chrismorgan

Joined 14 years ago

Karma
26,998
Submissions
6,652
Member since
Sep 13
https://chrismorgan.info/, [email protected]

I’m available for hire for consulting, training and mentoring in Rust, everything web, performance and more: https://chrismorgan.info/hire-me/

[ my public key: https://keybase.io/chrismorgan; my proof: https://keybase.io/chrismorgan/sigs/rEm41-0pghG3ITW8S5HeuFLA9TznvPSlg9NKgXXRXqQ ]

View on Hacker News

Recent submissions

Comment · 14 minutes ago
Some of the worst-behaving scrapers are using residential proxies now, and when each new request comes from a new IP address, IP banning is completely ineffective.
Comment · 5 hours ago
Your 100,000-word books would probably be better trimmed to 10,000 words.
Comment · 5 hours ago
I agree with most of what you say, but you consider it fixable, and I disagree with you there.

If you want to personify them: it’s a million clones of the one person, who is a tolerable actor, able to give impressions of others on request, but still ultimately one person.

As far as different models are concerned, they’re disturbingly close to being the same person, but perhaps we can call them siblings, raised in the same home.

Comment · 14 hours ago
Proof of work is bad rate limiting. The power asymmetry is too immense. Worst-case example is SHA-256, where an attacker with dedicated hardware is millions of times as efficient as common users. Even with a less boneheadedly foolish POW scheme (quite incidentally, every single web POW scheme that I know of started with SHA-256, and almost all still use it), the ratio is easily in the hundreds or thousands, too great an imbalance to bridge. (That is: if you want to require an attacker to burn one second of computation time, some cheap smartphone user will now be stuck for five minutes. If you reduce the difficulty so that user is only stopped for five seconds, your attacker is now burning less than 20ms.)

Most web proof-of-work stuff has worked because it breaks the normal flow and the typical scraper is supremely dumb, not because of the proof of work, which has largely been a total red herring.

Comment · 1 day ago
Comment · 2 days ago
That’s not bare else.
Comment · 2 days ago
The submitted title

> The 'else' keyword is probably a literal translation from German (2020)

is editorialised, inaccurate, and very misleading.

The actual title: “if … then … else had to be invented!”

And the content doesn’t say anything about it being a literal translation from German; rather:

> What they do say is that this document was originally written in German and hastily translated into English. I think a carefully-chosen German word was probably translated as an archaic English word and then never revisited.

Wild speculation, and definitely nothing about literality of translation.

As for the author’s description of it being archaic, well, I’d call that misleading too. Bare “else”, arguably (definitely not colloquial in most dialects), but as “or else”, perfectly current.

Seems perfectly reasonable to me that someone considered the options, decided “otherwise”, “or else” too wordy and confusing in its own way, and so settled on bare “else” as the best choice (which I think it is), not how people mostly speak, but perfectly legitimate, and concise.

(In other words: I think we’d have settled on “else” even without the possible German step. This too is speculation, of course.)

Comment · 2 days ago
That’s “or else”. Bare else is no longer common.
Comment · 6 days ago
Comment · 7 days ago
My wife is currently developing some stretch marks due to pregnancy. I intend to appreciate them for a great many years to come.
Comment · 7 days ago
When you injure yourself and get a lovely bruise, it can be a good story.

When you don’t remember how you got a bruise, it’s a bit odd, but it happens.

When you injure yourself and it hurts a lot and the bruise is barely even noticeable, that’s the worst. You earned a nice colourful bruise!

Comment · 7 days ago
I don’t know about that specific software, but I would be surprised if it decoded message bodies, which is entirely unrelated to TLS termination and shouldd be entirely unrelated to routing. So I would expect you would still be vulnerable.
Comment · 7 days ago
There are reasons why web content tends to compress better with Brotli than with Zstandard, and I don’t believe they’re algorithmic.
Comment · 8 days ago
Comment · 9 days ago
Almost all browsers require certificates be recorded in Certificate Transparency logs <https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...>. Since those logs are empty in this instance, you can state that no one used a forged certificate with a mainstream browser, which is the most obvious (and desirable) attack type.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton