HackerLangs
TopNewTrendsCommentsPastAskShowJobs

michaelt

38,419 karmajoined vor 14 Jahren
Greetings from London, United Kingdom! I'm Michael.

http://www.mjt.me.uk

[email protected]

Submissions

Guarding Against Physical Attacks: The Xbox One Story (2019)

platformsecuritysummit.com
14 points·by michaelt·vor 6 Monaten·6 comments

Falsehoods programmers believe about addresses

mjt.me.uk
144 points·by michaelt·vor 13 Jahren·128 comments

comments

michaelt
·vor 7 Stunden·discuss
I mean, drones trailing fiber optic cables are widely documented https://en.wikipedia.org/wiki/Fiber_optic_drone

So I’m pretty sure avoiding jamming by a military adversary is not trivial, even with frequency hopping and suchlike.
michaelt
·gestern·discuss
The behaviour of curl depends on how your version was built.

Python? The widely used 'requests' relies on 'certifi' and skips the OS store - but 'pip' on the other hand does use the OS store.

A tool that might use java, like a database or IDE, means it might have its own store.

Node? Make sure you set NODE_USE_SYSTEM_CA=1

Firefox and Chrome AFAIK both have their own stores.

Building a Docker container? That's intentionally isolated from the host, of course your container won't inherit the OS trusted CAs. Running a VM locally? Same.

Installed something using snap? The container-like isolation means it won't pick up the OS trusted CAs.

And of course you need the certs set up right on your cloud servers, your CI servers, the dozen different smartphones the mobile team uses for testing.
michaelt
·vor 3 Tagen·discuss
A lot of societies are set up to accommodate that society's dumbest members, and tourists, for most everyday tasks.

Outside of the workplace and my hobbies, I can't remember the last time someone asked me to read more than a few words, write anything at all, or do any maths more complicated than "the 12:20 train is 10 minutes late"

Personally I would say it's not respectful to a society to move there and not make a decent effort to learn the language - but I have no doubt a person could survive with only basic skills, if their workplace worked in their native language and they had an ethnic enclave as a support network.
michaelt
·vor 4 Tagen·discuss
Everything in business is a gamble.

Maybe tomorrow my competitor will aggressively cut prices. Maybe the product line I've spent money developing won't sell well. Maybe that new machine I've invested in won't be as productive as the marketing materials promised. Maybe bad weather will mean my customers stay home instead of visiting my shop. Maybe a war on the other side of the planet will raise my material costs and empty my customers' wallets. Maybe the artist headlining my music festival won't be allowed to enter the country. Maybe 10 years into its 50 year life my nuclear power plant will be undercut by falling costs for solar. Maybe Google will make the thing my app does a native feature of their OS. Maybe we pushed the envelope too far or didn't test thoroughly enough and we'll be buried in warranty claims.

This risk is why investments in businesses pay more than treasury bonds.

If you aren't comfortable with that, entrepreneurship might not be right for you - nothing wrong with being an employee and getting the certainty of a monthly salary.
michaelt
·vor 5 Tagen·discuss
> There is no such price

If it’s sustainable at $1/month, and a customer is willing to prepay $1200 for a 100 year subscription, that sounds sustainable to me.
michaelt
·vor 5 Tagen·discuss
> The main case against regulation is that it shouldn't be used when competition would do it better, which is most of the time. The trouble in this case is that copyright is a government-granted monopoly, which means this isn't one of those times, because competition is being foreclosed by statute.

Microsoft may have a monopoly on Minecraft, but they still have competition from other games (Roblox, Fortnite) and other forms of entertainment (social media, youtube, books, IRL friends).

To me, the problem is more one of the terms of the deal changing; if a person brought minecraft with a 'mojang' account and loses their purchase when those accounts disappear in favour of 'microsoft' accounts, for example.
michaelt
·vor 5 Tagen·discuss
> The reason bug reports feel like a ‘waste of everyone’s time’ is likely because you don't have the right error logging or telemetry built into the app itself. Having to wait for a manual bug report from a user is already a failure.

Yes and no.

You want enough logging and telemetry that you can roll out an update to 2% of users and know if something is terribly wrong before you roll it out to the other 98%.

On the other hand, you probably don't want enough telemetry to detect that customer Jim Smith has trouble with WebRTC when joining calls without a microphone while using Firefox and Cloudflare Warp with split tunnels enabled.
michaelt
·vor 5 Tagen·discuss
> You have to accept that your pricing model sucks to a group of people (who are likely experiencing subscription fatigue) and decide if it’s worth losing or never getting their money.

And for some subscription situations, you can probably offer them a price that works for both of you.

There's a 'PhotoSync' app that offers a premium option for either $1/month or $24 for life. Presumably because they looked at the average subscription duration and found it was in the region of 2 years. Modulo the time value of money and per-transaction processing costs.

Personally I much preferred the one-off purchase, even though it's not clear I'll be using the app in 24 months, because it fits a lot better with my (somewhat chaotic) way of managing my money.
michaelt
·vor 5 Tagen·discuss
How many US warships did the Iranians need to hit?

Turns out, none. Plenty of stationary targets, like US-owned data centres in US-aligned countries. Plenty of huge, slow-moving, undefended tankers.
michaelt
·vor 7 Tagen·discuss
Not necessarily. See the paper See "DeepSeek-OCR: Contexts Optical Compression" [1]

One option, when an image is fed into an LLM, is to divide it into tiles, then those tiles pass through a 'vision encoder' neural network to make 'vision tokens' which are then input into the LLM much like text tokens are. Obviously you train the vision encoder and LLM to understand one another. This is known as an 'end-to-end OCR model'.

