Hacker News: winstonwinston

New comment by winstonwinston in "An open DNS recursive service for free security and high privacy"

winstonwinston — Fri, 04 Sep 2026 21:53:57 +0000

> I prefer to run my own local recursive resolver.

Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.

New comment by winstonwinston in "An open DNS recursive service for free security and high privacy"

winstonwinston — Fri, 04 Sep 2026 21:43:23 +0000

When I run a mix of CF and Quad9 resolvers, Quad9 was consistently slower in response times when measured. But it didn’t make any perceivable difference in real usage.

New comment by winstonwinston in "Discovery of a new OpenAI agent message board"

winstonwinston — Fri, 04 Sep 2026 21:05:56 +0000

A “swarm” and “hijacked” reads like DoS and spam at the very least, doubt any of those is legal in german law.

New comment by winstonwinston in "Models Don't Go Rogue"

winstonwinston — Fri, 04 Sep 2026 00:29:51 +0000

If they wanted air gapped environment they would’ve it. I mean, if you want to sabotage your trial by hard constraints you can do it, or you do not do it to see interesting results. They even said it that some constraints were disabled for the test.

New comment by winstonwinston in "Java is memory efficient [audio]"

winstonwinston — Thu, 03 Sep 2026 22:11:52 +0000

No memory ever wasted, consumes all of it.

But this does not seem to be the case anymore. Today I see that eclipse IDE is more memory friendly than Chrome.

New comment by winstonwinston in "uv: Deduplicate all files in the wheel cache"

winstonwinston — Tue, 01 Sep 2026 19:34:58 +0000

I can say that I have used pip only and it does a package manager job well, it just works.

I’m not sure at what uv excel at but reading comments it seems uv is not only package manager but also venv manager.

New comment by winstonwinston in "How to get a free .arpa domain"

winstonwinston — Tue, 01 Sep 2026 18:22:06 +0000

Do these free HE assigned IPv6 prefix(es) just remain valid indefinitely even when not actually being used/routed?

New comment by winstonwinston in "Debian votes to allow "responsible use of generative AI""

winstonwinston — Sat, 29 Aug 2026 16:37:44 +0000

What a fucked up reality when you need to point out that code contributor is responsible for their code.

New comment by winstonwinston in "Apple threat notifications and spyware: what everyone should know"

winstonwinston — Thu, 27 Aug 2026 15:22:14 +0000

Google has been sending some similar alerts long before Apple, those read something like "Government-backed attackers may be trying to steal your password".

New comment by winstonwinston in "Six government passport CAs that Python rejects and OpenSSL accepts"

winstonwinston — Thu, 27 Aug 2026 14:49:04 +0000

`Cryptography` is not a Python stdlib:

  try:
    from cryptography import x509
    from cryptography.hazmat.primitives import hashes
    from cryptography.x509.oid import NameOID
  except ImportError:  # pragma: no cover
    sys.exit("missing dependency: pip install cryptography")

Then it goes on with a subprocess for openssl for a case that `cryptography` package does not handle.

Why not submit issue with `cryptography` project to get it fixed if it is a problem that needs fixing?

New comment by winstonwinston in "VMs won't contain cyber-capable agents"

winstonwinston — Wed, 26 Aug 2026 17:45:02 +0000

I have no idea what you mean.

It is no surprise that known unpatched CVEs will be exploited. Perhaps more effort should be put into shipping fixes faster than writing blogs about exploiting known issues.

New comment by winstonwinston in "Migrating a Synology NAS to a UniFi UNAS Pro 8 with Robocopy, SMB Multichannel"

winstonwinston — Mon, 24 Aug 2026 05:49:39 +0000

You could just run multiple rsync processes using different src and dest paths to achieve multiple copy streams. Anyway this would not be likely much faster if rsync is run over encrypted SSH due to CPU performance, compared to unencrypted SMB.

New comment by winstonwinston in "How a Texas student blew the whistle on a rogue AI hacking attempt"

winstonwinston — Sat, 22 Aug 2026 21:14:03 +0000

Well, when I go look at the “victim repository”, to me that looks like manufactured persona with pointless vibe codes projects, a test playground so to speak. It does not appear that they actually let it target an actual persona/project.

New comment by winstonwinston in "Giving an LLM your prod database is easy. Taking access away is the hard part"

winstonwinston — Sat, 22 Aug 2026 08:33:46 +0000

Blog post is displayed for a moment and shortly after the post text is replaced with a cryptic error about regex parsing. I guess it has something to do with Safari javascript engine. Anyway, the current state of web development is so pathetic.

New comment by winstonwinston in "Every Model Cheats"

winstonwinston — Fri, 21 Aug 2026 01:56:09 +0000

It would loose automagic?

In a recent full discloure I was reading about a CVE of an LLM agent, the vendor installed a “secure sandbox VM” and then just shared a host’s filesystem read/write to the agent’s VM.

New comment by winstonwinston in "Mozilla revokes Firefox signing key after unencrypted copy lands in GitHub"

winstonwinston — Wed, 12 Aug 2026 11:01:53 +0000

> after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.

Unencrypted signing key. They just don’t care anymore.

New comment by winstonwinston in "Windows 11's built-in Weather app wastes more than 1 GB of RAM"

winstonwinston — Mon, 10 Aug 2026 16:19:51 +0000

> It may be that the 662 MB used by the "Renderer" is shared between many Windows components, so killing that Weather app may not reclaim as much space as you may hope, instead, it would require killing every user of the component, some may be core system apps.

Bet one’s ass that “Renderer” sub-process is embed browser engine allocating working memory for rendering of web app page layout.

New comment by winstonwinston in "Rust-lang/rust is adopting an LLM policy"

winstonwinston — Wed, 05 Aug 2026 09:25:36 +0000

You can’t be upset because they want to know the truth, seriously. When a project has concerns about generated code, it is for a reason.

New comment by winstonwinston in "If technology got better, why did everything get worse?"

winstonwinston — Sun, 02 Aug 2026 16:11:54 +0000

> I think we all know the answer to this: bad incentives.

Better technology, worse food quality, more profit.

New comment by winstonwinston in "Investigating three real-world incidents in our cybersecurity evaluations"

winstonwinston — Fri, 31 Jul 2026 02:03:35 +0000

The blog post is painfully vague. What usually happens when you publish a package on PyPI is that it will be downloaded tens of times shortly after uploading files by some 3rd-party automatic security scanners which then could “detonate” (install and execute) the package in some sandbox and to log what happens.