Hacker News: rb12345

New comment by rb12345 in "Aliens.gov ~ domain registered 17MAR2026"

rb12345 — Thu, 19 Mar 2026 09:01:16 +0000

Assuming US gallons, $8/US gallon works out as £1.60/litre. That sounds about right for current UK prices, depending on what and where you're buying it. (Yes, fuel is expensive here compared to the US; that's largely down to fuel duty and taxes.)

New comment by rb12345 in "Why Do Domestic Prices Rise with Tarriffs?"

rb12345 — Mon, 07 Apr 2025 14:26:23 +0000

Usernames for new users always show up in green.

New comment by rb12345 in "Visual explanation of SAML authentication (2020)"

rb12345 — Wed, 24 Jul 2024 15:55:52 +0000

That's true for SAML2, but not SAML1 - not that anything should be using SAML1 these days.

New comment by rb12345 in "A Gentle Introduction to SAML"

rb12345 — Mon, 22 Jul 2024 22:34:37 +0000

Outdated certificates are actually fine with regards to SAML, oddly enough; the logic being that the trust is handled out of band at metadata level, and the certificate is just a public-key distribution method. (That applies to Shibboleth at least; other implementations may disagree.) This does of course assume that you have a means of safely keeping metadata for the other end of the trust relationship up to date. In an eduGAIN/local federation setting, that's easy enough to do with signed XML metadata feeds and daily fetches, but far less so for bilateral trust.

The XMLDSig stuff is definitely a mess though. There were definitely issues with comments in signed content allowing values to be truncated to the start of the comment, along with some similar weirdness with XML entities. And that's before any of your (entirely valid!) complaints...

New comment by rb12345 in "A Gentle Introduction to SAML"

rb12345 — Mon, 22 Jul 2024 22:20:45 +0000

I'd say the main difference is that OAuth is granting the SP the ability to "do stuff" as the original user (including reading the user's profile details, as OIDC does), as opposed to SAML's approach of just sending attributes describing them.

For what it's worth, it is certainly possible for SAML SPs to flag that certain attributes should/must be released to them via their metadata, but the actual release is at the whim of the IdP and its operators. It's also possible for a SAML IdP to expose that level of detail to its end users and allow them to agree/disagree to the attribute release, although I'd be surprised if that behaviour was particularly common in practice.

New comment by rb12345 in "Microsoft Chose Profit over Security, Whistleblower Says"

rb12345 — Fri, 14 Jun 2024 17:16:48 +0000

> What is an "OAuth key"? Do you mean an OAuth token? No, Golden SAML is worse than stealing an OAuth token, because an OAuth token is valid for 1 user, but Golden SAML can be used to impersonate any user. Also, OAuth tokens expire, but Golden SAML doesn't expire (although if you steal an OAuth refresh token, that won't expire).

Stealing the OAuth token signing key, since then any fake OAuth tokens signed by it would be considered authentic.

New comment by rb12345 in "XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.""

rb12345 — Sun, 31 Mar 2024 11:56:41 +0000

> But that's the thing: deciding how software is built and which features are shipped to users _is_ under our control. The case with xz was exceptionally bad because of the state of the project, but in a well maintained project having these checks and oversight does help with delivering better quality software. I'm not saying that this type of sophisticated attack could've been prevented even if the project was well maintained, but this doesn't mean that there's nothing we can do about it.

In this particular case, having a static project or a single maintainer rarely releasing updates would actually be an improvement! The people/sockpuppets calling for more/faster changes to xz and more maintainers to handle that is exactly how we ended up with a malicious maintainer in charge in the first place. And assuming no CVEs or external breaking changes occur, why does that particular library need to change?

New comment by rb12345 in "The Great Migration from MongoDB to PostgreSQL"

rb12345 — Fri, 29 Mar 2024 11:50:51 +0000

Yes, but as MongoDB is a document database, storing and updating giant blobs of JSON as a single operation as opposed to breaking the JSON down into individual fields is intended behaviour. This works in Postgres too, of course, but then you lose the relational database advantages on top of the large-single-field issues.

All this really comes down to is picking the right database type for the problem you're trying to solve.

New comment by rb12345 in "THX Theme in SuperCollider"

rb12345 — Wed, 27 Mar 2024 23:21:58 +0000

Try https://infinitedigits.co/tinker/thx/ instead?

New comment by rb12345 in "Getaddrinfo() on glibc calls getenv(), oh boy"

rb12345 — Tue, 17 Oct 2023 17:42:57 +0000

In fairness, they also gave us the joys of `strcpy(src_ptr, dest_ptr)` and `scanf("%s", str_ptr)`, which with the benefit of hindsight and many buffer overflows later were a terrible idea.

