<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: thom_nic</title><link>https://news.ycombinator.com/user?id=thom_nic</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Mon, 06 Apr 2026 06:22:33 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=thom_nic" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by thom_nic in "California's new bill requires DOJ-approved 3D printers that report themselves"]]></title><description><![CDATA[
<p>> is this pressure from the gun manufacturing lobby<p>Definitely not, it's pressure from the anti-gun lobby that keeps pushing "one more bill that <i>this time</i> will actually change violent crime statistics, we promise!"<p>These bills are being introduced in the states that already have the most restrictive gun control already, yet to nobody's surprise, hasn't done much to curb violent crime.  But the lobby groups and candidates campaign and fundraise on the issue so they have to keep the boogeyman alive rather than admit that the policies have been a failure.</p>
]]></description><pubDate>Thu, 19 Feb 2026 20:11:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=47078552</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=47078552</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47078552</guid></item><item><title><![CDATA[New comment by thom_nic in "DoD's public.cyber.mil is using an untrusted root CA"]]></title><description><![CDATA[
<p>This is fair, but I would venture to guess 99% of people including software developers and even most IT professionals completely rely on the vendor pre-installed root CAs.</p>
]]></description><pubDate>Mon, 25 Aug 2025 16:16:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=45015490</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=45015490</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45015490</guid></item><item><title><![CDATA[New comment by thom_nic in "DoD's public.cyber.mil is using an untrusted root CA"]]></title><description><![CDATA[
<p>DOD Cyber Exchange, home of DISA STIGs among other resources, appears to be signed by a root CA "US DoD CCEB Interoperability Root CA 2" which does not appear to be in any browser list of trusted root CAs.  This seems to have changed at some point, because public.cyber.mil <i>used to</i> be accessible without any browser warnings.  Certificate chain:<p><pre><code>    $ gnutls-cli --print-cert public.cyber.mil 443 </dev/null
    Processed 150 CA certificate(s).
    Resolving 'public.cyber.mil:443'...
    Connecting to '23.9.224.83:443'...
    - Certificate type: X.509
    - Got a certificate list of 2 certificates.
    - Certificate[0] info:
     - subject `CN=comm-cyber.mil,OU=DISA,OU=PKI,OU=DoD,O=U.S. Government,C=US', issuer `CN=DOD SW CA-74,OU=PKI,OU=DoD,O=U.S. Government,C=US', serial 0x087ef6, RSA key 2048 bits, signed using RSA-SHA256, activated `2025-08-11 17:51:06 UTC', expires `2026-09-12 17:51:06 UTC', pin-sha256="zqDELcwzXa0DHRYN6o+J5FGm2fSFXYb3O0knmjH3MrE="
            Public Key ID:
                    sha1:2925dac566b06932f1995cc904f1e723e26d6f5d
                    sha256:cea0c42dcc335dad031d160dea8f89e451a6d9f4855d86f73b49279a31f732b1
            Public Key PIN:
                    pin-sha256:zqDELcwzXa0DHRYN6o+J5FGm2fSFXYb3O0knmjH3MrE=


    -----BEGIN CERTIFICATE-----
    ...snip
    -----END CERTIFICATE-----

    - Certificate[1] info:
     - subject `CN=DOD SW CA-74,OU=PKI,OU=DoD,O=U.S. Government,C=US', issuer `CN=DoD Root CA 6,OU=PKI,OU=DoD,O=U.S. Government,C=US', serial 0x4a, RSA key 2048 bits, signed using RSA-SHA384, activated `2023-05-16 16:05:29 UTC', expires `2029-05-15 16:05:29 UTC', pin-sha256="NJVFdvvbhMFMXyUHKDk1RLnMkkY5Qt9eP3Q0Q8QHPUk="

    -----BEGIN CERTIFICATE-----
    ...snip
    -----END CERTIFICATE-----

    - Status: The certificate is NOT trusted. The certificate issuer is unknown. 
