Hacker News: derekerdmann

New comment by derekerdmann in "Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry."

derekerdmann — Fri, 23 Oct 2026 00:48:42 +0000

That approach to disclosure is about discovering vulnerabilities. Talking about something with a published CVE isn't really comparable.

New comment by derekerdmann in "US man given prison sentence for bot-farming music streams"

derekerdmann — Thu, 08 Oct 2026 20:00:57 +0000

> What crime did he actually commit?

Fraud. https://xkcd.com/1494/

New comment by derekerdmann in "Removable batteries in smartphones will be mandatory in the EU starting in 2027"

derekerdmann — Mon, 04 May 2026 17:55:19 +0000

No. Bought in person at a Walmart in like, 2005

New comment by derekerdmann in "Removable batteries in smartphones will be mandatory in the EU starting in 2027"

derekerdmann — Mon, 04 May 2026 16:04:23 +0000

I once had a cheap Timex watch die from water ingress after running a track workout during a torrential downpour. At the time I joked that it only failed because we ran farther than the 100m rating

New comment by derekerdmann in "ICAO issued new power bank restriction on flight"

derekerdmann — Sat, 28 Mar 2026 17:51:06 +0000

Not really, even Anker recalled a huge number of power banks last year: https://www.cpsc.gov/Recalls/2025/Anker-Power-Banks-Recalled...

New comment by derekerdmann in "TPM on embedded systems: Pitfalls and caveats to watch out for"

derekerdmann — Wed, 21 Jan 2026 16:17:56 +0000

If I remember correctly it's up to the client program to set up the session, not something to do with the vendor's implementation. It's conceptually similar to how an HTTPS client performs a TLS handshake after opening a socket before it can work with plain HTTP content.

New comment by derekerdmann in "Dumping Memory to Bypass BitLocker on Windows 11"

derekerdmann — Mon, 30 Dec 2024 21:54:01 +0000

Correct, unless you're using a self-encrypting drive the FVEK sits in RAM once it's been released by the TPM during boot. The TPM is only a root of trust; for fast crypto operations without keeping the key in kernel memory you would need something like Intel SGX or ARM TrustZone.

New comment by derekerdmann in "Music and Geometry: Intervals and Scales"

derekerdmann — Fri, 20 Dec 2024 17:31:09 +0000

Take a look at Fretboard Theory by Desi Serna - it spends a lot of time on how different scales are constructed and relating different patterns and chord forms back to the underlying concepts.

New comment by derekerdmann in "Apple Hearing Study shares preliminary insights on tinnitus"

derekerdmann — Mon, 09 Sep 2024 19:37:25 +0000

It’s self-oscillating

New comment by derekerdmann in "Never ask a candidate to rate themselves out of 10"

derekerdmann — Mon, 08 Jul 2024 18:40:45 +0000

When someone asks you if you're a god, you say, "yes!"

New comment by derekerdmann in "Static Analysis Tools for C"

derekerdmann — Thu, 26 Oct 2023 13:40:39 +0000

Static analyzers are NOT formal methods. Reporting no issues just means your tool didn’t find anything, not that your program is correct.

New comment by derekerdmann in "LackRack: IKEA's cheapest table is perfectly sized to rackmount computers (2020)"

derekerdmann — Fri, 19 Aug 2022 14:21:48 +0000

> Is rackmount equipment cheaper than regular consumer PC hardware?

Never

New comment by derekerdmann in "Wi-Fi packet capturing on M1 Macs is broken"

derekerdmann — Thu, 29 Apr 2021 22:17:19 +0000

> 1. Packet captures don’t use the correct channel

I've also seen this on a 2020 Intel MacBook Air. I assumed it was a Big Sur issue but had never tried it on Catalina.

Sniffing from the command line did pick up the correct channel: https://unix.stackexchange.com/a/49317/36875

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

derekerdmann — Wed, 21 Apr 2021 16:29:45 +0000

Article URL: https://signal.org/blog/cellebrite-vulnerabilities/

Comments URL: https://news.ycombinator.com/item?id=26891811

Points: 1897

# Comments: 332

New comment by derekerdmann in "The eleven nations of the United States and their cultures"

derekerdmann — Fri, 06 Dec 2019 14:53:57 +0000

Greater Appalachia definitely extends through PA in a T shape across the center of the state and the northern border (sometimes called Pennsyltucky) and covers at least the Southern Tier in New York.

New comment by derekerdmann in "Ways to Get Better at C++"

derekerdmann — Fri, 23 Jun 2017 16:52:28 +0000

Effective Modern C++ by Scott Meyers

New comment by derekerdmann in "A Cosmic Burst Repeats, Deepening a Mystery"

derekerdmann — Tue, 18 Apr 2017 23:26:07 +0000

"the FRBs were as blinding as flash grenades in a dark forest"

Just that much should be terrifying for anyone who's read The Three-Body Problem and its sequels.

New comment by derekerdmann in "Users Have Been Betrayed in the Final TPP Deal"

derekerdmann — Mon, 05 Oct 2015 20:08:22 +0000

I'm not convinced this analysis is reading the draft fairly:

... if you need to circumvent a DRM for personal use, you are now liable for criminal penalties. Traditionally, for many jurisdictions, circumventing DRM is typically reserved for civil penalties. Criminal penalties implies that the government would foot the bill for enforcement. In civil cases, it is typically rights holders that go after individuals."

Except that here's the actual text:

> Each [7] Party [US/SG/MX/NZ/PE/JP/BN/AU/CL/MY propose: shall] [CA propose: may] provide for criminal procedures and penalties to be applied where any person is found to have engaged willfully and for purposes of commercial advantage or financial gain in any of the above activities.

That doesn't sound like "if you need to circumvent a DRM for personal use, you are now liable for criminal penalties" to me.

New comment by derekerdmann in "The FBI Can Bypass Encryption [pdf]"

derekerdmann — Fri, 31 Oct 2014 07:07:08 +0000

That is not what the linked patent describes. In that patent, the base key in the hierarchy (the one created by the administrator, NOT the storage root of trust or SRK) is created outside the TPM and stored elsewhere, then imported and used. If the TPM is cleared or reset, then loading the key will fail and the base key will need to be imported again.

Creating key hierarchies under the SRK that can be duplicated or moved is actually very clearly specified in the TPM 2.0 spec, and is at least partially meant for exactly this sort of recovery process. The seed that's used to derive the SRK itself will still never leave the TPM, so any keys that are in a separate hierarchy under the SRK (instead of the imported base key) are still secure.

https://www.trustedcomputinggroup.org/resources/tpm_20_libra...

New comment by derekerdmann in "Gradually sunsetting SHA-1"

derekerdmann — Sat, 06 Sep 2014 19:14:20 +0000

This is something Linus addressed quite a while ago: http://lwn.net/Articles/132513/