Hacker Newsnew | past | comments | ask | show | jobs | submit | evanjrowley's favoriteslogin

You know what the fun fact that everyone I hear complain about the US spending more than is fair on international projects ignores or appears ignorant of?

When you’re the one carrying the water, you get to decide where the water goes.

I actually prefer regimes like NATO where everyone is happy to leave the US in charge and doesn’t arm themselves. For all the projection of “strength” the current admin gives off, they are on their way towards reigning over a kingdom formed from the ashes of the republic's empire


It used to be cv dazzle [0] is 15 years young. But its questionable if it works anymore. Theres also a bunch of of digital camo, most seem to target IR cameras [1] here's a homebrew version.

[0] https://adam.harvey.studio/cvdazzle

[1] https://www.macpierce.com/the-camera-shy-hoodie


I moved a 100% MS shop to AWS circa 2015. We ran our DCs on EC2 instances just as if they were on prem. At some point we installed the AAD connector and bridged some stuff to Azure for office/mail/etc., but it was all effectively in AWS. We were selling software to banks so we had a lot of due diligence to suffer. AWS Artifact did much of the heavy lifting for us. We started with Amazon's compliance documentation and provided our own feedback on top where needed.

I feel like compliance is the entire point of using these cloud providers. You get a huge head start. Maintaining something like PCI-DSS when you own the real estate is a much bigger headache than if it's hosted in a provider who is already compliant up through the physical/hardware/networking layers. Getting application-layer checkboxes ticked off is trivial compared to "oops we forgot to hire an armed security team". I just took a look and there are currently 316 certifications and attestations listed under my account.

https://aws.amazon.com/artifact/faq/


For some reason an Azure outage does not faze me in the same way that an AWS outage does.

I have never had much confidence in Azure as a cloud provider. The vertical integration of all the things for a Microsoft shop was initially very compelling. I was ready to fight that battle. But, this fantasy was quickly ruined by poor execution on Microsoft's part. They were able to convince me to move back to AWS by simply making it difficult to provision compute resources. Their quota system & availability issues are a nightmare to deal with compared to EC2.

At this point I'd rather use GCP over Azure and I have zero seconds of experience with it. The number of things Microsoft gets right in 2025 can be counted single-handedly. The things they do get right are quite good, but everything else tends to be extremely awful.


For any given viewing distance, there's a recommended screen size; further there are diminishing returns to resolution given the Mark One eyeball's resolution power:

* https://carltonbale.com/1080p-does-matter/

* https://en.wikipedia.org/wiki/Optimum_HDTV_viewing_distance

* https://www.rtings.com/tv/reviews/by-size/size-to-distance-r...


> "Northern Virginia was really at the centre for the growth of the internet, [it was] where AOL was headquartered, and so naturally they have the talent, they have the people already there, it was just easier to make [the data centres] there," cybersecurity expert Thomas Hyslip said.

Relevant Wikipedia entry-point: https://en.wikipedia.org/wiki/MAE-East

“Although it initially had no single central nexus, one eventually formed in the underground parking garage of an office building in Vienna, VA.[3]”

I love how this sentence is written like some sci-fi premise. The source is much more clinical about it: https://web.archive.org/web/20050214071013/http://www.wolfso...

“The décor of the machine room is unmarred by ornament. The room was created by walling off an area of the underground parking garage of a suburban Virginia office tower. The ceiling is low; harsh light pours out of fluorescent tubes; the air is filled with the white noise of a hundred computer cooling fans and a hint of battery fumes. Standing in this crowded space, surrounded by hard-working and very slightly grungy machinery, gives an interesting perspective and sense of scale, which is exactly what I was looking for in coming here. The room is no bigger than a two-car garage, and yet by some estimates more than half the traffic on the Internet passes through here.”


1) Younger people are cheaper to hire in the first place

2) They often have fewer commitments, so more time to dedicate to work

3) They have less experience in the workforce, so easier to bamboozle

4) A lot of them have that fresh excitement and desire to join a “mission” and/or replace through work the peer group they miss from college (which combines well with point 3)

Most companies need very few actually smart people, not sure where the misconception comes from. They mostly need grunts to put in the hours and who won’t complain about their lot.


