<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: profmonocle</title><link>https://news.ycombinator.com/user?id=profmonocle</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Wed, 22 Apr 2026 08:35:48 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=profmonocle" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by profmonocle in "Wikipedia loses challenge against Online Safety Act"]]></title><description><![CDATA[
<p>Possibly naive question, why should Wikimedia do anything at all? Do they have a legal presence in the UK?<p>If not, why not just say "we aren't a UK based organization so we have no obligations under this law"<p>Let the UK block Wikipedia.</p>
]]></description><pubDate>Mon, 11 Aug 2025 22:32:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=44870231</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=44870231</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44870231</guid></item><item><title><![CDATA[New comment by profmonocle in "A proposal to restrict sites from accessing a users’ local network"]]></title><description><![CDATA[
<p>Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites.<p>One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large.<p>A better definition of "local IP" would be whether the IP is in the same <i>subnet</i> as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.</p>
]]></description><pubDate>Wed, 04 Jun 2025 20:00:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=44184866</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=44184866</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44184866</guid></item><item><title><![CDATA[New comment by profmonocle in "Port of Los Angeles says shipping volume will plummet 35% next week"]]></title><description><![CDATA[
<p>I don't think OP was specifically stating we need to save these <i>specific</i> jobs, rather they were pointing out the interconnected nature of the economy. Less importing hurts the workers in those industries. Taking that further, it will hurt businesses near the ports where the workers may have gotten lunch, etc. etc. etc. That's how recessions look at a microeconomic scale.</p>
]]></description><pubDate>Wed, 30 Apr 2025 15:06:03 +0000</pubDate><link>https://news.ycombinator.com/item?id=43846326</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43846326</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43846326</guid></item><item><title><![CDATA[New comment by profmonocle in "Amazon to display tariff costs for consumers"]]></title><description><![CDATA[
<p>I'm fine with this as long as they include the tariff in the listed price.<p>I'm worried businesses are going to use tariffs as an excuse to have a fake list price, then hit you with massive hidden fees at the point of sale.
Some sectors have been doing this for years - "service fees" at restaurants, "regulatory response fees" in the telecom industry, all sorts of nonsense in event ticketing.<p>Physical goods have mostly been spared this type of fake pricing - aside from sales tax not being included, but that's been universally true in the US forever so everyone is used to it.<p>Tariffs could be the end of that if businesses see sales plummet. Especially because these scams actually <i>work</i> - the reason restaurants give for not just increasing their menu prices is because higher listed prices drive people away.</p>
]]></description><pubDate>Tue, 29 Apr 2025 12:19:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=43831594</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43831594</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43831594</guid></item><item><title><![CDATA[New comment by profmonocle in "4chan Sharty Hack And Janitor Email Leak"]]></title><description><![CDATA[
<p>> 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts<p>That's too generous. "Not your personal army" started because 4chan had a well-earned reputation for harassment - usually raiding other web sites, but often targeting individual people who caught their attention for one reason or another.<p>The "not your personal army" slogan came about because people who were <i>very aware</i> of this reputation were showing up, hoping to make a web site or person they disliked the next target. That got annoying fast, hence they told those people to go away.<p>It wasn't a moral stance against target harassment - far from it. It was a stance that the group mind will choose the next target when they feel like it - not because some rando is mad at their ex or something</p>
]]></description><pubDate>Tue, 15 Apr 2025 23:37:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=43699723</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43699723</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43699723</guid></item><item><title><![CDATA[New comment by profmonocle in "4chan Sharty Hack And Janitor Email Leak"]]></title><description><![CDATA[
<p>When the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was easy to tell - this was before the App Store, so having extra app icons on the home screen wasn't normal.)<p>This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)</p>
]]></description><pubDate>Tue, 15 Apr 2025 23:19:03 +0000</pubDate><link>https://news.ycombinator.com/item?id=43699581</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43699581</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43699581</guid></item><item><title><![CDATA[New comment by profmonocle in "4chan Sharty Hack And Janitor Email Leak"]]></title><description><![CDATA[
<p>I would also say don't run ghostscript with the same permissions as the web server, especially not if you can just hand it your PDF through stdin and take a PNG through stdout. Sandbox it as much as possible. PDF is a really complex format which means lots of opportunities for buffer overruns and the like. (Edit: Actually, reading through Arch-TK's post above, it sounds like it was much dummer than something like a buffer overrun.)</p>
