<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: aaronmdjones</title><link>https://news.ycombinator.com/user?id=aaronmdjones</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Wed, 10 Jun 2026 09:55:37 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=aaronmdjones" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by aaronmdjones in "AI errno(2) values"]]></title><description><![CDATA[
<p>`errno` is a userland concept; the kernel returns negative error numbers that libc then turns into -1 and sets errno. Thus the correct manpage is errno(3).</p>
]]></description><pubDate>Mon, 25 May 2026 14:08:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=48267052</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=48267052</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48267052</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Hardware Attestation as Monopoly Enabler"]]></title><description><![CDATA[
<p>> Am I understanding correctly that [...]<p>What I took away from the thread is that they're against services forcing attestation in general, and also pointing out that Play Integrity <i>isn't</i> about security, but rather about control, because Google could trivially make it work with GrapheneOS (which is more secure than any other Android OS on the market) but they won't.</p>
]]></description><pubDate>Sun, 10 May 2026 18:45:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=48086600</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=48086600</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48086600</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Dirtyfrag: Universal Linux LPE"]]></title><description><![CDATA[
<p>You don't need any setuid binaries. You could just as easily use the vulnerability to add a job to crontab(5) that causes the cron daemon to run whatever you want as root.</p>
]]></description><pubDate>Fri, 08 May 2026 00:57:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=48057167</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=48057167</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48057167</guid></item><item><title><![CDATA[New comment by aaronmdjones in "For Linux kernel vulnerabilities, there is no heads-up to distributions"]]></title><description><![CDATA[
<p>If they don't have world-execute permission, an access(2) check for executability would return negative, leading to things like shells not tab-completing it. The kernel would also deny attempting to execute it, as it is not executable for your fsuid.<p><pre><code>  $ sudo chmod 4700 hello
  $ ./hello
  bash: ./hello: Permission denied
</code></pre>
You need execute access in order to launch it, but in order for it to run, the user it is running as (not you) needs read access; you don't.</p>
]]></description><pubDate>Thu, 30 Apr 2026 22:56:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=47969350</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47969350</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47969350</guid></item><item><title><![CDATA[New comment by aaronmdjones in "For Linux kernel vulnerabilities, there is no heads-up to distributions"]]></title><description><![CDATA[
<p>> Without read permissions you cannot execute the binary<p>This is not correct, as when the binary is setuid-someone-else, <i>you</i> are not the one executing it; they are.<p><pre><code>  $ cat hello.c 
  
  #include <stdio.h>
  
  int main(void)
  {
      (void) puts("Hello, world!");
      return 0;
  }
  
  $ clang-21 -Weverything hello.c -o hello
  $ sudo chown root:root hello
  $ sudo chmod 4711 hello
  
  $ ls -l hello
  -rws--x--x 1 root root 16056 Apr 30 22:22 hello
  
  $ ./hello
  Hello, world!
  
  $ id
  uid=1000(aaron) gid=1000(aaron) groups=1000(aaron),27(sudo),46(plugdev),100(users)
</code></pre>
Removing world-readability from all setuid-root binaries on the system would be sufficient to kill the PoC script provided for this vulnerability. It would not be sufficient to prevent exploitation though; there are many ways to abuse the ability to write to files you have read access to in order to gain root, for example by using the vulnerability to alter the cached copy of a file in /etc/sudoers.d/, or overwrite /etc/passwd, or /etc/crontab, ... the list goes on.</p>
]]></description><pubDate>Thu, 30 Apr 2026 22:25:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=47969044</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47969044</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47969044</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Easyduino: Open Source PCB Devboards for KiCad"]]></title><description><![CDATA[
<p>A substantial portion of the things you need to know about layout are summarised quite nicely in the 4 YouTube videos in a previous comment of mine<p><a href="https://news.ycombinator.com/item?id=44549063">https://news.ycombinator.com/item?id=44549063</a><p>Note that the audio in the first video doesn't start until 40 seconds in.</p>
]]></description><pubDate>Tue, 28 Apr 2026 04:26:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=47930445</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47930445</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47930445</guid></item><item><title><![CDATA[New comment by aaronmdjones in "The electromechanical angle computer inside the B-52 bomber's star tracker"]]></title><description><![CDATA[
<p>... and yet on more than one occasion, pilots have taken off and prematurely retracted the flaps when they meant to retract the gear!<p>Humans fascinate me sometimes.<p><a href="https://assets.publishing.service.gov.uk/media/578defbae5274a0da900011c/Airbus_A320-214_G-EZTZ_08-16.pdf" rel="nofollow">https://assets.publishing.service.gov.uk/media/578defbae5274...</a><p><a href="https://assets.publishing.service.gov.uk/media/578def27ed915d3cfd000161/Airbus_A319-111_G-EZFA_08-16.pdf" rel="nofollow">https://assets.publishing.service.gov.uk/media/578def27ed915...</a><p>(Two separate incidents in the same year, on the same day, even)<p>EDIT: Updated links to point to incident reports</p>
