Hacker News: ash

New comment by ash in "Cloudflare Meerkat - Globally distributed consensus"

ash — Wed, 08 Jul 2026 16:00:17 +0000

2 out of 3 meerkats look in the same direction. Enough for consensus.

New comment by ash in "Google Hits 50% IPv6"

ash — Sun, 21 Jun 2026 10:01:39 +0000

It is harder to maintain two networks instead of one. Potential problems double. Hacks like RFC8305 "Happy Eyeballs" become a must.

New comment by ash in "Google Hits 50% IPv6"

ash — Sun, 21 Jun 2026 09:58:45 +0000

Unfortunately, individual actions would never be enough to solve the IPv6 chicken and egg problem. See djb's "IPv6 mess" article:

https://cr.yp.to/djbdns/ipv6mess.html

Yes, it is old, many examples are outdated, but the main points still hold. Decades later his suggestions for making IPv6 succeed are still not implemented.

Next.js and the corrupt middleware: the authorizing artifact

ash — Sun, 23 Mar 2025 07:57:40 +0000

Article URL: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

Comments URL: https://news.ycombinator.com/item?id=43451485

Points: 94

# Comments: 36

New comment by ash in "Tailscale is pretty useful"

ash — Wed, 05 Mar 2025 20:59:46 +0000

Have you tried "Smaller binaries" instruction? https://tailscale.com/kb/1207/small-tailscale

Ladybird browser update (January 2025) [video]

ash — Mon, 03 Feb 2025 23:36:27 +0000

Article URL: https://www.youtube.com/watch?v=-l8epGysffQ

Comments URL: https://news.ycombinator.com/item?id=42924950

Points: 46

# Comments: 1

New comment by ash in "OpenAUTH: Universal, standards-based auth provider"

ash — Thu, 19 Dec 2024 10:34:08 +0000

The article by Ory's Aeneas Rekkas perfectly describes OAuth / OIDC problems. The only thing it misses is the suggestion for the alternative protocol for first-party auth. It does suggest that it's preferable to use simpler systems like Ory Kratos. But OAuth / OIDC is a set of protocols, not an implementation. Is there an a effort to specify simple auth protocol, when third-party auth is not needed?

New comment by ash in "OpenAUTH: Universal, standards-based auth provider"

ash — Wed, 18 Dec 2024 00:55:07 +0000

Less secure that HttpOnly cookies, which are not accessible by third-party JavaScript. LocalStorage also doesn't have automatic expiration.

New comment by ash in "OpenAUTH: Universal, standards-based auth provider"

ash — Wed, 18 Dec 2024 00:48:32 +0000

Cool project!

OAuth-based auth providers are nice, but they can have a weakness. When you have just one app, OAuth can be overkill: protocol is complex, and users suffer jarring redirects¹.

This is not surprising, because OAuth / OIDC is fundamentally designed for (at least) three parties that don't fully trust each other: user, account provider and an app². But in a single app there are only two parties: user and app itself. Auth and app can fully trust each other, protocol can be simpler, and redirects can be avoided.

I'm curious what OpenAUTH authors think about it.

¹ Except for Resource Owner Password Credentials (ROPC) grant type, but it's no longer recommended: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...

² In addition, OAuth is mostly designed for and by account providers, and follows their interests more than interests of app developers.

New comment by ash in "Is String Theory dead? [video]"

ash — Sun, 15 Dec 2024 22:50:06 +0000

Thank you! The video is a criticism of that article.

Is String Theory dead? [video]

ash — Sun, 15 Dec 2024 22:36:41 +0000

Article URL: https://www.youtube.com/watch?v=8JYwmxZBjZQ

Comments URL: https://news.ycombinator.com/item?id=42426474

Points: 3

# Comments: 2

This Month in Ladybird – November 2024

ash — Sun, 01 Dec 2024 10:15:35 +0000

Article URL: https://ladybird.org/newsletter/2024-11-30/

Comments URL: https://news.ycombinator.com/item?id=42287503

Points: 4

# Comments: 0

New comment by ash in "The Case Against Quantum Computing (2018)"

ash — Thu, 21 Nov 2024 15:00:58 +0000

As someone outside of the field I don't follow your argument. The author stated that the problem is not just in the analog nature of quantum computer, but in the impossibly large amount of analog parameters to process and also to correct errors in.

New comment by ash in "The Case Against Quantum Computing (2018)"

ash — Thu, 21 Nov 2024 14:22:07 +0000

Interesting observation about the maximum lifetime of a bubble:

> I believe that, appearances to the contrary, the quantum computing fervor is nearing its end. That's because a few decades is the maximum lifetime of any big bubble in technology or science. After a certain period, too many unfulfilled promises have been made, and anyone who has been following the topic starts to get annoyed by further announcements of impending breakthroughs. What's more, by that time all the tenured faculty positions in the field are already occupied. The proponents have grown older and less zealous, while the younger generation seeks something completely new and more likely to succeed.

New comment by ash in "The Case Against Quantum Computing (2018)"

ash — Thu, 21 Nov 2024 14:19:50 +0000

> That IEEE published this surprises me

I find your reaction to be a positive sign. The sign that IEEE is willing to push envelope of knowledge (as of 2018). One can't push it without taking a risk of publishing something wrong, possibly very wrong.

I don't have any opinion on this topic, it's not my field of expertise. However, it's the first semi-technical article about quantum computing that I can follow along and understand.