]]></description><pubDate>Tue, 15 Apr 2025 23:13:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=43699534</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43699534</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43699534</guid></item><item><title><![CDATA[New comment by profmonocle in "The Practical Limitations of End-to-End Encryption"]]></title><description><![CDATA[
<p>There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.</p>
]]></description><pubDate>Tue, 25 Mar 2025 17:48:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=43473965</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43473965</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43473965</guid></item><item><title><![CDATA[New comment by profmonocle in "The Practical Limitations of End-to-End Encryption"]]></title><description><![CDATA[
<p>In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to silently install spyware with root level access. No need to break signal's crypto if you can just silently capture screenshots.<p>It's not hard to imagine some foreign intelligence agency is sitting on some severe zero-day vulnerability, waiting to use it on very high value targets, such as senior administration staff.</p>
]]></description><pubDate>Tue, 25 Mar 2025 17:17:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=43473625</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43473625</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43473625</guid></item><item><title><![CDATA[New comment by profmonocle in "The Practical Limitations of End-to-End Encryption"]]></title><description><![CDATA[
<p>Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary.<p>Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.</p>
]]></description><pubDate>Tue, 25 Mar 2025 17:08:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=43473544</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43473544</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43473544</guid></item><item><title><![CDATA[New comment by profmonocle in "AWS S3 SDK breaks its compatible services"]]></title><description><![CDATA[
<p>Treating a proprietary API as a standard is risky - this is a good example of why. From Amazon's point of view there's no reason to keep the S3 SDK backwards compatible with old versions of the S3 service, because they control the S3 service. Once this feature was rolled out in all regions, it was safe to update the SDK to expect it.<p>Amazon may not be actively hostile to using their SDK with third party services, but they never promised to support that use case.<p>(disclaimer: I work for AWS but not on the S3 team, I have no non-public knowledge of this and am speaking personally)</p>
]]></description><pubDate>Thu, 20 Feb 2025 20:12:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=43119550</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43119550</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43119550</guid></item><item><title><![CDATA[New comment by profmonocle in ""Uber for Armed Guards" Surges After UnitedHealthcare CEO Assassination"]]></title><description><![CDATA[
<p>Who is this actually for? It seems like most people who need private security need it on an ongoing basis, not just for a one-off thing. Even if the need arises suddenly (i.e. a stalker starts threatening a celebrity), it still seems like someone who needs that would have it arranged via their management / assistant, and wouldn't have any need (or desire) to arrange it themselves.<p>I actually <i>can</i> see some situations where on-demand private security would be useful. Say you need to retrieve your belongings from your abusive ex-partner's place (and imagine you're on the lease/deed so you have the right to enter without their permission) - having an escort could be useful if the person is violent.<p>However... situations like that don't seem to be what this app is going for?<p>> Every booking comes with a motorcade and users get to select the number of Escalades that’ll be joining them as well as the uniforms their hired goons will wear.<p>It honestly seems like it's for people wanting to LARP as being powerful and important. Which is fine (as long as no one gets hurt), but how big of a market is there for that?</p>
]]></description><pubDate>Wed, 19 Feb 2025 05:37:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=43098934</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=43098934</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43098934</guid></item><item><title><![CDATA[New comment by profmonocle in "Some flag emojis aren’t working on Chrome on Windows"]]></title><description><![CDATA[
<p>Chrome launched their own root program a couple years ago: <a href="https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html?m=1" rel="nofollow">https://blog.chromium.org/2022/09/announcing-launch-of-chrom...</a></p>
]]></description><pubDate>Mon, 03 Feb 2025 18:05:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=42920996</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=42920996</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42920996</guid></item><item><title><![CDATA[New comment by profmonocle in "Back to basics: Why we chose long-polling over websockets"]]></title><description><![CDATA[
<p>And it's worth noting that you can't just ignore this problem if you're using websockets - websockets disconnect sometimes for a variety of reasons. It may be less frequent than a long-polling timeout, but if you don't have <i>some</i> mechanism of detecting that messages weren't ack'd and retransmitting them the next time the user connects, messages will get lost eventually.</p>
]]></description><pubDate>Mon, 06 Jan 2025 00:34:27 +0000</pubDate><link>https://news.ycombinator.com/item?id=42606353</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=42606353</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42606353</guid></item><item><title><![CDATA[New comment by profmonocle in "Back to basics: Why we chose long-polling over websockets"]]></title><description><![CDATA[
<p>The next long-polling request can include a list of the ID(s) returned in the previous request. You keep the messages in the queue until you get the next request ack'ing them.</p>
