Hacker News: Gaelan

New comment by Gaelan in "Spyware vendors use 0-days and n-days against Android, iOS and Chrome"

Gaelan — Wed, 29 Mar 2023 13:25:06 +0000

Yes (from the Google blog post linked elsewhere in the thread):

> CVE-2022-42856, a WebKit remote code execution exploiting a type confusion issue within the JIT compiler (0-day at time of exploitation).

Lockdown mode disables the Webkit JIT.

New comment by Gaelan in "FedNow FAQ"

Gaelan — Thu, 18 Aug 2022 22:58:45 +0000

Routing numbers aren't, but account numbers are: traditionally in the US it's possible to use a routing+account number to withdraw from someone's account.

New comment by Gaelan in "Killbutmakeitlooklikeanaccident.sh"

Gaelan — Sun, 17 Jul 2022 12:38:33 +0000

Perhaps even more evil:

kill -SEGV $1

New comment by Gaelan in "The Kia Instrument"

Gaelan — Wed, 27 Apr 2022 22:38:01 +0000

Looking at the contents of the macOS installer (I haven't tried to run it), it seems to be both. Looks like it's based on https://www.cabbageaudio.com?

New comment by Gaelan in "Why Remotion is a native macOS app, not Electron"

Gaelan — Fri, 08 Apr 2022 15:05:57 +0000

Well yes, but GTK and Qt apps feel about as native on macOS as Electron apps do.

New comment by Gaelan in "Why Remotion is a native macOS app, not Electron"

Gaelan — Fri, 08 Apr 2022 15:04:42 +0000

Isn't Edge just Chromium these days? The page you linked says:

> Evergreen distribution. Rely on an up-to-date version of Chromium with regular platform updates and security patches.

No Ghosts

Gaelan — Tue, 15 Mar 2022 14:43:50 +0000

Article URL: https://blog.sunfishcode.online/no-ghosts/

Comments URL: https://news.ycombinator.com/item?id=30685943

Points: 6

# Comments: 0

New comment by Gaelan in "FoundationDB: A distributed unbundled transactional key value store"

Gaelan — Fri, 11 Mar 2022 22:42:19 +0000

> probably prone to issues if you can’t update multiple as part of the same transaction

IIRC one of FoundationDB's features is that it does support such transactions, so you can easily implement indexing on top of it.

New comment by Gaelan in "A Proposal for Type Syntax in JavaScript"

Gaelan — Wed, 09 Mar 2022 19:22:22 +0000

This is essentially doing that—it would allow browsers to parse and run TypeScript. What it isn't doing is actually having browsers do type checking, for good reason: the TypeScript type checker is a large and complex piece of software, so browsers would either have to incorporate it (and they're probably not excited to have a large chunk of JS code in the critical web-page-rendering path, nor would they be excited to have a critical chunk of the browser with a single implementation), or reimplement it themselves (which would be a huge amount of work, and make changes to the language much slower and more difficult).

New comment by Gaelan in "Linux's GPLv2 licence is routinely violated (2015)"

Gaelan — Sun, 20 Feb 2022 13:11:22 +0000

> I am not claiming that running on an OS is the same as dynamically linking with a library

In pretty much any case, it literally is: you're dynamically linking against the libc. This is a little fuzzier on Linux (because, as you mention, multiple libc implementations exist), but on Windows, macOS, and the BSDs, the only supported way to make syscalls is to make calls into a dynamically linked libc, provided by the operating system.

New comment by Gaelan in "Apple's custom NVMes are amazingly fast – if you don't care about data integrity"

Gaelan — Thu, 17 Feb 2022 09:20:04 +0000

Laptops have batteries, so an AC power failure doesn't mean they immediately crash: they just keep running on battery until the battery gets low, at which point the system cleanly hibernates.

New comment by Gaelan in "Is it safe to use __secret_internals_do_not_use_or_you_will_be_fired?"

