Hacker News: lachiflippi

New comment by lachiflippi in "Scammers are abusing an internal Microsoft account to send spam links"

lachiflippi — Sun, 24 May 2026 11:48:17 +0000

That's actually really easy:

1. be government agency

2. pay 30-70% less than private sector companies would for a similar position

3. receive applicants that are 30-70% less competent

Bonus:

- have 30+ year old systems nobody understands anymore because the team behind them has been dead/retired for a decade

- have hiring process handled entirely by out of touch suits

- have a revolving door of motivated soon-to-be burnouts mopping up the mess behind the aforementioned regular employees

New comment by lachiflippi in "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"

lachiflippi — Sun, 17 May 2026 15:27:39 +0000

Sensitive data written down on a sticky note is arguably more secure than that same data sitting on an unencrypted hard drive, at least in a home setting.

New comment by lachiflippi in "A Tiny E Reader"

lachiflippi — Sat, 16 May 2026 14:19:13 +0000

Kind of. There's an "unlocker" that just spoofs their OTA endpoint to flash custom firmware because xteink decided to not implement TLS validation, though they could theoretically change that at any point.

Xteink also claims that non-domestic versions of their devices sold by their "official" store are unlocked, but there's been a bunch of reports that that's not always the case (...along with devices arriving with broken screens, not arriving at all, or the wrong device showing up).

New comment by lachiflippi in "A Tiny E Reader"

lachiflippi — Sat, 16 May 2026 12:40:42 +0000

The X3/X4 are such neat devices with a great community behind them, shame the manufacturer decided to lock down devices sold on AliExpress in an attempt to funnel potential customers into their own store instead of embracing the open source firmware like Chinese handheld gaming vendors usually do. I hope these devices being as successful as they are inspire other manufacturers to build a better device that doesn't try to force customers to choose between running the dysfunctional stock firmware, or having to purchase from the equally dysfunctional manufacturer store.

New comment by lachiflippi in "Frontier AI has broken the open CTF format"

lachiflippi — Sat, 16 May 2026 12:27:08 +0000

The "CTF for fun" aspect has been dead ever since the winning teams had thousands of dollars of rewards waiting for them. Of course people are going to use anything that's not explicitly forbidden by the rules to win. Introducing what amounts to an "I win" button that both can't be prevented by rules and is accessible to anyone didn't "break the format" anymore than the epidemic of giant merger teams did a couple years ago, it just broke the community because you now don't have to actually talk to other people to cheat anymore.

Many CTFs have switched to a dual-leaderboard format recently, one for "agentic teams," one for the rest. If all you care about is "learning" and imaginary internet points, you can just participate as a human team and adblock the AI scoreboard, and maybe lobby CTFTime into splitting their rankings as well.

New comment by lachiflippi in "Classic 7 is a Windows 10 LTSC mod to look 1:1 to Windows 7"

lachiflippi — Thu, 14 May 2026 11:33:57 +0000

Vista was fine from the get-go if you had enough (>=4GB) RAM, which OEMs mostly didn't bother shipping.

My ME machine would reliably BSOD when I opened / closed the CD tray.

New comment by lachiflippi in "Why Switzerland has 25 Gbit internet and America doesn't"

lachiflippi — Mon, 06 Apr 2026 07:43:14 +0000

It absolutely does happen that way in Germany. We had Fiber Company A rip up the entire city a year ago, and Fiber Company B ripped up the streets again just a few weeks ago.

ETA from my ISP to actually get any of those lines into my apartment is still 2028.

New comment by lachiflippi in "How kernel anti-cheats work"

lachiflippi — Sun, 15 Mar 2026 11:24:10 +0000

Don't forget that ActiBlizz are also pretty much the only ones regularly taking legal action against pay2cheat developers, see Bossland/EngineOwning.

New comment by lachiflippi in "Privacy-preserving age and identity verification via anonymous credentials"

lachiflippi — Tue, 03 Mar 2026 16:32:06 +0000

My understanding is that the responses are signed, but in a way that prevents linking signatures across vendors, so the same card being used for verification on different sites could not be linked, while the same card being used multiple times for the same vendor could.

As I'm not an expert on the crypto underlying the protocol, feel free to check the eIDAS standard for more info (the documents are in English, even if the link is not): https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisati...

New comment by lachiflippi in "Privacy-preserving age and identity verification via anonymous credentials"

lachiflippi — Tue, 03 Mar 2026 11:46:37 +0000

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it.

Anonymous age verification isn't a technical problem to be solved, as it's already been solved, it's a societal problem in that either the companies or the politicians pushing for age verification don't want to support it.

New comment by lachiflippi in "Qwen3.5 122B and 35B models offer Sonnet 4.5 performance on local computers"

lachiflippi — Sat, 28 Feb 2026 23:30:14 +0000

Yeah, it tends to get stuck in loops like that a lot with everything set to default. I wonder if they distilled Gemini at some point, I've seen that get stuck in a similar "I will now do [thing]. I am preparing to do [thing]. I will do it." failure mode as well a couple of times.