]]></description><pubDate>Mon, 06 Jan 2025 00:29:44 +0000</pubDate><link>https://news.ycombinator.com/item?id=42606321</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=42606321</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42606321</guid></item><item><title><![CDATA[New comment by profmonocle in "Trump wins presidency for second time"]]></title><description><![CDATA[
<p>The problem is people don't really see wage increases and inflation as things that balance each other out. They think of raises as something earned that will improve their lifestyle - when inflation cancels that out, it can feel like you were cheated out of that reward.<p>Even if you understand intellectually that a pay increase is a cost of living adjustment, that doesn't mean it isn't disheartening to see your new earnings being eaten up by inflation.</p>
]]></description><pubDate>Thu, 07 Nov 2024 01:10:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=42072145</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=42072145</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42072145</guid></item><item><title><![CDATA[New comment by profmonocle in "Penguin Random House underscores copyright protection in AI rebuff"]]></title><description><![CDATA[
<p>> if LLM training involves merely reading a dataset, but it is not strictly necessary to copy, or even store it verbatim to be useful, then does it even fall under copyright protection at all?<p>Copyright includes the creation of derivative works, not just literally copying the source material.<p>For instance, imagine I read a novel, then I decide to write my own, unauthorized sequel to it. It's not a literal "copy" of the original material - it's my own original text, but obviously a <i>derivative work</i> of the original material. Under copyright law, that would be infringement - I would be sued if I tried to sell that. (Yes, that means fanfiction is infringing, but most rights holders have wisely decided to look the other way on that, as long as it's non-commercial.)<p>This is what people who claim AI is infringing are worried about. Not that the AI has a literal copy of the source material in its training data, but that the training data can be used to produce a derivative work.<p>I could write a (crappy) fanfic of the Lord of the Rings without directly referencing the books/movies. And that doesn't mean I have a complete copy of the books/movies in my head - that isn't how memory works. Until now, creating a derivative work without directly using the source material was something only humans could do. This is completely uncharted legal territory.</p>
]]></description><pubDate>Sat, 19 Oct 2024 07:15:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=41886218</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=41886218</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=41886218</guid></item><item><title><![CDATA[New comment by profmonocle in "Penguin Random House underscores copyright protection in AI rebuff"]]></title><description><![CDATA[
<p>Would that matter if the company wants to do business in countries with more restrictive laws?<p>I.E. if I wrote my own spin-off of a popular book series, which was somehow considered fair use in country A, but considered infringing in country B, the publisher could get it removed from stores in country B.<p>By the same logic, if AI training is ruled as copyright infringement in the US, it won't matter if the company trains their model somewhere else - if they open a US division to sell service using that model, they'd get sued.<p>Granted I'm not an IP lawyer and AI IP law is in its infancy - maybe I'm missing something?</p>
]]></description><pubDate>Sat, 19 Oct 2024 06:49:57 +0000</pubDate><link>https://news.ycombinator.com/item?id=41886125</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=41886125</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=41886125</guid></item><item><title><![CDATA[New comment by profmonocle in "Malaysia started mandating ISPs to redirect DNS queries to local servers"]]></title><description><![CDATA[
<p>I'm honestly surprised that the US doesn't have a legal framework to force ISPs to block IPs / DNS hostnames. I've been expecting that for 10+ years now, but it hasn't happened.</p>
]]></description><pubDate>Sat, 07 Sep 2024 07:32:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=41472178</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=41472178</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=41472178</guid></item><item><title><![CDATA[New comment by profmonocle in "Malaysia started mandating ISPs to redirect DNS queries to local servers"]]></title><description><![CDATA[
<p>`sudo tcpdump port 53` says yes, they do use unencrypted DNS.<p>AFAIK Chrome has a hardcoded list of DNS servers which offer encrypted DNS. I.E. if your DHCP server tells your PC to use 8.8.8.8, 1.1.1.1, 9.9.9.9, (or the IPv6 equivalents) it will instead connect to the equivalent DNS-over-HTTPS endpoint for that DNS provider. This is a compromise to avoid breaking network-level DNS overrides such as filtering or split-horizon DNS. It's not limited to public DNS providers either, ISP DNS servers are in there. (I've seen it Chrome connect to Comcast's DNS-over-HTTPS service when Comcast's DNS was advertised via DHCP.)<p>Of course, this is pretty limited. Chrome obviously can't hardcode ever DNS server, and tons of networks use private IPs for DNS even though they don't do any sort of filtering / split-horizon at all. (My Eero router has a local DNS cache, so even if my ISP's DNS servers were in Google's hardcoded list, it wouldn't use DNS-over-HTTPS, because all Chrome can see is that my DNS server is 192.168.4.1)</p>
]]></description><pubDate>Sat, 07 Sep 2024 07:25:16 +0000</pubDate><link>https://news.ycombinator.com/item?id=41472152</link><dc:creator>profmonocle</dc:creator><comments>https://news.ycombinator.com/item?id=41472152</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=41472152</guid></item></channel></rss>