    *** PKI verification of server certificate failed...
    *** Fatal error: Error in the certificate.</code></pre></p>
]]></description><pubDate>Mon, 25 Aug 2025 14:06:39 +0000</pubDate><link>https://news.ycombinator.com/item?id=45014004</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=45014004</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45014004</guid></item><item><title><![CDATA[DoD's public.cyber.mil is using an untrusted root CA]]></title><description><![CDATA[
<p>Article URL: <a href="https://www.cyber.mil/stigs/">https://www.cyber.mil/stigs/</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=45014003">https://news.ycombinator.com/item?id=45014003</a></p>
<p>Points: 2</p>
<p># Comments: 3</p>
]]></description><pubDate>Mon, 25 Aug 2025 14:06:39 +0000</pubDate><link>https://www.cyber.mil/stigs/</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=45014003</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45014003</guid></item><item><title><![CDATA[New comment by thom_nic in "Czech gunmaker CZG buys Colt in cash and stock deal"]]></title><description><![CDATA[
<p>From my anecdotal observation this is true.  Gun sales are also growing among demographics not typically associated with gun ownership (non-white, non-conservative.)</p>
]]></description><pubDate>Fri, 12 Feb 2021 19:44:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=26117735</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=26117735</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=26117735</guid></item><item><title><![CDATA[New comment by thom_nic in "“I saw that you spun up an Ubuntu image in Azure”"]]></title><description><![CDATA[
<p>> the salesman wasn't supposed to TELL YOU that we are monitoring what you install<p>Exactly.  The old "I'm sorry I got caught" and not "I'm sorry I did it."</p>
]]></description><pubDate>Fri, 12 Feb 2021 16:28:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=26115368</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=26115368</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=26115368</guid></item><item><title><![CDATA[New comment by thom_nic in "Why the Arabic world turned away from science (2011)"]]></title><description><![CDATA[
<p>> There's always the risk that the West might internally reject the scientific revolution.<p>In the US I am pretty sure we are already on the decline.<p>I think it has to do with, during the industrial revolution and post-war, huge scientific advancements and tech grew the economy, fed capitalism by means of providing new desirable goods to consumers (e.g. dishwashers, nicer cars, etc.)<p>I wonder if we've reached a "peak" of consumer comfort where advances in science/ tech/ medicine are no longer frequent/ impactful enough to meaningfully satisfy consumers, (why do we care about exploring Mars?) so it's easy for people to reject it and say "we don't need science."</p>
]]></description><pubDate>Fri, 09 Oct 2020 13:18:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=24729608</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=24729608</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=24729608</guid></item><item><title><![CDATA[New comment by thom_nic in "Major Proposed Changes to Linux From Scratch"]]></title><description><![CDATA[
<p>I agree, for a couple reasons.  One, while you usually have to deal with a cross toolchain (usually intel-> ARM) it's easier to build and debug on a target board versus booting and rebooting your PC to see if you did everything right. Also the<p>I've used debootstrap to build a Debian distro for ARM with a custom kernel (for an Olimex board target or Beaglebone.)  That's very hands-off and not nearly the same "depth" as LFS.  The next step was taking the same kernel and building a busybox-based rootfs.  Then I had to make my own PID 1 and do init work to bring up services such as networking on boot which was very educational, yet busybox provides most of the "lego bricks" that you're not left writing too much from scratch.<p>Building to an embedded target also allows one to punt on the most annoying and complex parts of a desktop linux distro, such as the desktop environment, audio/video drivers, UEFI bootloader, etc. Building a semi-custom (e.g. Arch or Debian/debootstrap, Buildroot or OpenEmbedded) headless distro was what I'd call a "shallow dive" or gentle introduction to more of Linux's inner workings without having to understand every bit in order to get a running system.</p>
]]></description><pubDate>Fri, 10 Jul 2020 03:44:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=23787928</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=23787928</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=23787928</guid></item><item><title><![CDATA[New comment by thom_nic in "Pricing niche products"]]></title><description><![CDATA[
<p>This sounds a bit like the custom bicycle frame builder phenomenon as well.  Well-known builders/shops can have years-long wait lists and their builds will go for 2x, 5x or 10x the cost of a top of the line mainstream model - 10s of thousands of $$.<p>Granted each one <i>is</i> built by hand so the artisanal craft is easy to appreciate.<p>But exclusivity is there, because these shops are building less than a dozen bikes per year.  If you got your hands on one, wow it will turn heads when you roll up to the bier garden at the CX race.</p>