This is needs consumer staying power in order to secure the funding. I recommend selling the blends in DRM locked plastic pods and have the device only be operable from a mobile app. The mobile app's purpose would be to gamify the aerosol dispensation by grading it on timeliness, targeted direction and force of the spray, as well as streaks that get posted to social media for a sense of foamo.

Even if you don't learn Chinese, I've been consciously adding http://v2ex.com to my doomscrolling regimen and running it through Google translate. It's a popular Chinese webforum, and while I wouldn't say it's exactly Chinese HN, it's a close enough approximation. It's interesting to see I have some of the same concerns and questions as someone halfway around the world in a totally different language and culture.

Here's an example from the front page, English title is: As a backend programmer writing front-end with the help of cursor, what is the most suitable front-end framework/solution

The comments mentioned all the usual suspects, Angular, Vute, React, next, etc.

https://www.v2ex.com/t/1165949

One thing that some users here would appreciate is their footer:

• Please do not copy and paste AI-generated content when answering technical questions


patio11's already saved over $2k apparently, maybe he'll do a more formal write-up at some point. (A couple threads here https://x.com/patio11/status/1977425626584711668 and here https://x.com/patio11/status/1978168404793037087 )

WhatsApp is no longer running FreeBSD. Prior to acquisition, everything was bare metal managed hosting at SoftLayer and we had all FreeBSD except one Linux host for reasons I can't remember (maybe an expirement for calling?). After acquisition, there was a migration to Facebook hosting that included moving to Facebook's flavor of containerized Linux.

Not because Linux is better, but to fit better within Facebook's operations[1], and Erlang runs on many platforms, so it was a much smaller effort to get our code running on Linux than to get FB's server management software to work for FreeBSD. Server hardware was quite a bit different, so we had no apples to apples comparisons of which OS was more efficient or whatever else. During initial migration, BEAM support of kqueue was much better than epoll, but that got worked out, and I feel like Linux's memory usage reporting is worse than FreeBSD's, but it's a weakness of both. I was never comfortable in the FB server environment, so I left in late 2019, when the FreeBSD server count was reduced to a small enough number that I ran out of things to do.

[1] Much of the server team had experience with acquisitions at Yahoo! and the difficulties of making an operations team focused on one OS support acquired teams on another OS. With the many other technical and policy differences between WA and FB, eliminating the OS difference was an easy choice to reduce friction. Our host count, which was large at SoftLayer, was small at Facebook, even after factoring in increased numbers because the servers were smaller and the operations less stable.


I get why you'd say the web versions are "pretty good" for most people, and I agree they've improved, but I think that's only true if you're doing basic stuff. The moment you hit a complex corporate or academic document, the web version of Office falls apart. It's materially worse than even LibreOffice when you consider a power user's reality.

The real killer is Excel. The web version has zero support for crucial tools like Power Query or Power Pivot, which are essential for any modern data analysis. You can't run, edit, or even create serious VBA/Macros, and advanced data validation and conditional formatting are stripped down to the bone.

For Word, if you're in law or academia, forget it. Features like Table of Authorities or Table of Figures are either completely missing or so simplified they are useless. Even the ability to handle standard APA or MLA citation styles is heavily cut down compared to the desktop app.

And for PowerPoint? You lose access to serious third party add-ins, and the granular control over animations and timers that professionals need just isn't there.

So, while the web version might be fine for a quick edit of a simple file, if you need to reliably work with a complex document from a Windows-based company, the compatibility issues and missing features will force you into a desktop app eventually. If you're going to be forced into a desktop experience anyway, you might as well bite the bullet and go LibreOffice for its feature completeness on Linux/FreeBSD.

It's a stronger bet than relying on Microsoft's cut-down web versions.


The article agrees:

> This suggests, I think, that in Thiel’s mind there are two cosmic forces warring over creation itself, and they both consist of Peter and his friends.


And that was the downfall..

1: Standardization was made by committee lovers and/or architecture astronauts leaving us with overly convoluted (sometimes to fit lacklustre object models in early OO languages) and complex ways of working.

