android, I'd imagine there's some practice of Google or Apple that you object to, so it's not practical to do it in all cases. In my experience, I try t
7. 637.▲
   by mtlynch 2y ago

   > I think that's only true if your CSP has the word 'unsafe' or '*' in it. No, that's the subtlety that a lot of people in the thread are missing. I wish OP did a better job of explaining the difference. Im
8. 638.▲
   by mtlynch 2y ago

   What I mean is that imagine you have HTML like this: <div hx-disable><img src="foo.jpg"></div> You might screw up and give the attacker a way to control the src attribute like: <div hx-disa
9. 639.▲
   by mtlynch 2y ago

   The headers say "Server: AmazonS3" which means it's a static site. Given that it's also a personal blog, there's not much point in CSP headers because a) it's not processing user input and b) even if an attacke
10. 640.▲
    by mtlynch 2y ago

    There are some good points here, but I think the author neglects to dig deeper and explain how you can mitigate some of these risks with htmx settings. I've been using htmx with CSP for the past couple of weeks, and I do find that it e
11. 641.▲
    by mtlynch 2y ago

    The relevant thing here is that before, CSP would protect you even if you failed to sanitize an attacker-controlled input. Bringing in htmx allows the attacker to bypass CSP, and that hasn't been documented well before. The htmx docs m
12. 642.▲
    by mtlynch 2y ago

    Creating a tool that allows people to aggregate writing from a website is fine. This project goes one step further and shares a copy of Graham's writing as an ePub on Github,[0] which I don't think is ethical or legal. It's G
13. 643.▲
    by mtlynch 2y ago

    That's true, I guess it's more the quality. Were people publishing lossless PNG screenshots in 2001? My memory of screenshots of that time was that they were super compressed GIFs and JPEGs.
14. 644.▲
    by mtlynch 2y ago

    Are there some shenanigans here with the publication date? The screenshots looked surprisingly large and high-quality for something published in 2001. I looked up the page in the Internet Archive, and there's no record of its publicati
15. 645.▲
    by mtlynch 2y ago

    Hi Achim, thanks for the response! Would it be possible for you to document somewhere how to flash from source? The website currently kind of explains it under "Flashing Of The AirGradient Firmware," but step two is to flash the
16. 646.▲
    by mtlynch 2y ago

    Cool, thanks for the additional context! As someone who is a Nix beginner and struggles with the language, I'd love to see an alternative that's easier to use. Is Nickel at the point where it is a viable alternative for Nix than t
17. 647.▲
    by mtlynch 2y ago

    There's no explanation of what Nickel is. Even if I click the link, I get: > Better configuration for less > Write complex configurations. Modular, correct and boilerplate-free. I still don't get what this is. Configuratio
18. 648.▲
    by mtlynch 2y ago

    I think the feigned shock from GP is that Komorebi was inspired by Linux tiling managers, so porting to Linux maybe feels like a copy of a copy. I guess it's a little like moving to Mexico and asking if Taco Bell has ever considered op
19. 649.▲
    by mtlynch 2y ago

    Agree. I'd always thought that inline dialogs with fictional characters were more for the author's entertainment than the reader's, so I was surprised OP and others in the thread like them. I have nothing against them if peop
20. 650.▲
    by mtlynch 2y ago

    I also own an indoor AirGradient, and I like supporting open-source, open hardware, but I've been pretty disappointed with the product. There were no instructions in the box, and I had to dig around a while until I found this PDF from
21. 651.▲
    by mtlynch 2y ago

    Link for the curious: https://en.m.wikipedia.org/wiki/Skin_(short_story) Collection: https://en.m.wikipedia.org/wiki/Someone_Like_You_(short_stor...
22. 652.▲
    by mtlynch 2y ago

    For anyone who was as confused as I was: Carson Gross, the author of this essay is also the creator of htmx. I thought at first that the essay was going to be a joke of "all these weaknesses are actually strengths," but I feel lik
23. 653.▲
    by mtlynch 2y ago

    Haha, I was surprised to see my name pop up on HN in this context when I saw the headline.
24. 654.▲
    by mtlynch 2y ago

    I typically worked 30-40 hours per week.
25. 655.▲
    by mtlynch 2y ago

    My net income from TinyPilot was $10,447 in 2022, but I had other income from investments (mainly just boring index funds). But I live in Western Massachusetts and own my home (no mortgage), so my cost of living is fairly low.
26. 656.▲
    by mtlynch 2y ago

    The deal happening ASAP was aligned with my interests in this case. I would have taken a lower sale price for a faster close. But even aside from that, they make more money the larger the deal, so they work to get a good price. They also fe
27. 657.▲
    by mtlynch 2y ago

    I'd be happy to, but the podcast is on indefinite hiatus: https://news.ycombinator.com/item?id=33945360 https://nickjanetakis.com/blog/taking-an-indefinite-break-fr...
28. 658.▲
    by mtlynch 2y ago

    Thanks for reading! And thanks for giving us a chance in those early days!
29. 659.▲
    by mtlynch 2y ago

    In this case, that wasn't that much of a concern. I felt like the buyer had the skills to grow TinyPilot from $1M to $10M+, but he didn't have a technical background, so he'd have a hard time recreating the business from scra
30. 660.▲
    by mtlynch 2y ago

    Thanks for reading and for the kind words! And 21 years is amazing! With everything that's changed in the last two decades, it's awesome that you've continued adapting and kept competitive all these years later.