Hacker News: codedokode

New comment by codedokode in "GDID Windows – Cut the tracker that follows you even under VPN"

codedokode — Sun, 26 Jul 2026 22:47:16 +0000

The /proc contains too many unnecessary information, which can be used for fingerprinting or helping an attack. Run `ls /proc` and find yourself surprised. For example, why do applications need to know the kernel command line? What for? Why do they need the list of major and minor device numbers? List of filesystems? Network configuration?

So I want to follow the principle of minimal privileges and only grant access to files needed for running a program. Sadly many programs cannot run without /proc. For example, poorly coded Apple's Grand Central Dispatch library crashes the application (for example, Telegram) if it cannot enumerate the information about threads or processes. It needs this information to calculate how many additional worker threads need to be created, and if it cannot calculate the number, it terminates the application for reasons I do not understand.

There is also a catch that the program can create a new unprivileged user namespace and mount /proc there thus bypassing my daemon completely. Anyone can create a user namespace nowadays.

> Another option may be to set up a container or PID namespace and give your tool direct access to that /proc.

/proc contains information not only about processes, but a lot of extra information.

New comment by codedokode in "GDID Windows – Cut the tracker that follows you even under VPN"

codedokode — Sat, 25 Jul 2026 22:35:04 +0000

How do you write SELinux policies to allow reading only certain files in /proc, where process IDs are not known ahead? I ended up writing my own FUSE-based /proc emulation. The facilities are there, but it feels like writing your own OS.

New comment by codedokode in "GDID Windows – Cut the tracker that follows you even under VPN"

codedokode — Sat, 25 Jul 2026 22:22:51 +0000

They do not need this, they require you to create a Microsoft account to use your own computer (currently without a phone number, passport and selfie but that will probably change in the future).

New comment by codedokode in "GDID Windows – Cut the tracker that follows you even under VPN"

codedokode — Sat, 25 Jul 2026 22:20:04 +0000

Probably Windows constantly pings the MS server and they record those tuples.

New comment by codedokode in "GDID Windows – Cut the tracker that follows you even under VPN"

codedokode — Sat, 25 Jul 2026 22:11:33 +0000

Stopped using Windows in Windows 7 era, never regretted.

New comment by codedokode in "ARC-AGI Leaderboard"

codedokode — Sat, 25 Jul 2026 12:55:24 +0000

Why is there no Kimi 3, and GLM5.2 didn't run the third benchmark? I am more interested in knowing the abilities of open weight models.

New comment by codedokode in "“We have information that Moonshot distilled Fable for the development of K3”"

codedokode — Wed, 22 Jul 2026 17:42:21 +0000

Do you by chance also have information about Anthropic's training data sources?

New comment by codedokode in ""We have information that Moonshot distilled Fable for the development of K3""

codedokode — Wed, 22 Jul 2026 17:35:55 +0000

Smartphones are mostly Chinese now (except for iPhones and Samsung).

New comment by codedokode in "Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber"

codedokode — Tue, 21 Jul 2026 20:27:23 +0000

> Domestic China is the only very large audience for their own models

I don't think so. US models are very expensive, and not available in every country. I am not willing to pay $50/1M tokens for writing my pet projects.

New comment by codedokode in "I found a WordPress RCEs with GPT5.6 and $25"

codedokode — Tue, 21 Jul 2026 19:59:15 +0000

But in a safe manner.

New comment by codedokode in "Who's afraid of Chinese models?"

codedokode — Tue, 21 Jul 2026 13:32:57 +0000

Cannot non-Chinese closed weights model do the same?

New comment by codedokode in "China's open-weights AI strategy is winning"

codedokode — Mon, 20 Jul 2026 15:36:08 +0000

If a developer in your company named functions like this, what would you say?

New comment by codedokode in "China’s open-weights AI strategy is winning"

codedokode — Mon, 20 Jul 2026 15:33:38 +0000

And to provide "correct" answers to questions like "island of Taiwan belongs to which country". It seems that there is not single agreed point of view on national borders.

New comment by codedokode in "Hacker wipes Romania's land registry database"

codedokode — Mon, 20 Jul 2026 15:21:25 +0000

Blockchain is unnecessary complicated, for example, it has mining, rewards for those who add new records, even VM and scripts and all of these are not needed for a government registry. I do not need scripts within a land registry.

New comment by codedokode in "Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25"

codedokode — Mon, 20 Jul 2026 15:17:24 +0000

It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.

New comment by codedokode in "I found a WordPress RCEs with GPT5.6 and $25"

codedokode — Mon, 20 Jul 2026 15:14:30 +0000

One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

New comment by codedokode in "Hacker wipes Romania's land registry database"

codedokode — Mon, 20 Jul 2026 15:05:28 +0000

If every notary is a node, you need some mechanism to ensure they perform only legitimate transactions and constantly monitor them. It is easier to just have a central authority.

New comment by codedokode in "Hacker wipes Romania's land registry database"

codedokode — Mon, 20 Jul 2026 15:02:00 +0000

It doesn't matter, it's a dumb idea anyway because there is a central authority managing the land registry and there is no need for anyone else to be involved.

Also, SQL database is much more convenient to use, it has query language and indices unlike a blockchain.

New comment by codedokode in "Hacker wipes Romania's land registry database"

codedokode — Mon, 20 Jul 2026 15:00:17 +0000

No. Blockchain is made for managing transactions between untrusted parties. In case with a land, there is an authority managing the registry, so a standard relational DB (with optional digital signatures) is the bets option. Why someone wants to use a tool, not good for a specific purpose, for that exact purpose?

New comment by codedokode in "Hacker wipes Romania's land registry database"

codedokode — Mon, 20 Jul 2026 14:54:36 +0000

So that 50% attack results in someone taking all the land? No thanks.

It is a poor idea to use blockchain for government registries. If you want transparency, simply publish signed daily updates and that's enough. Just use simple DB with backups, and optionally, a printer printing changes on a paper.