Hacker News: woodruffw

New comment by woodruffw in "Keys Not Included: recovering the signing keys for US driver's license barcodes"

woodruffw — Thu, 17 Sep 2026 04:42:20 +0000

As far as compact encodings go, this kind of patch-and-fill technique isn't particularly egregious. The alternative mentioned (where the verifier has to be aware of a bitfield that defines the to-be-signed elements) is much easier to mess up!

New comment by woodruffw in "A single firm is behind OpenAI, Anthropic, and Meta hacking scandals"

woodruffw — Thu, 17 Sep 2026 00:06:49 +0000

I didn’t realize it was hasbara to describe Unit 8200’s proficiency as propaganda. One would reasonably expect the exact opposite.

New comment by woodruffw in "A single firm is behind OpenAI, Anthropic, and Meta hacking scandals"

woodruffw — Wed, 16 Sep 2026 02:11:48 +0000

“Space camp,” not “space.” As in, a place to park dorks.

(The problem with “alumni” is that it means very little in mandatory systems. Unit 8200 is where Israel parks its dorks, and it stands to reason that dorks are the ones who tend to start tech firms.)

New comment by woodruffw in "A single firm is behind OpenAI, Anthropic, and Meta hacking scandals"

woodruffw — Wed, 16 Sep 2026 01:32:04 +0000

> The idea that people bend over backwards to hire criminals as subject matter experts on security is largely a Judaic practice that television perpetuates in spite of reality.

What?

> If you're convicted of hacking in Israel, Unit 8200 will probably send a recruiter.

To the best of my understanding, Unit 8200 is filled with military conscripts, i.e. is primarily 18-somethings doing their mandatory service. You get assigned to it based on an aptitude test. The widely held idea that it’s a uniformly elite entity rather than the IDF’s space camp is a triumph of propaganda.

New comment by woodruffw in "Homebrew 7.0.0"

woodruffw — Sun, 13 Sep 2026 22:21:10 +0000

I’m one of Homebrew’s security maintainers, and I don’t recall any contact with you. Who did you reach out to?

If you have concrete concerns, please bring them to us. Vague concerns and hand-waving about “people getting hurt” isn’t appropriate or productive.

New comment by woodruffw in "The death of San Francisco's Market Street"

woodruffw — Fri, 04 Sep 2026 01:26:51 +0000

That’s fascinating; like others, I’d love to see the source data.

New comment by woodruffw in "The death of San Francisco's Market Street"

woodruffw — Thu, 03 Sep 2026 22:16:35 +0000

That makes sense, given that the median car mile probably isn’t in a dense urban core. The more accurate comparison would require us to know pedestrian fatalities per mile in urban areas.

New comment by woodruffw in "The death of San Francisco's Market Street"

woodruffw — Thu, 03 Sep 2026 21:12:45 +0000

The primary driver appears to be economics (vis a vis the pandemic and slow recovery afterwards), which has very little to do with the author’s primary target (cyclists and buses).

A more sensible null hypothesis would be that cyclist and bus traffic follow the same rough pattern as car and pedestrian traffic, i.e. economics is always the leader for whether people show up in a given public space. That would explain why NYC and most European cities haven’t seen any real negative consequences to aggressively pedestrianizing and re-allocating their streets away from single-occupant car traffic.

New comment by woodruffw in "How accurate have Ed Zitron's AI skeptic predictions been?"

woodruffw — Wed, 02 Sep 2026 03:01:55 +0000

I mean, the point of Frankfurt’s bullshitter is that we know they’re bullshitting (or more expansively, Frankfurt gives us a set of criteria to test them against). We know they don’t care about the truth value of their statement, only that they are misrepresenting themselves because of a hidden “enterprise.” But there’s no such unknown enterprise in either’s case, and neither appears to be misrepresenting themselves (to my point about appearing earnest). Maybe that latter part is itself deception, but without the former they would fall into Frankfurt’s classification of a “liar” instead.

(I have to admit a bias when it comes to Frankfurt: I don’t think On Bullshit is that convincing. In particular, I think Frankfurt doesn’t do a good job of motivating the connection between bull sessions and bullshit in his strong sense, and many of his examples - like the Pascal/Wittgenstein one - don’t demonstrate misrepresentation either.)