And it turns out, once you've trained a model to do this, you can vary the number of 'vision tokens' used to represent a given text document by scaling an image of a document up or down, and see what happens. You also get a load of other parameters like patch size and vision encoder complexity and so on.

Turns out it works really well; in some tests they used 90% fewer input tokens, but still got 97% output performance.

[1] https://arxiv.org/abs/2510.18234
michaelt
·vor 8 Tagen·discuss
Does their salary bonus depend on that though?

Car makers make money selling cars. Which buyers happily pay five figure suns for. An executive can add to the bottom line by raising sales prices/volumes with a more competitive product, or lowering component costs.

This isn’t some weird social media business with non-paying users and a reliance on ad money.
michaelt
·vor 9 Tagen·discuss
One thing I've noticed with generative AI is it's now easier than ever to write more lines of code.

Before, a backend guy asked to add an intranet page would make an austere page -bare html with barely any styling or javascript. Today, the same guy given the same task can turn in something with styling, javascript, internationalisation, interactive form validation, progress spinner, minification build stage, linting, maybe even automated browser tests.

And I have to code review it. Now the bottleneck of writing the code has been removed, I now find code review is the bottleneck - and a bottleneck facing much higher flow must either let more through, or start applying back pressure.

Sometimes I think an evil genie granted my wish for better tested code by trying to drown me in it.
michaelt
·vor 10 Tagen·discuss
> This is why things like the Nintendo Switch hacks and iphone jailbreaks have to be reloaded every time the system reboots,

Why is it this particular form of 'malware protection' always seems to involve a 30% fee?
michaelt
·vor 12 Tagen·discuss
When nobody's done something before, there are lots of unanswered questions.

Is it even possible? Will businesses my voters like and use a lot just leave my country entirely? Will companies be able to develop privacy-preserving age check infrastructure? Will the press present it as a 'Chinese-style Great Firewall' or be more supportive of it? Will the blocks all be trivial to bypass? Will the large number of porn users in my country form a cohesive voting block? Will a powerful pro-privacy, pro-free-speech lobby emerge to challenge this? And will they be backed by powerful, well-funded US interests like Facebook and Google?

Australia simply showed the world passing this sort of legislation isn't political suicide.
michaelt
·vor 12 Tagen·discuss
There's quite a lot of statistics saying currently teens struggle with mental health even more than is historically normal for teenagers. [1, 2] Young people are also spending less time with friends, drinking less, and having less sex than ever before.

Obviously it's difficult to pin a 20-year trend on a single cause. But most parents have the sense their teens spend too much time on their phones; and with social media use as common as it is, almost every kid who commits suicide will have recently used social media. But it's not possible to prove causality in a way that will silence all objections.

I suspect it's particularly easy to convince politicians that social media is bad for mental health because of their lived experience. Consider the experience of being a professional politician on Twitter.

[1] https://www.canada.ca/en/public-health/services/publications... [2] https://www.oecd.org/en/publications/child-adolescent-and-yo...
michaelt
·vor 13 Tagen·discuss
I mean, the web 20-30 years ago was kinda mixed?

You had your IRC, with no message persistence, no image hosting, and no persistent account names (being able to reserve a username was an optional add-on feature). People would show they were away by changing their username from bob to bob_afk.

And it was common for people to use a nickname (for safety) and never show their face (because posting photos was a big effort). A person could be called 'cmdrtaco' or 'hemos' and that was enough, didn't need their real name or photograph or anything.

But you're right that there were also more small forums using things like phpBB which would be dedicated to a single interest, and they were much more human-scale communities. And people could have big signatures and animated GIF avatars, so you couldn't help but remember them!
michaelt
·vor 14 Tagen·discuss
With the rise of USB-C, docking-station-like devices are cheaper than ever before.

For $20 you can get something that will pass through power from a USB-C charger, 4k HDMI to a monitor, and provide gigabit ethernet and some USB ports. We're no longer in the bad old days of USB 2 where USB ethernet was noticeably slower - or of $$$ vendor-specific, laptop-specific docking stations.

And if you don't have a dedicated desk where you can set up your docking station, you're probably not going to enjoy the wired ethernet experience, because without a desk you'll have to crawl around to plug your ethernet cable into a floor port every time you move desks.

I still have a soft spot for laptops with built in ethernet ports, though, for connecting to devices in the field.
michaelt
·vor 15 Tagen·discuss
> I think we are all programmed to respond well to any courtesy, no matter how indirect.

I once read a book called "The Media Equation" that argued humans' social cooperation/courtesy instincts are many thousands of years old, while computers are very new (the book was written in 1996). As academic HCI researchers they'd conducted many experiments, providing evidence for this, which is why it's a book, not a paragraph.

What I found fascinating about this book was you could see how their findings had directly translated into Clippy in Office 97. You close 'Clippy' and it waves goodbye instead of disappearing immediately? They had research findings saying that was perceived more favourably.
michaelt
·vor 16 Tagen·discuss
The “Five Eyes cyber security leaders” aren’t exactly famous for their political independence, or for having the public’s best interests at heart, or erring on the side of regulating less.

You don’t get very far in the spying profession with honesty.
michaelt
·vor 16 Tagen·discuss
Some systems use liquid cooling for the GPU and CPU, but air cooling for the PSU, RAM and SSDs.

With that said, by the standards of industrial sites data centres are quiet, low traffic and smell free. An industrial area that can’t build a data centre certainly can’t build a steelworks or oil refinery or leather tannery.