]]></description><pubDate>Sat, 18 Apr 2026 20:47:39 +0000</pubDate><link>https://news.ycombinator.com/item?id=47819404</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47819404</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47819404</guid></item><item><title><![CDATA[New comment by aaronmdjones in "WireGuard makes new Windows release following Microsoft signing resolution"]]></title><description><![CDATA[
<p>> and had to go through the normal process?<p>There is no normal process. The error message clearly states "There are no appeals available, we have closed your application".<p>If the company makes it impossible for you to communicate with them, the only recourse is to draw public attention to it in order to shame them. This only works if you can gather enough public support and kick up enough of a stink about it. All of the small developers still locked out of their accounts are screwed.</p>
]]></description><pubDate>Fri, 10 Apr 2026 22:29:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=47724497</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47724497</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47724497</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Veracrypt project update"]]></title><description><![CDATA[
<p>The website formerly known as Twitter has never cared about the username part of the URI; it only looks at the status number and will redirect you to the canonical version if it wasn't.</p>
]]></description><pubDate>Wed, 08 Apr 2026 16:06:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=47692113</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47692113</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47692113</guid></item><item><title><![CDATA[New comment by aaronmdjones in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>> Answer #1: Many UK RCDs/RCBOs are actually single-pole devices and don't disconnect the neutral.<p>This is not correct; all type AC and type A RCDs used in British consumer units disconnect the neutral as well. Some RCBOs do not disconnect the neutral and this is a problem in some circumstances. The datasheet I linked for Wylex NHXS1 RCBOs explains that these ones do disconnect the neutral.<p>> Answer #2: It looks like some/many one-module wide UK RCBOs _do have_ electronics in them [...] but if backfed for longer than the disconnect time that might be enough to toast the solenoid or the driver<p>This is correct. For an example of this construction in an RCBO, see [1]. This illustrates that if the supply is connected to the "To Load" part of the schematic (toward the end of the video), as it would be if the supply is a solar PV inverter with battery storage, then it can continue powering the electronics and be shunted out by the thyristor after it has supposed to have tripped, very quickly burning itself out.<p>Bidirectional RCBOs are not designed in this manner. They have more complicated circuitry that makes them more expensive to manufacture, but are absolutely required in situations like this if you don't want your protective devices to burn and/or explode when they operate.<p>> Notably neither of these has anything to do with the direction of power flow.<p>Yes it does, because if the power is flowing backwards to how they designed it, <i>that is backfeeding it</i>, keeping its circuitry powered after it should have been disconnected.<p>[1] <a href="https://www.youtube.com/watch?v=8kWIITspYvk" rel="nofollow">https://www.youtube.com/watch?v=8kWIITspYvk</a></p>
]]></description><pubDate>Sat, 28 Mar 2026 17:55:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=47556848</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47556848</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47556848</guid></item><item><title><![CDATA[New comment by aaronmdjones in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>This is not an RCD, it's an RCBO. It combines the functions of an MCB (Miniature Circuit Breaker) and an RCD (Residual Current Device) in one device, as specified by BS EN 61009 (Residual Current Operated Circuit Breakers with Integral Overcurrent Protection).</p>
]]></description><pubDate>Sat, 28 Mar 2026 06:25:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=47552136</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47552136</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47552136</guid></item><item><title><![CDATA[New comment by aaronmdjones in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>Between the phasing out of analog meters (the latter half of the last century) and the introduction of smart meters (2010), a lot of electronic prepayment meters produced for the UK market would set a tamper flag if they detected power flowing backwards through them, as a proxy indication of an attempt at electricity theft. These meters will refuse top-ups in this condition, requiring you to contact your energy supplier to sort it out, leaving you without power until you do and then exposing you to scrutiny when they arrive.<p>Pre-smart non-prepayment electronic meters (for those with old meters, still submitting manual readings, and paying by direct debit) will be fine. Most of these meters, and all smart meters, are inherently bidirectional, because they maintain 4 counts (energy imported and energy exported, in kWh and kVARh) and your energy provider will do all the necessary math to figure out what to actually bill you for (residential customers are not billed for kVARh usage).