usr1106's favorites | Hacker News

gosub100 73 days ago | parent | context | on: Breaking the 4Chan CAPTCHA

Re: your last paragraph, https://coveryourtracks.eff.org/

EFF have been running this for years. Gives an estimate about how many unique traits your browser has. Even things like screen resolution are measured.

barbolo 73 days ago | parent | context | on: Breaking the 4Chan CAPTCHA

https://github.com/lwthiker/curl-impersonate

hi-v-rocknroll 4 months ago | parent | context | on: Ask HN: Does anyone use sound effects in their dev...

Forking each sox command to the background causes samples to play non-deterministically and step over each other. Here's a better way:

    # Define notes for major seventh chord starting on A 440
    A=440
    C_SHARP=554.37
    E=659.25
    G_SHARP=830.61

    case "$layout" in
    Finnish)
      kitty +kitten themes --reload-in=all Apprentice &
      play "|sox -np synth 0.2 sine $A" \
           "|sox -np synth 0.2 sine $C_SHARP" \
           "|sox -np synth 0.2 sine $E" \
           "|sox -np synth 0.2 sine $G_SHARP" \
           vol -30dB 2>&- &
      ;;
    'English (US)')
      kitty +kitten themes --reload-in=all Default &
      play "|sox -np synth 0.2 sine $G_SHARP" \
           "|sox -np synth 0.2 sine $E" \
           "|sox -np synth 0.2 sine $C_SHARP" \
           "|sox -np synth 0.2 sine $A" \
           vol -30dB 2>&- &
      ;;
    *) echo >&2 'Invalid $layout - must be "Finnish" or "English (US)"'; exit 1
    esac

PenguinRevolver 5 months ago | parent | context | on: The Santander UK iOS app is 613 MB and 35% of it d...

Breakdown of the app is available here: https://www.emergetools.com/app/example/ios/examp_fCeiq7Z6xe...

galleywest200 6 months ago | parent | context | on: Apple Maps on the web launches in beta

No, it does work. Just go to a sub-directory. I can access via Firefox.

https://beta.maps.apple.com/asd as an example.

ykonstant 8 months ago | parent | context | on: What Is PID 0?

I can't help sharing one of the loveliest uses of `kill 0` I know:

    #!/bin/sh
    #
    #    Usage: upto LIMIT COMMAND
    #        Run COMMAND until LIMIT seconds have passed, then exit.
    #
    test "$1" -gt 0 || {
     printf '%s\n' " Error: first argument must be a positive integer."
     exit 1
    }
    
    sh -ic '
     sleeptime=$1
     shift
     exec 3>&1 2>&3
     { 
      "$@" >&3
      kill 0
     } |
     {
      sleep "${sleeptime}"
      kill 0
     }
    ' sh "$@"

SubzeroCarnage 9 months ago | parent | context | on: Apple and Google deliver support for unwanted trac...

Google Play System updates provide very few security patches and this only applies to devices with Android 10 and higher and most APEX modules are only updatable in later versions.

I track security patch counts of monthly Android Security Bulletin vs available APEX vs my aftermarket backports for A7 through A13 here: https://divestos.org/pages/patch_counts#aggregatePatchCounts

giantpotato 10 months ago | parent | context | on: XZ backdoor story – Initial analysis

The tool used in those white screenshots is called IDA pro, a decompiler.

https://hex-rays.com/ida-pro/

madars 11 months ago | parent | context | on: OpenVPN Is Open to VPN Fingerprinting

Might be http://witch.valdikss.org.ru/ , e.g., using number of flows and MTU (and maybe other techniques)

petercooper on Nov 20, 2023 | parent | context | on: Trap and test AWS SES emails locally

I suspect you meant something more independent, but technically yes, AWS provides this: https://aws.amazon.com/workmail/

While SES can handle both inbound and outbound mail, I think Workmail is the only way to get IMAP and actual hosting of email. I imagine you could set up https://mailinabox.email/ on the cheapest EC2 instance and use SES for outbound, though.

eastdakota on Nov 4, 2023 | parent | context | on: Post Mortem on Cloudflare Control Plane and Analyt...

I was surprised we didn't get a single question about it from an analyst or investor, either formally on the Q3 call or on any callbacks we did after. One weird phenomenon we've seen — though not so much in this case because the impact wasn't as publicly exposed — is that investors after we've had a really bad outage say: "Oh, wow, I didn't fully appreciate how important you were until you took down most of the Internet." So… ¯\_(ツ)_/¯

mkimball on Oct 7, 2023 | parent | context | on: Ask HN: How does Starlink work for IP address/ASN ...

Starlink's RFC 8805 geolocation list is publicly available:

https://geoip.starlinkisp.net/feed.csv

Folks interested in geofencing content and such pull from there.

SushiHippie on Oct 7, 2023 | parent | context | on: The Honeypot Diaries: Thousands of Daily Attacks o...

Then you can be in the 512kb club. https://512kb.club/

EDIT: even in the green team! https://512kb.club/faq

paradite on July 25, 2023 | parent | context | on: The Fall of Stack Overflow

I'm assuming you are talking about XY problem?

https://xyproblem.info/

jaakkonen on July 14, 2023 | parent | context | on: COSMIC DE: Desktop environment created for Pop!_OS...