New comment by woodruffw in "How accurate have Ed Zitron's AI skeptic predictions been?"

woodruffw — Wed, 02 Sep 2026 02:28:34 +0000

I don’t think these mental states are in evidence for either of them. I think they’re both credibly earnest in their views.

(Frankfurt’s characterization of the bullshitter rests on not just the truth value being absent, but also on the bullshitter’s misrepresentation of what he’s “up to.” I don’t feel that either Zitron or Altman is misrepresenting what they’re getting up to.)

New comment by woodruffw in "How accurate have Ed Zitron's AI skeptic predictions been?"

woodruffw — Wed, 02 Sep 2026 01:16:30 +0000

Without reference to either person, I think this is essentially a misunderstanding of Frankfurt’s analysis: On Bullshit is about expressing sentiments without caring about their truth value, i.e. the concept of a “bull session.”

Both Altman and Zitron are the opposite of Frankfurt’s bullshitter, because they both appear to evince genuine care for the truth value of their position.

(Frankfurt is very subtle about this, in that he distinguishes the kind of performative lying you’re suggesting as distinct in moral and rhetorical content from bullshitting. The liar wants you to believe a specific thing; the bullshitter wants to regale you.)

New comment by woodruffw in "uv: Deduplicate all files in the wheel cache"

woodruffw — Mon, 31 Aug 2026 23:07:46 +0000

It depends on what you mean. The PEPs are essentially a behavioral core, and each tool (build backend, etc.) adds on top of that core. If you’re installing a package, any installer should work; if you’re developing a package, you may be subject to implementation details from your development tool of choice.

Brocards for Vulnerability Triage

woodruffw — Mon, 31 Aug 2026 15:59:47 +0000

Article URL: https://vulnbrocards.com/

Comments URL: https://news.ycombinator.com/item?id=49511315

Points: 1

# Comments: 0

New comment by woodruffw in "uv: Deduplicate all files in the wheel cache"

woodruffw — Mon, 31 Aug 2026 14:10:17 +0000

We do a lot more than that, e.g. how to cache distributions is not defined anywhere within PEPs (and should not be, since it’s a purely internal tool decision). But yes, it helps that uv implements the PEP for detached metadata, particularly during resolution.

New comment by woodruffw in "uv: Deduplicate all files in the wheel cache"

woodruffw — Mon, 31 Aug 2026 13:43:01 +0000

I think this sockpuppet is referring to a different thread I commented in yesterday. But I think it would be an uncharitable stretch to read what I wrote in an official voice, much less “pro” in an unqualified sense.

New comment by woodruffw in "A CVE Dispute"

woodruffw — Mon, 31 Aug 2026 13:39:57 +0000

This kind of hellish experience is a great example of the CVE system trying to have it both ways: when on the offense it’s a rich source of information for defenders, and when on the defense it’s just an opaque ID for coordination that implies nothing about the quality or correctness of the underlying report.

New comment by woodruffw in "CobaltC – The Successor to C?"

woodruffw — Mon, 31 Aug 2026 04:33:57 +0000

Another one?

New comment by woodruffw in "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel"

woodruffw — Sun, 30 Aug 2026 23:40:54 +0000

My understanding is that IME and PSP come more from the world of corporate compliance than anything else. In other words they exist for x86 because x86 gets deployed in corporate settings, and any ISA that attempts to occupy a similar niche will meet a similar fate.

(Compare ARM’s TrustZone, etc.)

New comment by woodruffw in "European Commission Revives Push for Encryption Backdoors in ProtectEU Strategy"

woodruffw — Sun, 30 Aug 2026 22:20:25 +0000

I don’t think the average American voter “genuinely” thinks that they’re on a Blues Brothers-style mission from god to deliver liberalism and freedom to the world. I would be surprised if that’s even a minority view among voters.

New comment by woodruffw in "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel"

woodruffw — Sun, 30 Aug 2026 21:25:51 +0000

Is there some evidence that x86 is uniquely prone to exploitable memory corruption? I haven't seen it, if so.

> That's why Huawei and the Chinese government aren't even trying any more to make western CPU architectures secure, it's a hopeless cause.

I suspect there are much more boring reasons for this, ranging from licensing to geopolitics (i.e., it being useful/valuable to have a domestic base of engineers who can design an ISA).