]]></description><pubDate>Fri, 04 Oct 2019 17:04:31 +0000</pubDate><link>https://news.ycombinator.com/item?id=21159635</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=21159635</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=21159635</guid></item><item><title><![CDATA[New comment by thom_nic in "A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”"]]></title><description><![CDATA[
<p>I was curious, and since the author of this answer provided links to what they called leaks [1], it's not difficult to download both the leak and ReactOS source [2] and look for similarities.  So, out of curiosity, that's what I did.<p>I started poking at some source files at random in ntoskernel, and it only took a minute to get some "hits" from the ReactOS source:<p><pre><code>    $ rg InitializeContextThread
    ./ntoskrnl/ke/thrdobj.c:872:        KiInitializeContextThread(Thread,
    ./ntoskrnl/ke/powerpc/thrdini.c:53:KiInitializeContextThread(IN PKTHREAD Thread,
    ./ntoskrnl/ke/i386/thrdini.c:92:KiInitializeContextThread(IN PKTHREAD Thread,
    ./ntoskrnl/ke/amd64/thrdini.c:36:KiInitializeContextThread(IN PKTHREAD Thread,
    ./ntoskrnl/ke/arm/thrdini.c:53:KiInitializeContextThread(IN PKTHREAD Thread,
    ./ntoskrnl/include/internal/ke.h:464:KiInitializeContextThread(

    $ rg NpxFrame
    ./ntoskrnl/ke/i386/v86vdm.c:473:    PFX_SAVE_AREA NpxFrame;
    ./ntoskrnl/ke/i386/v86vdm.c:480:    NpxFrame = &StackFrame->NpxArea;
    ./ntoskrnl/ke/i386/v86vdm.c:481:    ASSERT((ULONG_PTR)NpxFrame % 16 == 0);
    ./ntoskrnl/ke/i386/v86vdm.c:485:    RtlCopyMemory(KiGetThreadNpxArea(Thread), NpxFrame, sizeof(FX_SAVE_AREA));
    ./ntoskrnl/ke/i386/v86vdm.c:510:    PFX_SAVE_AREA NpxFrame = &StackFrame->NpxArea;
    ./ntoskrnl/ke/i386/v86vdm.c:512:    ASSERT((ULONG_PTR)NpxFrame % 16 == 0);
    ./ntoskrnl/ke/i386/v86vdm.c:551:    RtlCopyMemory(NpxFrame, V86Frame->ThreadStack, sizeof(FX_SAVE_AREA));
</code></pre>
Now that said, I have no idea what I'm looking for, or if this is significant.  But since we have the source for both, it seems we can do better than speculate w/r/t how much code is similar between them.  I know that does not prove copying but I think the author's point can't be blindly dismissed.<p>[1] <a href="https://github.com/Zer0Mem0ry/ntoskrnl" rel="nofollow">https://github.com/Zer0Mem0ry/ntoskrnl</a><p>[2] <a href="https://sourceforge.net/projects/reactos/files/ReactOS/" rel="nofollow">https://sourceforge.net/projects/reactos/files/ReactOS/</a></p>
]]></description><pubDate>Wed, 03 Jul 2019 03:17:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=20341321</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=20341321</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=20341321</guid></item><item><title><![CDATA[New comment by thom_nic in "Urql: a GraphQL client library"]]></title><description><![CDATA[
<p>I clicked the article link just because I was expecting to see this guy: <a href="https://en.wikipedia.org/wiki/Steve_Urkel#/media/File:Steve_Urkel.jpg" rel="nofollow">https://en.wikipedia.org/wiki/Steve_Urkel#/media/File:Steve_...</a></p>
]]></description><pubDate>Fri, 31 May 2019 17:28:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=20063018</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=20063018</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=20063018</guid></item><item><title><![CDATA[New comment by thom_nic in "Chaosnet"]]></title><description><![CDATA[
<p>Beyond the Abstract, can anyone give a TL;DR on novel or interesting things covered in this paper?</p>
]]></description><pubDate>Thu, 11 Apr 2019 12:45:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=19633822</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=19633822</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=19633822</guid></item><item><title><![CDATA[New comment by thom_nic in "Wipe and reinstall a running Linux system via SSH (2017)"]]></title><description><![CDATA[
<p>I actually implemented something on an embedded linux product once: a busybox initramfs that you could boot into "recovery mode," then along with dropbear, SSH into a completely in-memory system and re-flash the entire system image without having to pop out an SD card or connect a cable for DFU.<p>The recovery mode could even be initiated remotely, so you could re-flash a device without ever touching it.  Of course you have to be careful, if the re-flash failed you could be SOL :)  Apparently I need to go back and improve it so we can re-flash without rebooting!<p>These days you can use things like containers (Balena also looks very cool) to achieve a similar goal in possibly a "safer" way.  But the idea of being able to re-flash the entire system while running it felt sort of like changing the engine of a car while driving it down the freeway!</p>
]]></description><pubDate>Mon, 11 Mar 2019 12:20:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=19358367</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=19358367</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=19358367</guid></item><item><title><![CDATA[New comment by thom_nic in "Node.js Logging Made Right"]]></title><description><![CDATA[