2: Complexity that introduced security vulnerabilities

Sure, there was some great tooling available, but how much of it was needed because all complexity made it hopeless to work with without the tooling?

I used it for configuration and serialization in some projects, and it was actually great but I almost always diverged from the bloated norms and defaults for readability/writeability (that made it a bit annoying to specify serialization rules).

I mean, why did people prefer?

  <object><property name="somename"><int32>123</int32></property></object>
Over just?

  <object somename="123"/>
Yeah there is so much "flexibility" in those above designs but it wasn't needed 99% of the time.

JSON was and is so far the best popular compromise between "just plain data" and "some" structure to make automated processing non-painful.

Also as an improvement over XML collections (do you created a container element to specify container target leading to bloat or just map some of the sub-elements to specific collections and hope you don't run into ambiguities?) is that collections are just specific lists to a property.

The biggest drawback of JSON is that we never had a way to handle type specializations/subtyping but had we done that we might have not gotten the universal acceptance across languages.

Yes, comments but whenever you need that you can make a single-line regexp to strip a useful subset of them without affecting anything by the standard by removing matches of

  /^\s*\/\/[^\r\n]*/mg

During a face2face with my n+2, he once told me « manage your manager ». I discovered later that he had been forced to hire my n+1 but did not like him at all. And that the message was basically: « he is a bozo whereas you a competent engineer. Don’t be fooled by the organization chart. »

So sometimes saying no to your n+1 is totally in line with your n+2 :)


Human beings are ephemeral. They're born, they die.

Everything human beings create is ephemeral. That restaurant you love will gradually drop standards and decay. That inspiring startup will take new sources of funding and chase new customers and leave you behind, on its own trajectory of eventual oblivion.

When I frame things this way, I conclude that it's not that "software quality" is collapsing, but the quality of specific programs and companies. Success breeds failure. Apple is almost 50 years old. Seems fair to stipulate that some entropy has entered it. Pressure is increasing for some creative destruction. Whose job is it to figure out what should replace your Apple Calculator or Spotify? I'll put it to you that it's your job, along with everyone else's. If a program doesn't work, go find a better program. Create one. Share what works better. Vote with your attention and your dollars and your actual votes for more accountability for big companies. And expect every team, org, company, country to decay in its own time.

Shameless plug: https://akkartik.name/freewheeling-apps


No, they gave the cannibal ants a link to a new food source. Imagine you're living in your house, your neighborhood, and there's this large pit in the center, where the cannibals live. They're 30ft down so they can't get out, so you don't have to worry. Then someone puts a ladder down to them. Start of a horror movie if you ask me.

My kids could read and do math in K, unlike many of their classmates.

At that point it doesn't really matter, because K is really about play and learning the conventions.

By the end of 2nd grade it was clear that they were bored out of their minds. So to private school they went.

For parents with kids that aren't motivated it's hard to understand what the fuss is.

But, the Left's problem is that instead of trying to raise everyone up they're bringing people down. It was that way in the USSR, and it's that way here. Where I used to live the Talented and Gifted program (which was state mandated) had a $1000 budget systemwide. The "equity" fund was almost a third of the budget. At that point why bother with public schools? It's taxation without representation.


Has anyone read Montefiore's Young Stalin and Court of the Red Tzar? Those books were an absolutely wild ride. Stalin really comes across as one of the more unusual characters of history. No one in his native Georgia liked him, so they were happy to dish dirt on his youth and give the full story free of obvious glorification.

I think the most unusual characteristics of his story was that everyone tried to control him. First, the priests at the seminary by disciplining him, then his father, who wanted him to be a shoe cobbler, then the czars by putting him in prison and exiling him, then his fellow party members by trying to out politic him, and absolutely nothing worked on him. The guy did not budge an inch from his mission or ever got discouraged no matter what happened. The guy, like a serial killer, was completely emotionally unmoved and undeterred by any obstacle or opinion of anyone.

