Hacker News: evan_a_a

New comment by evan_a_a in "Telegram Desktop vulnerability allowed any user's file to be stolen"

evan_a_a — Sat, 10 Oct 2026 22:35:32 +0000

>But I'm not aware of a messenger that provides a good UX for that

WhatsApp is the largest messaging app in the world (3B MAU) and does E2EE by default across private chats and groups.

New comment by evan_a_a in "GPT-Synopsys: Frontier Intelligence to Revolutionize Chip Design"

evan_a_a — Thu, 01 Oct 2026 17:22:51 +0000

Physical design (what this seems to be targeting) already uses non-deterministic algorithms because floorplanning, placement, and routing are all difficult problems to solve with a deterministic algorithm. Introducing probabalistic approaches helps to find the right fit within the constraints.

New comment by evan_a_a in "Building a certificate authority for the whole Internet"

evan_a_a — Tue, 29 Sep 2026 19:04:06 +0000

There are a whole host of controls in place to mitigate this risk. Plus such an acquisition wouldn't be easy to keep secret, so as soon as an untrusted actor acquired control over a root, the CAB would likely immediately distrust the cert.

https://cabforum.org/working-groups/server/baseline-requirem...

New comment by evan_a_a in "U.S. State Department pauses immigrant visa applications"

evan_a_a — Thu, 27 Aug 2026 15:55:14 +0000

A green card is permanent residency, not a visa process.

New comment by evan_a_a in "The University as We Know It Is Finished"

evan_a_a — Fri, 21 Aug 2026 02:08:02 +0000

>>Professors should teach about AI, include how to prompt efficiently and how to critically scrutinize the output

>100% agree, as with any important technology. But this is just a small curriculum change, just one more topic to cover in the lecture, and maybe a class.

Critically scrutinizing LLM output is just critical thinking skills, something universities should already teach.

New comment by evan_a_a in "Universal health coverage could save $1T and 114k lives a year: study"

evan_a_a — Wed, 19 Aug 2026 04:34:55 +0000

Healthcare worker shortages are a problem in the US and other developed countries with universal systems. The type of system doesn't really influence the waiting time.

New comment by evan_a_a in "Flock impersonates journalist in order to cancel his hotel reservations"

evan_a_a — Tue, 18 Aug 2026 22:34:31 +0000

That comes with a contract between the hotel and the block holder.

New comment by evan_a_a in "Flock impersonates journalist in order to cancel his hotel reservations"

evan_a_a — Tue, 18 Aug 2026 22:06:17 +0000

If the journalist really did make a reservation under the room block for the event, and then was denied attendance to the event, it would seem fairly normal for the reservation to be canceled by the block holder.

Really, if the journalist wanted to cover the event without being noticed he could've done so undercover.

New comment by evan_a_a in "Illinois just told every operating system to start reporting your kid's age"

evan_a_a — Sun, 09 Aug 2026 14:19:35 +0000

Encryption does not ensure data integrity, sigh...

New comment by evan_a_a in "What happens if an entire class of workers loses faith in their careers"

evan_a_a — Sun, 09 Aug 2026 13:51:58 +0000

Translator jobs aren't really getting wiped out according to the stats (in the US). Growth is still projected at 2% in the next 10 years.

They also have this to say about AI:

>Computer tools, including artificial intelligence (AI), are making the work of translators and localization specialists more efficient. However, many of these jobs cannot be entirely automated because computers cannot yet produce work comparable to what human translators do in most cases.

https://www.bls.gov/ooh/media-and-communication/interpreters...

New comment by evan_a_a in "US strikes $1.2B deal to pay German firm to halt offshore wind projects"

evan_a_a — Fri, 07 Aug 2026 11:52:30 +0000

They've been in a stop work since April 2025 so that buildup is likely all gone or already reallocated.

https://www.reuters.com/sustainability/climate-energy/rwe-ha...

New comment by evan_a_a in "US strikes $1.2B deal to pay German firm to halt offshore wind projects"

evan_a_a — Fri, 07 Aug 2026 11:46:39 +0000

They'll certainly continue wind projects, just not likely in the US and not with this money.

New comment by evan_a_a in "US strikes $1.2B deal to pay German firm to halt offshore wind projects"

evan_a_a — Fri, 07 Aug 2026 11:20:46 +0000

>RWE said that it will now reinvest the sum into conventional gas projects, including $900m (£669m) in a liquefied natural gas (LNG) export terminal project in Louisiana.

New comment by evan_a_a in "How to think about software quality (2022)"

evan_a_a — Wed, 29 Jul 2026 21:24:29 +0000

If the design is so inflexible that a single requirement shift destroys it, then it wasn't a good design.

New comment by evan_a_a in "Ubuntu's TPM encryption switches to snap kernel that blocks deb kernel packages"

evan_a_a — Wed, 29 Jul 2026 17:03:54 +0000

This is contingent on the sealing policy including PCRs that would change as a result of booting a different operating system, like PCR 11, which, when booting a UKI, contains those measurements. Only sealing against PCR 7 would allow this attack, since the default platform secure boot policy would not need to change.

New comment by evan_a_a in "Ubuntu's TPM encryption switches to snap kernel that blocks deb kernel packages"

evan_a_a — Tue, 28 Jul 2026 22:28:22 +0000

The keys can be indirectly sealed against specific system and software configurations such that this attack is not possible. Additionally, as you noted, using custom secure boot keys would prevent the attacker from booting an arbitrary OS.

New comment by evan_a_a in "Ubuntu's TPM encryption switches to snap kernel that blocks deb kernel packages"

evan_a_a — Tue, 28 Jul 2026 19:07:20 +0000

The disk encryption key(s) isn't typically stored in the TPM, it is sealed by the TPM. A sealed key can only be unsealed if the TPM is in the same state as it was sealed against (simplifying some things here). With the proper selection of Platform Configuration Registers (PCRs), this can prevent the key from being unsealed if the system has not securely booted (sealed against PCR 7). In more complicated configurations, it is also possible to seal the key against a particular phase of boot such that it can't be unsealed once userspace is reached.

In your scenario, yes it is bad if the attacker gets root on your computer, but sealing the key with the TPM means they can't retrieve the key itself. Where the TPM helps is preventing the attacker from establishing low level (kernel, bootloader, or firmware) persistence, since modifications of these components would change the TPM PCR measurements and result in a boot failure.

If the attacker is local and they reset the UEFI, the TPM PCRs are now different and as before, the disk encryption keys will not unseal.

It is also generally recommended to use a pin with TPM, which further complicates this scenario for the attacker because the TPM enforces rate limiting. As the other commenter mentioned, the physical access scenario is commonly a stolen laptop situation, where the attacker would not be in communication with the victim and probably wouldn't return the laptop.

New comment by evan_a_a in "Ubuntu's TPM encryption switches to snap kernel that blocks deb kernel packages"

evan_a_a — Tue, 28 Jul 2026 18:56:05 +0000

Far better to just use the raw tools and manage it yourself ala arch wiki:

https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR...

New comment by evan_a_a in "GrapheneOS protections against data extraction from locked devices"

evan_a_a — Sun, 26 Jul 2026 11:44:49 +0000

Border searches are special case in US law where the 4th amednment protections aren't as strong. See the EFF page about it for more:

https://www.eff.org/issues/border-searches

New comment by evan_a_a in "So Reddit has decided that plain HTML is unsafe"

evan_a_a — Thu, 23 Jul 2026 16:38:43 +0000

According to stats on a relatively small local sub I mod, most people interact with Reddit through the mobile app these days. All of the web interfaces make up a small percentage of visits, and old.reddit is even smaller.