<p>The issue becomes when you're calling some generic library that's unaware that it is running in a request handler.  If you want to log from deeper in some logic, maybe you've passed some data or domain objects but not a request/context/session object.  Do you pollute that logic with additional data passed in or does your library just create its own logger and call `log.info('intermediate result of some thing: XXX')` and let the CLS magic associate that with the request that generated the call?</p>
]]></description><pubDate>Tue, 05 Mar 2019 15:30:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=19311121</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=19311121</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=19311121</guid></item><item><title><![CDATA[New comment by thom_nic in "Corretto – No-cost, multiplatform, developer-preview distribution of OpenJDK"]]></title><description><![CDATA[
<p>I have not used Java in <i>many</i> years now, but I'm curious if anyone has anecdotal experience using OpenJDK in production?  Performance vs Oracle Java, bugs/ idiosyncrasies due to internal API differences, etc?</p>
]]></description><pubDate>Wed, 14 Nov 2018 14:51:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=18450189</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=18450189</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=18450189</guid></item><item><title><![CDATA[New comment by thom_nic in "Product Updates Based on Your Feedback"]]></title><description><![CDATA[
<p>I tried this as well, can't reproduce.<p>I've got a 15" "late 2013" rMBP, set display options to "more space."  I've got a total of 45 tabs open between a couple different windows (I use the userChrome hack to re-enable multiple tab rows.) Cycled between tabs, refreshed, navigated around FB, GMail, etc.  Can't get the CPU to do anything out of the ordinary.</p>
]]></description><pubDate>Wed, 26 Sep 2018 03:12:47 +0000</pubDate><link>https://news.ycombinator.com/item?id=18072433</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=18072433</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=18072433</guid></item><item><title><![CDATA[New comment by thom_nic in "Dropbear SSH, a lightweight alternative to OpenSSH"]]></title><description><![CDATA[
<p>If anyone is interested in <i>other</i> lightweight tools to complement a minimal embedded linux distro, check out Troglobit's GitHub repo: <a href="https://github.com/troglobit" rel="nofollow">https://github.com/troglobit</a>.  He has a collection of tiny apps perfect for embedded systems, such as...<p><pre><code>  - mdnsd (not in Busybox), 
  - merecat httpd (much more full-featured than busybox  httpd) 
  - inadyn dynamic DNS updater
  - finit (IMO much nicer than busybox's runsv)
  - watchdogd
  - uftpd
  - ntpd (with ipv6 support!)
</code></pre>
He has been super responsive to requests as well.</p>
]]></description><pubDate>Wed, 15 Aug 2018 15:07:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=17766570</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=17766570</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=17766570</guid></item><item><title><![CDATA[New comment by thom_nic in "Azure Government and ICE"]]></title><description><![CDATA[
<p>I hate to say it, but demonizing ICE seems like the wrong thing.  It's the executive administration that direct ICE and Congress that tells ICE the laws to enforce.<p>That's not to say they are blameless but we could point fingers at pretty much every federal agency.  ICE is just in the crosshairs at the moment.</p>
]]></description><pubDate>Mon, 18 Jun 2018 16:11:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=17339350</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=17339350</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=17339350</guid></item><item><title><![CDATA[New comment by thom_nic in "Making a Statically-Linked, Single-File Web App with React and Rust"]]></title><description><![CDATA[
<p>How about a web interface on an embedded device?</p>
]]></description><pubDate>Thu, 05 Apr 2018 15:51:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=16766015</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=16766015</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=16766015</guid></item><item><title><![CDATA[New comment by thom_nic in "Announcing Flutter beta 1: Build beautiful native apps"]]></title><description><![CDATA[
<p>> I really don't want to learn dart<p>Literally half of programmers: "Ugh why can't everything be Javascript"
Other half of programmers: "Ugh Javascript is the worst language in existence"  /s<p>Given that javascript (esp on mobile) has a hard time reaching native performance, they presumably chose Dart because its design makes it immensely easier to target native iOS and Android without drastically augmenting JS to the point where it's no longer JS.<p>If there's a non-JS language that's easy to learn for a JS programmer, Dart (and I guess, TS) are it.</p>
]]></description><pubDate>Tue, 27 Feb 2018 16:12:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=16474748</link><dc:creator>thom_nic</dc:creator><comments>https://news.ycombinator.com/item?id=16474748</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=16474748</guid></item></channel></rss>