I'm so stoked about a well supported tiling Wayland compositor! Now KDE/Gnome are the only secure options in a world where all others implement screen capture, virtual keyboard and virtual mouse interfaces without access restrictions (looking at you sway and all of wlroots)

adamgordonbell on May 12, 2023 | parent | context | on: Pigz: Parallel gzip for modern multi-processor, mu...

I heard of pigz in the discussions following my interview of Yann Collet, creator of LZ4 and zstd.

If you'll excuse the plug, here is the LZ4 story:

Yann was bored and working as a project manager. So he started working on a game for his old HP 48 graphing calculator.

Eventually, this hobby led him to revolutionize the field of data compression, releasing LZ4, ZStandard, and Finite State Entropy coders.

His code ended up everywhere: in games, databases, file systems, and the Linux Kernel because Yann built the world's fastest compression algorithms. And he got started just making a fun game for a graphing calculator he'd had since high school.

https://corecursive.com/data-compression-yann-collet/

soheilpro on April 26, 2023 | parent | context | on: Google Authenticator cloud sync: Google can see th...

After my phone was stolen last month, I switched to https://2fas.com and couldn't be any happier.

It's free, open source and has tons of great features.

benmmurphy on April 12, 2023 | parent | context | on: Firefox rolls out Total Cookie Protection by defau...

I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru

rwmj on Jan 18, 2023 | parent | context | on: Fedora's tempest in a stack frame

This article by one of the GNOME devs is well worth reading to understand why frame pointers are currently the only good solution if you want accurate profiles: https://blogs.gnome.org/chergert/2022/12/31/frame-pointers-a...

I have to agree with him. perf has an option to use DWARF data for stacks, but IMHO it simply does not work.

neathack on Nov 16, 2022 | parent | context | on: Infosys leaked FullAdminAccess AWS keys on PyPI fo...

When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org). Would have made a big difference!

EDIT: That GitHub user is gone for good.

thrdbndndn on July 31, 2022 | parent | context | on: Famous HNers and their sites

From this? https://console.cloud.google.com/marketplace/details/y-combi...

xenocratus on July 13, 2022 | parent | context | on: Rolling your own crypto: Everything you need to bu...

Obligatory reply to an endorsement of Applied Cryptography: https://sockpuppet.org/blog/2013/07/22/applied-practical-cry...

asicsp on June 12, 2022 | parent | context | on: Ask HN: Which are the best open source books?

There are huge lists on freely available books on programming topics here (most would probably not fit your 3rd point though):

* https://ebookfoundation.github.io/free-programming-books/boo...

---

All my books are free to read online and markdown sources are available on GitHub: https://github.com/learnbyexample/scripting_course#ebooks

pancho111203 on June 12, 2022 | parent | context | on: Show HN: Browser extension that spoofs your locati...

This could also happen if you have a misconfigured VPN with a DNS leak. Check out this website for clues: https://ipleak.net/

AdrianoKF on June 11, 2022 | parent | context | on: DNS Toys

You can also use iodine (https://github.com/yarrick/iodine/) to tunnel IPv4 data through DNS (useful e.g. when on a captive portal network that doesn't block DNS requests). Performance isn't great obviously, but the concept is fascinating nonetheless.

lovelearning on April 8, 2022 | parent | context | on: Firefox DNS-over-HTTPS

If you're a dev who uses curl / requests / HTTP libraries, just browser-level DoH isn't enough for ISP privacy or govt censorship evasion.

On Ubuntu 18, I installed "dnss" at the OS-level to send all DNS requests as DoH. Currently, it just forwards them to CloudFlare's DoH URL. But I can also install it as a DoH proxy on my remote server if I want to move away from CloudFlare.

It works fine and is easily installed without any builds or PPAs. The only problem with it is that I had to disable systemd-resolved first to reserve port 53 for dnss.

ShowalkKama on March 17, 2022 | parent | context | on: Browser in the Browser (BITB) Attack

Fear not, among the millions of flags firefox exposes in about:config there is browser.link.open_newwindow.restriction that does exactly what you are looking for! Make sure to set it to 0.

j0r0b0 on Feb 24, 2022 | parent | context | on: Tell HN: News sites may have a “lite” version for ...

Shameless plug: I made a French version of CBC Lite, with contents coming from Radio-Canada.ca[0]. It basically shares the same advantages, but the content is written in French and the build/content is refreshed every 30 minutes. It's built with Eleventy[1].

The project is called Radio-Canada Lite and it's over at https://rc-lite.xyz

[0] https://ici.radio-canada.ca

[1] https://www.11ty.dev

mhale on Feb 20, 2022 | parent | context | on: Going IPv6 Only

I've also found this Geekflare tool to be useful to test the IPv6 compatibility of any domain/URL. https://gf.dev/ipv6-test

Geekflare (https://gf.dev/) has several other useful tools, worth checking out.

This page is useful to test the IPv6 compatibility of your current network/browser: https://test-ipv6.com/

tkanarsky on Feb 11, 2022 | parent | context | on: Phone number has been used too many times

https://github.com/MattGorko/libu2f-emu can spin up virtual U2F tokens which are indistinguishable (in my experience) from real ones plugged into a USB port