Hacker News: arcfour

New comment by arcfour in "US FAA says it will phase out floppy disks from air traffic control by 2028"

arcfour — Sat, 07 Nov 2026 01:56:58 +0000

This is just flatly false. You're comparing a worst case SSD with maybe 10% of its writes left to an extremely lucky floppy disk that hasn't died to binder hydrolysis, mold and fungal growth, warping or demagnetization. And you also completely made up that you couldn't generate a strong enough magnetic field at home to corrupt one - you absolutely could especially since rare earth magnets are not that uncommon and are more than enough to kill a floppy.

New comment by arcfour in "Restaurant Delivery Payment-Skimming Campaign"

arcfour — Sat, 07 Nov 2026 01:45:17 +0000

> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.

This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.

I don't know where you got your information from but it's quite literally the opposite of reality.

Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.

New comment by arcfour in "So my ISP was hijacking my DNS"

arcfour — Thu, 05 Nov 2026 19:51:51 +0000

I would argue that knowing you are visiting a top 10k site is less valuable than... All other sites.

Also that was last updated 6 months ago...

New comment by arcfour in "So my ISP was hijacking my DNS"

arcfour — Thu, 05 Nov 2026 07:08:24 +0000

> Although your regular internet traffic is encrypted with TLS, your ISP can see the hostname during the TLS handshake (SNI).

https://support.mozilla.org/en-US/kb/understand-encrypted-cl... not anymore, with many (not all) sites.

New comment by arcfour in "Insects don't swarm at LED lights"

arcfour — Wed, 04 Nov 2026 21:02:55 +0000

Pesticides weren't in use 20-30 years ago? Wouldn't more dangerous pesticides have been in use then, too, compared to now?

New comment by arcfour in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

arcfour — Wed, 28 Oct 2026 11:16:02 +0000

I swear I have seen plenty of PCs attempt a PXE boot before failing and continuing on to the next boot option. It probably isn't the default for most "personal" machines but... That's not really a guarantee I would want to hang my hat on...

New comment by arcfour in "Code-execution flaw in UEFI firmware threatens most servers on planet Earth"

arcfour — Wed, 28 Oct 2026 11:14:09 +0000

You need to compile a device tree for every single device you want to support individually, whereas x86 has ACPI to avoid that mess. ACPI is its own mess, yes. And UBoot is great. But it isn't a standalone replacement for a unified firmware interface/"BIOS"/whatever.

New comment by arcfour in "AI promised less work. I've never worked more"

arcfour — Tue, 27 Oct 2026 13:13:34 +0000

It would be even nicer to be carried by a bunch of servants and fed exotic fruits and not have to work, too, but isn't comparison the thief of joy?

New comment by arcfour in "AI promised less work. I've never worked more"

arcfour — Tue, 27 Oct 2026 13:12:34 +0000

Seems excessively pessimistic.

New comment by arcfour in "GPT-6.1 Terra"

arcfour — Tue, 27 Oct 2026 04:43:08 +0000

Probably never? Unless they get super far out of sync, a "medium" model just isn't the right choice for a "large" (or "extra large") model task.

New comment by arcfour in "GPT-6.1 Terra"

arcfour — Tue, 27 Oct 2026 03:53:06 +0000

I use Sol 6.4 because it's newer (and "big") unless there is a specific benchmark that 6.1 Astra scores better on that I think I need.

Or I might try both and pick whichever I prefer for a given task...

New comment by arcfour in "There isn't an easy exploit for this PHP vulnerability"

arcfour — Thu, 22 Oct 2026 07:44:01 +0000

So I have been failing to do half of my career this whole time?

The people you hear from are famous personalities... That's the nature of being a famous personality. There are plenty of us who are just normal people with opinions of our own and no desire to cultivate a public name or face for ourselves...

New comment by arcfour in "eMudhra intermediate CA compromise"

arcfour — Tue, 20 Oct 2026 17:14:33 +0000

Rare in public PKIs, yes; not so much in private ones, I would imagine.

From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually!

- OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/

- GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API...

- go (crypto/x509) supports everything except DirectoryName constraints, https://pkg.go.dev/crypto/x509#Certificate.Verify

- Python (pyca/cryptography) has full support, https://cryptography.io/en/stable/x509/reference/#cryptograp...

- Windows/Schannel has full support, https://learn.microsoft.com/en-us/windows/win32/seccertenrol...

- Java has full support, https://docs.oracle.com/en/java/javase/21/docs/api/java.base...

- I know that NSS also supports them from experience but (sorry!) couldn't find the docs in a few seconds of searching

- I know that Strongswan supports them well because I actually opened an issue about it a few years back and got it fixed :-)

(Just a few off the top of my head)

New comment by arcfour in "eMudhra intermediate CA compromise"

arcfour — Tue, 20 Oct 2026 16:05:09 +0000

It doesn't have to, you can set X509 name constraints which say "the CA may only issue/may not issue certificates for these Subjects," or you can set CAA in DNS, for example.

(Of course, the former isn't really intended to constrain trusted Root CAs, moreso internal PKIs. But it is an option people should know about!)

New comment by arcfour in "Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware"

arcfour — Sat, 17 Oct 2026 10:35:52 +0000

Would be nice if we could choose, say, multiple 4090s or otherwise customize the configuration (or maybe I just missed the button for that?)

New comment by arcfour in "Claude reveals ECDSA curve origins"

arcfour — Fri, 16 Oct 2026 21:10:49 +0000

Why would you be blocked? I cannot imagine why you would be for this specific task unless the supposed backdoor turned out to be real.

New comment by arcfour in "Wanted to download an ISO, ended up writing a kernel exploit"

arcfour — Thu, 15 Oct 2026 08:15:49 +0000

I am in CVP too as I have worked professionally as a security engineer for various reputable companies for almost 10 years now and I got refusals to reverse engineer MS-DOS malware from 1994 because Anthropic has placed a blanket ban on reverse engineering any malware at all. Even the model would admit that was ridiculous.

OpenAI has no such restriction and I don't even need to use my Daybreak access, either, to analyze modern malware samples.

It's asinine, truly.

New comment by arcfour in "Zod 4.6.6 compromised by malware?"

arcfour — Mon, 12 Oct 2026 12:34:53 +0000

This happened 3 weeks ago and no release was published on NPM containing the code.

New comment by arcfour in "Zod 4.6.6 compromised by malware?"

arcfour — Mon, 12 Oct 2026 12:32:21 +0000

A very pertinent comment from zod's maintainer, from that page:

> EDIT Sept 24 — All of my packages on npm have migrated to use environment-scoped staged publishing triggerable only by workflow_dispatch. This means 2FA is always required, so even if (god forbid) an npm or GitHub token is compromised, it will not be possible for the attacker to publish new versions.

So at least that's good to see. It would be nice for them to actually remove the commit from git history, though...

New comment by arcfour in "Zod 4.6.6 compromised by malware?"

arcfour — Mon, 12 Oct 2026 12:28:32 +0000

He is (evidently) the product manager of NPM, so while external, I guess he should have a good idea of what's going on. Claude generated, yes, appears so, though it appears to be factually correct and fairly brief, from my quick perusal.