<p>The UK government in 2011 announced plans to have 50 million smart meters installed by the end of 2020. In typical overpromise underdeliver government fashion, they didn't even achieve half of that; by then, only 23.6 million had been installed, and of those, 4.5 million had stopped working because they were initially (and stupidly) designed to be tied to a specific energy provider and the customer had changed provider. This even affected me.<p>Nevertheless they'd still accurately track energy consumption and export even if they'd lost their reporting capability, so you have nothing to fear here. This situation has been rectified at the redesign stage with provider-independent SMETS 2 meters, and all SMETS 1 meters still in service have been hotpatched to bring them into line (restoring their smart functionality regardless of provider).<p>Even today (well, as of last September), this number is only 40 million, with only 36.7 million of them actually working as designed (reporting readings automatically).<p>This leaves up to 16 million properties with a meter that may stop working and expose you to a theft investigation when you obtain generation capacity that even momentarily exceeds your usage (for example if you have a dual RCD board and one of the RCDs trips, taking out half of the circuits in your home, but not the one the inverter is plugged into).<p>Realistically the true figure is probably around a quarter of that; prepayment meters were very popular among the renting population of the time, and those who wanted to track their energy usage carefully and only pay for it with cash as and when needed, and sometimes people had these meters forced upon them by suppliers after the customer had demonstrated poor payment history, but they were far from the norm.<p>Average home owner buying plug-in solar at a supermarket isn't going to know or care about any of this. They'll just plug it in, and it will work, until one day maybe it doesn't and their supplier opens a theft investigation.</p>
]]></description><pubDate>Sat, 28 Mar 2026 06:22:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=47552122</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47552122</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47552122</guid></item><item><title><![CDATA[New comment by aaronmdjones in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>Yes they are. Current alternates direction, but power usually only flows in one direction, from the input terminal (from the bus bar) to the output terminal (that the circuit is wired into).<p>If the circuit will be supplying power too (e.g. battery storage, an EV and EVSE that supports powering the house from the EV, etc) then you need a bidirectional RCBO.<p>People with no differential fault protection need not worry about any of this, they'll just be killed when it goes badly wrong.<p>Source: Am a UK electrician<p>Example: <a href="https://assets.cef.co.uk/downloads/pdg/wylex_nhxs1b32_datasheet/wylex_nhxs1b32_datasheet.pdf" rel="nofollow">https://assets.cef.co.uk/downloads/pdg/wylex_nhxs1b32_datash...</a><p>EDIT: To say nothing of people with unidirectional electricity meters; plugging these into those setups will get them prosecuted for electricity theft. All SMETS 2 smart meters are bidirectional; you'd best check your meter if it isn't one of those.</p>
]]></description><pubDate>Fri, 27 Mar 2026 22:34:08 +0000</pubDate><link>https://news.ycombinator.com/item?id=47549272</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47549272</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47549272</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Supreme Court Sides with Cox in Copyright Fight over Pirated Music"]]></title><description><![CDATA[
<p>> > AI training might be copyright infringement. But there’s no cases or laws to establish that.<p>> In September 2025, Anthropic agreed to pay at least $1.5 billion to settle a class-action lawsuit over using roughly 500,000 copyrighted books from "shadow libraries" to train their Claude LLMs.<p>Yes, but not because they were training LLMs with it. The judge in the case found specifically that training the LLMs on the copyrighted material was <i>not</i> copyright infringement; the only copyright infringement Anthropic had committed was acquiring the material itself. In other words, if they had legally bought all of the books they used, they would have been able to train their LLMs on them with no recourse from rights holders.</p>
]]></description><pubDate>Thu, 26 Mar 2026 11:39:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=47529244</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47529244</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47529244</guid></item><item><title><![CDATA[New comment by aaronmdjones in "LaGuardia pilots raised safety alarms months before deadly runway crash"]]></title><description><![CDATA[
<p>I also drew parallels to the Uberlingen mid-aid collision, but for a different reason.<p>The mid-air collision occurred because the Russian air crew maneuvered contrary to their TCAS instruction (it commanded them to climb, the controller ordered them to descend). They were not trained that TCAS is the ultimate authority in this situation; it exists precisely because the controller has already failed in their separation duties, and if you have TCAS giving you a resolution advisory, your aircraft is no longer under ATC control and you must ignore any ATC instruction to the contrary. The other aircraft was correctly following its TCAS instruction (descending) because their crew was trained in this. Both planes descended and still hit each other.<p>In this case, KLGA has RWSLs (Runway Status Lights), including RELs (Runway Entrance Lights) on taxiways, that behave like traffic lights on roads. This too is completely automated and is the last-ditch resort for when a controller has already failed in their separation duties. This system processes transponder data of nearby aircraft and determines whether an aircraft is about to take off (is on the runway and accelerating) or land (is approaching the runway and descending). In either case the RELs go red automatically, and the controller cannot override this.