Hacker News: drnick1

New comment by drnick1 in "Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware"

drnick1 — Mon, 27 Jul 2026 23:34:58 +0000

That's nice, but a cell phone isn't a viable gaming platform for anything but very basic games. And Android, at least in its typical Googled form, has its own set of problems; it's a privacy nightmare.

New comment by drnick1 in "Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware"

drnick1 — Mon, 27 Jul 2026 23:28:36 +0000

I sandbox Steam itself for simplicity. My experience with Nvidia and Wayland has been good. I simply exposed /dev/nvidia*, a few networking-related files in /etc and system binaries like /usr.

New comment by drnick1 in "Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware"

drnick1 — Mon, 27 Jul 2026 23:17:27 +0000

Dedicated hardware is definitely the most secure option, but realistically it is even less convenient than a separate user. You can't realistically play graphically intensive games on a Deck, and separate workstations are very unaffordable at the moment.

New comment by drnick1 in "Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware"

drnick1 — Mon, 27 Jul 2026 22:56:09 +0000

This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I adopted on my gaming PC is to bubblewrap Steam. Do not mount things like /home and devices games should not be using in the sandbox.

New comment by drnick1 in "Securing Services with Rootless Containers"

drnick1 — Mon, 27 Jul 2026 22:42:25 +0000

Rootless is definitely the way to go. You can forward ports manually on the host if you really need to use privileged ports. I generally expose my containers through a reverse proxy, running bare metal on the host, and that completely bypasses the privileged port issue.

New comment by drnick1 in "Google Chrome Arrives on ARM64 Linux, Widevine DRM Included"

drnick1 — Mon, 27 Jul 2026 19:28:25 +0000

> Firefox supports Widevine Level 1 on Windows 11 devices with the requisite hardware and has for a year or so.

I am not familiar with the way Widevine works, but if that is true, there must be a way to hack that support into the Linux version. After all, the code is there and it should be possible to spoof hardware identifiers or whatever is needed to run Widevine on an open platform.

New comment by drnick1 in "Show HN: CheapSecurity – Lightweight, Self-Hosted CCTV for Linux SBCs"

drnick1 — Sun, 26 Jul 2026 22:48:59 +0000

I am not familiar with this particular project, but generally speaking, you don't want a USB camera for CCTV. You want an IP camera with POE and RTSP support.

New comment by drnick1 in "Kill The Cookie Banner"

drnick1 — Sun, 26 Jul 2026 19:18:21 +0000

I think so yes, but Firefox is probably still better.

New comment by drnick1 in "Show HN: CheapSecurity – Lightweight, Self-Hosted CCTV for Linux SBCs"

drnick1 — Sun, 26 Jul 2026 18:54:01 +0000

What is the difference between this and Frigate? Before clicking the link, I thought this would be a hardware solution (build you own camera from open components).

New comment by drnick1 in "Lidl Introduces the European Payment Method Wero in Germany"

drnick1 — Sun, 26 Jul 2026 18:47:57 +0000

But this system is probably tied to Google and Apple's "device attestation." Don't worry, it's in the name of security!

New comment by drnick1 in "GrapheneOS protections against data extraction from locked devices"

drnick1 — Sun, 26 Jul 2026 16:39:03 +0000

> I am wary that I could be targeted at a border just for having a google pixel with grapheneOS.

Is that likely to happen at all in a civilized (Western) country?

New comment by drnick1 in "GrapheneOS protections against data extraction from locked devices"

drnick1 — Sun, 26 Jul 2026 16:32:44 +0000

You can already do most of that with GrapheneOS or even an iPhone. My contacts, files, photos, etc. are on my home server, accessed through a VPN. My GrapheneOS phone only runs a handful of open source apps. If I were to lose the phone, I would simply revoke the Wireguard key and there wouldn't be anything valuable left on it.

New comment by drnick1 in "GrapheneOS protections against data extraction from locked devices"

drnick1 — Sun, 26 Jul 2026 16:21:06 +0000

Apple can at any time push a hostile "upgrade" that will remove or disable the claimed security features. You don't control the operating system, and can't trust that it isn't backdoored, especially given Apple's record[0].

[0] https://en.wikipedia.org/wiki/PRISM

New comment by drnick1 in "Kill The Cookie Banner"

drnick1 — Sun, 26 Jul 2026 16:07:13 +0000

uBlock Origin with all "annoyance" filters enabled. I haven't seen a cookie banner in years.

Another good one to have the "hide Youtube shorts" filter, featured on HN a while back.

New comment by drnick1 in "A 77-year-old Republican man is staging a solo protest against Flock cameras"

drnick1 — Sat, 25 Jul 2026 22:06:10 +0000

A sledgehammer would be a better solution.

New comment by drnick1 in "Open-weight AI is having its Kubernetes moment"

drnick1 — Sat, 25 Jul 2026 21:57:04 +0000

> Chinese release open models to drive the state of the art

Are you sure it isn't just another form of Chinese industrial policy? China does not have frontier labs, but through distillation and their own work they can get pretty close. It's not enough to be competitive with Anthropic and OpenAI, but there is still money to be made by selling compute (software as a service), and in any case it's better than being left behind in the AI race.

New comment by drnick1 in "Open-weight AI is having its Kubernetes moment"

drnick1 — Sat, 25 Jul 2026 19:58:06 +0000

> American labs need to release frontier-grade open-weight models under licenses that startups can actually build on.

To be fair, OpenAI has released a couple of (then very good) OSS models. I run the 20B version at home and it is excellent for reviewing text and common tasks like drafting bash scripts. There is a larger 120B that you can't realistically run on consumer hardware at reasonable tok/s too. I wish OpenAI updated these models more frequently though.

New comment by drnick1 in "Self-host your mail server"

drnick1 — Sat, 25 Jul 2026 00:39:32 +0000

I also self-host, and it's not nearly as difficult as know-it-all people on the Internet make it out to be. I rolled things out from scratch using Postfix and Dovecot on Debian as I dislike bloated and opaque containers that hide important decisions from the sysadmin. The main requirements are a clean, fixed IPv4 and an aged domain.

Absolutely zero maintenance has been required since I set it up (unattended upgrades), until recently when Dovecot updated the configuration syntax. Claude ported the config script to the new syntax in about 2min.

New comment by drnick1 in "Nvidia, Microsoft, Meta warn against overregulating open-weight models"

drnick1 — Fri, 24 Jul 2026 21:19:17 +0000

We are talking about the U.S. here, and no, 40k or 55k are not good salaries at all. It may be OK in Europe with the lower cost of living, etc., but the price of a new car is 50k in 2026, and a basic fast food meal pretty much anywhere is well north of $10.

New comment by drnick1 in "IRGC claims it destroyed Amazon's Bahrain data center"

drnick1 — Fri, 24 Jul 2026 17:50:01 +0000

Germany and Japan surrendered and have done pretty well since.