They put him in prison, he started taking control of the prison. They sent him to Siberia he came back and dove right back into revolution after always seeming to father an illegitimate child while in exile. He remembered everyone who he ever met and punished them or rewarded them later accordingly. He seemingly did everything for the sole purpose of global Marxist revolution and he got rid of anyone, or group of people or thing that got in his way. He wasn't even vulnerable to flattery. He was just dead set and committed to his goal of global marxist revolution and brutal vengeance against all his enemies who tried to keep him from achieving that.


kinc is an open source rootless, single-container Kubernetes distribution designed for development, testing, and edge deployments. It provides a complete Kubernetes cluster running entirely in userspace without requiring root privileges or complex multi-container orchestration.

- Rootless Operation: Runs entirely in userspace without root privileges

- Single Container: All components (etcd, API server, kubelet, etc.) in one container

- Multi-Cluster Support: Deploy multiple isolated clusters concurrently Podman Quadlet Integration: Native systemd service management

- Dynamic Resource Allocation: Automatic port and CIDR management

- Powered by crun, cri-o, podman, systemd, cgroup v2, nftables


> Any other admin and Apple would sue them

I doubt Apple could demonstrably prove damages before the civil statute of limitations expires. This is a nonstarter in court, and furthermore this is not negligence by the FCC. You do not have a right to keep your FCC filings from leaking under all circumstances, and the FCC has not assumed a civil obligation externally to your rights to do so. Government agencies do not sign NDAs when corporations submit technical documents to them. The Federal government has no obligation in statute to keep them secret, you asking them to is a polite suggestion to the FCC and holds no bearing in law. Even if you could prove damages, trying to bring a case under the Federal Tort Claims Act against the government for this would be a nightmare in any administration, and there's no way that the Supreme Court would cede the idea that the government has an absolute obligation your filings secret forever under pain of civil penalties. It's an embarrassing clerical error, but it isn't a tort.


Location: Kirkuk, Iraq Remote: Preferred Willing to Relocate: No Technologies: JavaScript, NodeJS, React, ExpressJS, Django, Python Résumé/CV: https://drive.google.com/file/d/1epyMsf_XHuoqDc6ap_mpO9nkVAM... Email: saadsawash{dot}mh{at}gmail{dot}com

It looks like you're in Iraq.

The first thing that comes to mind is, if I wanted to hire you remotely, how would I pay you?

I don't know whether it's a common question you have from prospective employers, but if I'm running a business (FWIW, I'm not), I'd be worried that regularly sending money to Iraq might trigger some alarms (anti-money laundering, sanctions, etc.), and this probably trumps any other consideration unless somehow you're able to show that you're so good at doing the work that it's worth the (perceived) risk.

So I'm speculating that maybe you'd have better chances if you focus on crypto-friendly companies and figure out a way to receive money using crypto, and mention this upfront or at least at the same time you reveal where you are currently.


With Envoy (https://www.envoyproxy.io/) and Contour (https://projectcontour.io/) being official CNCF sanctioned projects in the Service Proxy space, Istio (https://istio.io/) and Linkerd (https://linkerd.io/) being official CNCF sanctioned projects in the Service Mesh space and Emissary Ingress (https://emissary-ingress.dev/) the same in the API Gateway space, just to name a few, naming yourself a standard are some pretty big words...

... Traefik is pretty good yes, but a standard? Hell no.


Sounds like HackerOne Managed Triage Services dropped the ball again and closed both reports without even flagging to Cloudflare's security engineers.

This happened in a high-profile way with the Zendesk situation (https://news.ycombinator.com/item?id=41818459) and is not the first time:

    1. Bug bounty report received from knowledgeable person who isn't a "celebrity" (top x performer on H1 leaderboard, social media influencer, H1 event invitee)

    2. with novel impact to the company, open source ecosystem, or wider Internet

    3. which doesn't fall neatly into an OWASP Top 10 (Web) box

    4. so Triage close it in the pre-queue before the company get eyes on it, replying with a zero-effort CR (Common Response aka Canned Response)

    5. the company doesn't see the report unless they go digging for it in the thousands of spam/bullshit/Acunetix copypaste reports that are also closed
---

Timeline of events:

https://blog.cloudflare.com/unauthorized-issuance-of-certifi...

>2025-09-02 04:50:00: Report shared with us on HackerOne, but was mistriaged

>2025-09-03 02:35:00: Second report shared with us on HackerOne, but also mistriaged.