<p>The driver of the ARFF probably [1] placed more emphasis on the controller's clearance to cross than the lights telling him to stay put, in exactly the same way that the Russian air crew placed more emphasis on the controller's instruction to descend than their TCAS instruction to climb, not realising that they were maneuvering contrary to the thing that exists specifically to prevent these accidents.<p>EDIT: I am not assigning blame to the controller here. They are human, and humans make mistakes. That's why these systems exist. Having one person handle an airport the size of KLGA is an accident waiting to happen.<p>[1] Obviously this is unknown at this point, and is something the NTSB will investigate. The system could have been down for maintenance for example.</p>
]]></description><pubDate>Tue, 24 Mar 2026 23:23:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=47511016</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47511016</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47511016</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Microsoft's "Fix" for Windows 11: Flowers After the Beating"]]></title><description><![CDATA[
<p>When I went to university 17 years ago, all of the computers (except the Macs) had dual-boot Windows 7 and Ubuntu 9.04.<p>I'll give you five guesses which OS I never booted into.</p>
]]></description><pubDate>Tue, 24 Mar 2026 14:46:21 +0000</pubDate><link>https://news.ycombinator.com/item?id=47503397</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47503397</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47503397</guid></item><item><title><![CDATA[New comment by aaronmdjones in "What makes Intel Optane stand out (2023)"]]></title><description><![CDATA[
<p>I have a 16 GiB Optane NVMe M.2 drive in my router as a boot drive, running OpenWRT.<p>It's so incredibly fast and responsive that the LuCI interface <i>completely</i> loads the moment I hit enter on the login form.</p>
]]></description><pubDate>Sun, 15 Mar 2026 17:24:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=47389565</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47389565</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47389565</guid></item><item><title><![CDATA[New comment by aaronmdjones in "I'm reluctant to verify my identity or age for any online services"]]></title><description><![CDATA[
<p>> Work? Online.<p>Presumably my place of employment would have already verified my identity when I started working for them.<p>> School? Online.<p>Ditto, and for kids enrolling during lockdown they wouldn't have any ID to hand over anyway.<p>> Recreational activities? Online.<p>> Talking to loved ones you don’t live with? Online.<p>> Birthday party? Online.<p>> Nonfood shopping? Online.<p>Doesn't need me to verify my identity.<p>> Banking?<p>Every bank I've ever interacted with has done this verification in-person.<p>> Paying taxes<p>The government already knows who I am and what I look like (by issuing the ID to me); this is fine.<p>> and bills?<p>Direct debit just has a sort code, account number, and name on the account. No verification of identity.<p>> Job interview?<p>I wouldn't think that a new employer would be verifying your identity until you actually get the job offer?<p>> Doctors appointment?<p>Doesn't need me to verify my identity to arrange it. I have to go there in person anyway, I can damn well show them my ID then.<p>> Dating? You guessed it, online.<p>Eh. This one is a grey area. I can see the desire to have members verify who they are. I've also seen how badly that can go wrong.</p>
]]></description><pubDate>Wed, 04 Mar 2026 00:07:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=47241055</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47241055</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47241055</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Raspberry Pi Pico 2 at 873.5MHz with 3.05V Core Abuse"]]></title><description><![CDATA[
<p>It's better with absolutely no cooling. It doesn't even consume (and thus dissipate) 100mW flat-out.</p>
]]></description><pubDate>Fri, 20 Feb 2026 14:37:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=47088559</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47088559</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47088559</guid></item><item><title><![CDATA[New comment by aaronmdjones in "Dark web agent spotted bedroom wall clue to rescue girl from abuse"]]></title><description><![CDATA[
<p>Generally speaking, there are two levels of crime in the US; misdemeanors and felonies. Both will land you with a criminal record, but a misdemeanor-only record will not show up on some standard background checks and does not remove your right to bear arms or vote, for example. Felonies are much more serious, and generally mandate a minimum prison sentence of 1 year unless plead down, while the sentencing for misdemeanors generally caps out at a year and typically just gets reduced to fines and community service, or a short stint (e.g. a couple weeks) in the local jail instead of a prison.<p>In some states, first offense non-violent felony convictions (e.g. exceeding the speed limit while fleeing police in a vehicle) can be expunged from your record when you turn 21 (if you were convicted and served out your sentence before turning 21). Otherwise felonies generally stay with you for life.</p>
]]></description><pubDate>Tue, 17 Feb 2026 13:22:57 +0000</pubDate><link>https://news.ycombinator.com/item?id=47047227</link><dc:creator>aaronmdjones</dc:creator><comments>https://news.ycombinator.com/item?id=47047227</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47047227</guid></item></channel></rss>