Gaelan — Thu, 03 Feb 2022 17:04:44 +0000

  +-----------------------------------------------------------------------------+
  | You are entering the operating system shell. By confirming this action in   |
  | the appliance shell you have agreed that THIS ACTION MAY VOID ANY SUPPORT   |
  | AGREEMENT. If you do not agree to this -- or do not otherwise understand    |
  | what you are doing -- you should type "exit" at the shell prompt. EVERY     |
  | COMMAND THAT YOU EXECUTE HERE IS AUDITED, and support personnel may use     |
  | this audit trail to substantiate invalidating your support contract. The    |
  | operating system shell is NOT a supported mechanism for managing this       |
  | appliance, and COMMANDS EXECUTED HERE MAY DO IRREPARABLE HARM.              |
  |                                                                             |
  | NOTHING SHOULD BE ATTEMPTED HERE BY UNTRAINED SUPPORT PERSONNEL UNDER ANY   |
  | CIRCUMSTANCES. This appliance is a non-traditional operating system         |
  | environment, and expertise in a traditional operating system environment    |
  | in NO WAY constitutes training for supporting this appliance. THOSE WITH    |
  | EXPERTISE IN OTHER SYSTEMS -- HOWEVER SUPERFICIALLY SIMILAR -- ARE MORE     |
  | LIKELY TO MISTAKENLY EXECUTE OPERATIONS HERE THAT WILL DO IRREPARABLE       |
  | HARM. Unless you have been explicitly trained on supporting this            |
  | appliance via the operating system shell, you should immediately return     |
  | to the appliance shell.                                                     |
  |                                                                             |
  | Type "exit" now to return to the appliance shell.                           |
  +-----------------------------------------------------------------------------+

Cleaned up formatting

New comment by Gaelan in "AWS Service Terms: the clause 42.10"

Gaelan — Thu, 20 Jan 2022 10:33:33 +0000

Surely a reasonable court would say that it's very clear what they meant?

New comment by Gaelan in "Google Summer of Code in 2022 – No longer limited to students"

Gaelan — Thu, 11 Nov 2021 10:59:18 +0000

Note that they halved the project size in 2021, so the new project sizes are the original pre-2021 size, and the smaller 2021 size.

New comment by Gaelan in "Grand jury subpoena for Signal user data, Central District of California"

Gaelan — Fri, 29 Oct 2021 20:00:11 +0000

I'm not too familiar with this, but my understanding is that the push notification just wakes up the Signal app, then the Signal app gets the encrypted message (either from Signal's servers or the push notification payload, I'm not sure) and decrypts it client-side and provides the notification text.

New comment by Gaelan in "So You Want to Rust the Linux Kernel?"

Gaelan — Mon, 11 Oct 2021 09:40:52 +0000

Generally, the idea is that you use a small amount of unsafe code to build a safe abstraction to do what you need, then use that abstraction in many places. So now you only have a few unsafe sections you have to verify for correctness, instead of the entire program like you'd need in C/C++.

New comment by Gaelan in "Turbo 7"

Gaelan — Fri, 24 Sep 2021 14:36:45 +0000

@dang could you give "world.hey.com/foo" URLs the GitHub/Twitter treatment where it shows the first segment of the path?

New comment by Gaelan in "While posting to Tumblr, E and W keys just stopped working"

Gaelan — Tue, 21 Sep 2021 16:05:58 +0000

> (unless you remapped another key to capslock (why?))

When I first started doing caps-lock-to-control, I mapped my physical control key to caps lock. Eventually, I stopped bothering and kept it as control.

New comment by Gaelan in "Arm AArch64 Adds Memcpy() Instructions"

Gaelan — Tue, 21 Sep 2021 08:41:30 +0000

> Thumb adds many additional instruction encodings of variable length, load/store multiple already had pretty arbitrary latency

Worth noting that, AFAIK, both of these were removed on aarch64 (and aarch64-only cores do exist, notably Amazon's Graviton2)

New comment by Gaelan in "Crev is a code review system"

Gaelan — Sun, 19 Sep 2021 09:56:10 +0000

https://gitlab.com/crev-dev/auto-crev-proofs is an identity that automatically trusts every known reviewer (at level "none"), which is useful for finding reviewers. You can also browse all known reviews online at https://web.crev.dev/rust-reviews/.