New comment by rb12345 in "54% of Portugal’s electricity is now generated by renewable energy"

rb12345 — Sun, 01 Oct 2023 11:55:03 +0000

Those numbers look like they could be about right for 2020/2021, but using them in a 2023 article is meaningless given the effects of the war in Ukraine on gas and electricity prices. I don't know how much Portugal's grid depends on gas, but I could believe that it's less affected by gas prices than the UK grid is.

New comment by rb12345 in "The long life of Apache httpd 2.4"

rb12345 — Mon, 22 May 2023 12:51:27 +0000

"EnableSendfile On" will enable that on Apache, and has been around since Apache 2.0.44. It's not enabled by default though, and as you say, TLS breaks it.

New comment by rb12345 in "Breaking BIOS: enabling VT-x virtualization support on Acer Aspire One netbook"

rb12345 — Fri, 18 Nov 2022 15:38:29 +0000

It's true that Blue Pill and friends were an issue 15 years ago. I would have expected VT-x to be on by default now though given that Windows 10 and 11 both use virtualisation for various security features (Credential Guard, HVCI and so on). There's no advantage to disabling it...

(Edit: of course, that wasn't the case when this particular article and BIOS was written.)

New comment by rb12345 in "Podman Desktop: A Free OSS Alternative to Docker Desktop"

rb12345 — Wed, 09 Nov 2022 22:56:43 +0000

LXC/LXD are probably the closest to that on Linux, although I'm not sure about nesting containers.

New comment by rb12345 in "Amazon, Verizon found using IPv4 240/4 addresses"

rb12345 — Tue, 23 Aug 2022 23:33:37 +0000

Linux has supported 240/4 addresses for years, but Windows still does not.

New comment by rb12345 in "Is IPv6 faster than IPv4?"

rb12345 — Wed, 15 Jun 2022 22:34:19 +0000

The 50.03% is specifically US traffic; for global traffic, it's 36.89%.

New comment by rb12345 in "Russia Prepared to Withstand Sanctions. Why Wasn't Europe Prepared?"

rb12345 — Wed, 23 Feb 2022 22:42:05 +0000

The thing is though that 40% of the German gas supply comes from Russia at the moment. That means that if you can eliminate the 15% used for electricity, you've reduced the demand for Russian gas by about 38%. Put that way, reopening the newly shut nuclear plants makes a lot of sense. Refuelling and starting an existing power plant should be far quicker than building a brand new power plant or wind farm. You'll still have a lot of demand for gas from heating, but the warm winter and arrival of spring should reduce that too in the next few months.

Longer term, you are right about the need for more heat pumps to replace gas heating, and I'd also add extra insulation to that to reduce the heating needed from any source. The heat pumps can be powered by nuclear, renewables or gas depending on cost and preference.

New comment by rb12345 in "Ministers plan post-Brexit return of imperial pounds and ounces"

rb12345 — Fri, 17 Sep 2021 21:51:52 +0000

You can actually do most of this today; you just need to have the metric equivalent amount at least as visible on the packaging and pricing labels to satisfy the EU rules. Milk is still sold in pints (technically some multiple of ~0.57 l, but near enough), some foods (e.g. jam) are still sold in 454g (i.e. 1 lb) amounts. All changing the rules does is allow you to remove the metric sizing, and I'm not convinced there's any burning desire for that. (The "metric martyrs" were largely against the additional work to add metric prices alongside Imperial ones; most places today no doubt use software to generate the price labels and will just keep things as-is.)

New comment by rb12345 in "Ministers plan post-Brexit return of imperial pounds and ounces"

rb12345 — Fri, 17 Sep 2021 21:27:00 +0000

Even the kilogram is defined via physical constants these days (https://www.bipm.org/documents/20126/41483022/SI-Brochure-9...., pages 21 and 205 in the PDF).

New comment by rb12345 in "Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)"

rb12345 — Sun, 12 Sep 2021 11:12:23 +0000

Likely because DNS worked just fine without EDNS client IP (and indeed DNS) for decades. For example, I remember the use of the 4.2.2.2 server, which was globally accessible but US-based. The responses though were 100% usable wherever you were on the planet. Equally, a national ISP running DNS servers would get you a country at most; a /24 gives you city or better location, carrier-grade NAT aside. Latency between the client and server may be slightly higher, but that's the end user's problem and not an issue for the site. In any case, it sounds like the Cloudflare source IPs for recursive DNS lookups are locatable via GeoIP, so I fail to see the problem.