New comment by lachiflippi in "Qwen3.5 122B and 35B models offer Sonnet 4.5 performance on local computers"

lachiflippi — Sat, 28 Feb 2026 23:03:55 +0000

Qwen3.5 pretty much requires a long system prompt, otherwise it goes into a weird planning mode where it reasons for minutes about what to do, and double and triple checks everything it does. Both Gemini's and Claude Opus 4.6's prompts work pretty well, but are so long that whatever you're using to run the model has to support prompt caching. Asking it to "Say the word "potato" 100 times, once per line, numbered.", for example, results in the following reasoning, followed by the word "potato" in 100 numbered lines, using the smallest (and therefore dumbest) quant unsloth/Qwen3.5-35B-A3B-GGUF:UD-IQ2_XXS:

"User is asking me to repeat the word "potato" 100 times, numbered. This is a simple request - I can comply with this request. Let me create a response that includes the word "potato" 100 times, numbered from 1 to 100.

I'll need to be careful about formatting - the user wants it numbered and once per line. I should use minimal formatting as per my instructions."

New comment by lachiflippi in "Google API keys weren't secrets, but then Gemini changed the rules"

lachiflippi — Fri, 27 Feb 2026 12:48:40 +0000

OpenAI also does a really fun thing where prepaid credits just straight up expire after a year, which is straight up completely illegal in most (all?) of the EU.

New comment by lachiflippi in "Manjaro website off-line again due to lapsed certificate"

lachiflippi — Wed, 25 Feb 2026 00:22:34 +0000

You're developing "certbot, but it's paid and sends private keys around the network instead of generating the csr locally"? Why? Who's the target audience? Platforms that can't run certbot, or any of the infinite amount of other acme clients, most likely won't be able to run your agent as well, so what's the value add vs just running a regular, well-defined (and free!) acme client and just moving the cert over manually?

New comment by lachiflippi in "Is the RAM shortage killing small VPS hosts?"

lachiflippi — Fri, 30 Jan 2026 09:27:23 +0000

Running modern full-fat Linux on anything sub-512MB isn't a great experience unless you're willing to do a lot of tweaking, or running specialized distros like alpine. If dropping the whole "vm" thing is an option, you can go much lower -- I've been running perfectly usable alpine lxc system containers on as low as 32MB -- though container-based vps kind of fell out of favor in the last couple years, probably due to the issues that come with not having your "own" kernel in "your" vps. Virtuozzo/openvz was everywhere back then, now it's pretty much all kvm/vmware/hyperv.

New comment by lachiflippi in "There's a ridiculous amount of tech in a disposable vape"

lachiflippi — Wed, 14 Jan 2026 14:32:55 +0000

Yes, 100ml from the same store I bought a liter from for 40€ in 2015 now cost 56€. There is currently a tax of 0.32€ per ml on liquid, no matter if you're buying the base or the finished product.

New comment by lachiflippi in "All my Deutschlandtickets gone: Fraud at an industrial scale [video]"

lachiflippi — Wed, 14 Jan 2026 11:29:00 +0000

If purchasing via SEPA there's a wait period until the payment has cleared, if payment is done via credit card/[Apple|Google] Pay/PayPal fulfillment is instant.

New comment by lachiflippi in "There's a ridiculous amount of tech in a disposable vape"

lachiflippi — Wed, 14 Jan 2026 11:20:51 +0000

Refillable vapes used to be the standard around a decade ago, back when a liter of vape base (without nicotine) cost 30€ at max. Disposable vapes pretty much didn't exist. Now the same liter of vape base (still without nicotine) is a "tobacco product" and costs 400€+ due to taxes thanks to decade-long lobbying efforts by big tobacco, turning refillable vapes into a massive niche product due to single-use vapes costing the same or less, without any of the hassle of mixing your own liquids or having to refill them.

New comment by lachiflippi in "All my Deutschlandtickets gone: Fraud at an industrial scale [video]"

lachiflippi — Thu, 01 Jan 2026 22:02:15 +0000

Lack of centralization is one part of it (see also: communal digital services), yes, but the complete lack of standards and guidelines is also a massive issue. I tried buying a Deutschlandticket from the DB Navigator app a while back, and immediately ran into some issues:

- they only take credit card, probably because of the massive SEPA fraud they've had happen

- they require id verification with a third party(!), which then only supports the e-perso(!!) or video ident(!!!), which they could've just used the actual PostIdent service for, which would've provided an alternative for non-smartphone-havers / people who'd rather not have their ID and face recorded by some Eastern European company until the end of time

- their entire authentication system was down when it came to actually purchasing

buying from my local Verkehrsverbund was a single tap in their app instead, with no id verification whatsoever. If DB's offering were the only option it would be an absolute travesty.

New comment by lachiflippi in "I can't upgrade to Windows 11, now leave me alone"

lachiflippi — Sun, 21 Dec 2025 22:23:56 +0000

This is a massive pet peeve of mine as well. As far as I'm aware there's not a single consumer CPU listed in the Windows 11 compatibility list that doesn't have builtin TPM2.0.