ahlCVA

vor 15 Tagendiscuss

It seems like it doesn't do this for Code 128 (possibly because it is variable-width?). It definitely works with EAN13 though - I tried it locally using only the TTF file.

ahlCVA

vor 15 Tagendiscuss

Barcode fonts have been around for ages. But what's cute about this one is that it can calculate the EAN13 checksum on its own.

ahlCVA

vor 17 Tagendiscuss

This isn't without downsides though: As somebody with a niche technical hobby, it is hard for me to order from many suppliers because they understandably don't want to deal with consumer protection laws and thus exclude B2C transactions outright ("Verkauf nur an Gewerbetreibende").

I would be fine with waiving my right to returns but this is not possible on purpose, so my only options are to shop somewhere else (often not possible) or found a company (not possible because it would be Liebhaberei - "Running a company without intent to make profits").

ahlCVA

vor 2 Monatendiscuss

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin:

  What is true is already so.
  Owning up to it doesn't make it worse.
  Not being open about it doesn't make it go away.
  And because it's true, it is what is there to be interacted with.
  Anything untrue isn't there to be lived.
  People can stand what is true,
  for they are already enduring it.

I cannot wrap my mind around why people think finding vulnerabilities is bad. The code already was broken before somebody published the vulnerability. The difference now only is that you know about this.

Imagine somebody finding a flaw in a mathematical proof and everybody being sad because a beautiful proof got invalidated rather than being glad future work won't build on flawed assumptions.

I get that the rate of vulnerability discovery can be a burden, especially for people doing FOSS in their spare time, but the sustainability problem with that has always existed and only gets exacerbated by the vulnerability stuff, but the latter isn't the cause you need to make go away.

ahlCVA

vor 2 Monatendiscuss

Apple implements the USB-C/USB PD specs to a t and is unforgiving if you don't do either.

At work, our quick test for if a device implements USB PD correctly is to plug it into an Apple power supply (optionally with a PD protocol sniffer in line). If it doesn't work (either no/intermittent VBUS or the wrong VBUS), it's always been the case that the device is doing something wrong.

It can be annoying but strictly speaking their fault.

ahlCVA

vor 6 Monatendiscuss

Obviously the two aren't the same (especially given the need to do routing), but I've always found it amusing that in the systems world, capability-based systems (i.e. making it impossible to address things you aren't allowed to access) are gaining traction while the philosophy in the networking world seems to be going in the opposite direction (make it possible to address everything, i.e. IPv6 vs. NATted IPv4, then add filtering).

ahlCVA

vor 6 Monatendiscuss

Calling publishing API docs "open-sourcing" is a bit hyperbolic, but as token gestures go, it's at least worth a little bit.

I'm not familiar with those devices in particular, but I wish vendors would take steps to make life easier for after-markt firmware developers especially once devices go EOL by doing things like proactively dropping a GPL tarball and giving people a way to disable secure boot locks on devices that have them.

ahlCVA

vor 6 Monatendiscuss

This is a per-credential setting, so you can have your SSH signing key be a no-touch key and still use touch confirmation for everything else.

(see "uv" option here https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl... - the -sk key types in SSH are just a clever way of abusing the FIDO protocol to create a signing primitive)

ahlCVA

vor 7 Monatendiscuss

For what it's worth: You can set no-touch-required on a key (it's a generation-time option though).

ahlCVA

vor 7 Monatendiscuss

There is also a relatively modern capability-based kernel in the L4 family of microkernels, called Fiasco.OC: https://os.inf.tu-dresden.de/fiasco/overview.html

There are also a bunch of components for building a functional userspace (such as L4Re or Genode).

ahlCVA

vor 9 Monatendiscuss

SNI leakage is what encrypted client hello (ECH) tries to solve: https://blog.cloudflare.com/announcing-encrypted-client-hell...

It's still not perfect since you're still leaking information about the privacy set implied by the outer ClientHello, but this possibly isn't much worse than the destination IP address you're leaking anyway.

ahlCVA

vor 9 Monatendiscuss

Relevant SSC blog post: https://slatestarcodex.com/2015/01/31/the-parable-of-the-tal...

Starting from very similar observations but drawing the causality arrow in the opposite direction (alignment follows from talent).

ahlCVA

vor 10 Monatendiscuss

Previously: https://news.ycombinator.com/item?id=38664729

ahlCVA

vor 10 Monatendiscuss

Whenever people complain about the energy usage of LLM training runs I wonder how this stacks up against the energy we waste by pointlessly redownloading/recompiling things (even large things) all the time in CI runs.

Submissions

Valve open-source the Steam Machine e-ink screen so you can make your own

Black Box Probing: A Security Analysis of Xiaomi's MJA1 Secure Chip

German ruling declares Google liable for false answers in AI Overviews

Programming the Apollo Guidance Computer in Blockly

The Empty Field That Wasn't: GPS, OTAD and Two Decades of Encrypted Broadcasts

Ugetty: A modern, lightweight, multi-protocol Getty

You're probably taking the wrong painkiller

[untitled]

Linux PTP mainline development war story and new features

A Server That Forgets: Exploring Stateless Relays

Conway's Game of Life, in real life

Sashiko – an agentic system for Linux kernel changes

The Need for Understanding (2025)

Ucode

Help us test WEBCAT alpha

AI controls is coming to Firefox

Building cryptographically verifiable integrity into Linux systems

Rust for C Programmers

SoundSlab: How It Started

ASCII diagrams extracted from open source code-bases

comments