>2025-09-03 10:59:00: Report sent on the public mailing [list] picked up by the team.

---

The canned response in question:

https://groups.google.com/g/certificate-transparency/c/we_8S...

>"after reviewing your submission it appears this behavior does not pose a concrete and exploitable risk to the platform in and on itself.

>If you're able to demonstrate any impact please let us know, and provide an accompanying working exploit."


>Imagine a future where it becomes easier to commit terrorism because of some technological advancements

Imagine a future where aliens invade, and all of our civil rights have to be suspended in order for society to be re-focused on fighting an existential war against the invaders. I suppose this sci-fi hypothetical could happen and if it did happen then the sacrifice might even be necessary. But it's not happening now, and it's entirely reasonable to classify it as both (1) unlikely, and (2) an incredibly bad outcome we should hope that we never have to face.


I regularly see similar articles with similar comments here, but there's one thing I still don't understand:

From the European Convention on Human Rights[1]:

  ARTICLE 8
  Right to respect for private and family life
  
  1. Everyone has the right to respect for his private and family
  life, his home and his correspondence.
  
  2. There shall be no interference by a public authority with the
  exercise of this right except such as is in accordance with the
  law and is necessary in a democratic society in the interests of
  national security, public safety or the economic well-being of the
  country, for the prevention of disorder or crime, for the protection
  of health or morals, or for the protection of the rights and freedoms
  of others.
  
So I wonder, what is the legal argument solid enough to justify interfering with everybody's right to privacy?

My layman understanding of the usual process is like, we want surveillance over those people and if it seems reasonable a judge might say ok but for a limited time. Watching everyone's communications also seems at odds with the principle of proportionality[2].

[1]https://www.echr.coe.int/documents/d/echr/Convention_ENG

[2]https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12...


Nsig/sig - Special tokens which must be passed to API calls, generated by code in base.js (player code). This is what has broken for yt-dlp and other third party clients. Instead of extracting the code that generates those tokens (eg using regular expressions) like we used to, we now need to run the whole base.js player code to get these tokens because the code is spread out all over the player code.

PoToken - Proof of origin token which Google has lately been enforcing for all clients, or video requests will fail with a 403. On android it uses DroidGuard, for IOS, it uses built in app integrity apis. For the web it requires that you run a snippet of javascript code (the challenge) in the browser to prove that you are not a bot. Previously, you needed an external tool to generate these PoTokens but with the Deno change yt-dlp should be capable of producing these tokens by itself in the near future.

SABR - Server side adaptive bitrate streaming, used alongside Google's UMP protocol to allow the server to have more control over buffering, given data from the client about the current playback position, buffered ranges, and more. This technology is also used to do server-side ad injection. Work is still being done to make 3rd party clients work with this technology (sometimes works, sometimes doesn't).

Nsig/sig extraction example:

- https://github.com/yt-dlp/yt-dlp/blob/4429fd0450a3fbd5e89573...

- https://github.com/yt-dlp/yt-dlp/blob/4429fd0450a3fbd5e89573...

PoToken generation:

- https://github.com/yt-dlp/yt-dlp/wiki/PO-Token-Guide

- https://github.com/LuanRT/BgUtils

SABR:

- https://github.com/LuanRT/googlevideo

EDIT2: Addeded more links to specific code examples/guides


> SIM farms are normal, common things that exist all over the place to allow messages from far-away senders to be sent as if they came from a local number.

Meanwhile, many US companies won't let me, the actual legitimate user they're trying to authenticate, use Google Voice, because it's "so dangerous and spoofable, unlike real SIM cards".

Hopefully this helps a little bit in driving that point home.


The story of Israel and Hamas is a story of the force of modernity overcome by babarism against a barbarism borne from the horror of modernity. The author made an error in believing that barbarism is ever justified for its own sake, as a reaction. Nobody will question that violence is unnecessary for the cause of freedom, but what Hamas did was not tactical, it was an indulgent revenge cloaked in the guise of righteous anger. But personal feelings, percieved wrongs, are meaningless in the real world. The only thing that is right is eliminating the conditions of possibility for such senseless violence, and neither Israel nor Hamas has made any genuine efforts to do so.

Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: