Recent submissions

Comment · 1 year ago
I love that the black trash cans say "Microsoft" on them, for some reason.
Comment · 1 year ago
Comment · 1 year ago
Comment · 1 year ago
This apparently works on Pro versions of Windows, but not the Home versions which don't support domain-join.
Comment · 1 year ago
> We’re removing the bypassnro.cmd script from the build to enhance security and user experience of Windows 11. This change ensures that all users exit setup with internet connectivity and a Microsoft Account.

"enhancing security and user experience" -- what a ridiculous, bold-faced lie. Bravo Microsoft.

Comment · 1 year ago
This is an incredibly inflammatory and culture war-charged take. Even if you think the people working at this government agency were politically driven, there is public evidence to support that they did good work and were helping modernize government IT in a very cost-effective manner.
Comment · 2 years ago
Stelo is essentially a binned, feature-restricted version of the G7 that’s available OTC without a prescription. If you qualify for getting a G7, need readings more frequently than every 15 minutes, or have any need for high/low glucose alerts, then you shouldn’t consider Stelo at all, IMO —- it’s strictly an inferior version of the G7.
Comment · 2 years ago
Comment · 3 years ago
There is an entire open-source ecosystem around having direct access to your diabetes data, which predates the commercial availability of things like sharing glucose data live with others. The Nightscout Foundation (https://en.wikipedia.org/wiki/Nightscout) and Tidepool (https://www.tidepool.org/about) are two nonprofit organizations who lead development on open-source products (Nightscout and Tidepool, respectively) which help with this.

While the manufacturer-provided ecosystems function okay, they give you limited data mobility in case you switched to a different diabetes-related product like a CGM or insulin pump. They also introduce a dependency on on a cloud SaaS platform managed by said manufacturer, which can impose limitations, such as not allowing for real-time access to your data (Dexcom requires an approval process to get real-time data from their API: https://www.dexcom.com/webapi) and can have uncertain reliability (Dexcom had a notable outage in 2019, for instance: https://www.wsj.com/articles/diabetes-blood-sugar-data-outag...).

Conversely, you can run a Nightscout server on a Raspberry Pi in your home, or on a cloud server, for yourself and have full access to your data.

Comment · 3 years ago
Are you familiar with Loop? I believe they are currently just intercepting the Dexcom notifications rather than connecting directly over BLE by default for the G6/G7. However the xDrip + xDrip4iOS projects have gotten the G5/G6 BLE protocol to a state of being fairly well understood.
Comment · 3 years ago
Comment · 3 years ago
Like some other commenters mentioned, this is a cool idea, however by storing JSON data inside base64, the length of the URL blows up very quickly as you start storing more state.

While technically URLs have no formal length limit, various sources suggest that URLs with more than around 2,048 characters start causing issues in browsers, and around 8,196 start causing issues in CDNs (https://stackoverflow.com/a/417184). You can work around this partially by not storing this state information in the query string (path/to?<state>) and instead using a hash string (path/to#<state>), and then extract that data in JavaScript such that it's not sent to the server at all.

IMO, the canonical way to solve this problem is using protocol buffers, which you can then serialize into a much smaller number of bytes, which is then base64 encoded. For example, as mentioned in another comment in this thread (https://news.ycombinator.com/item?id=34314578), Yahoo Finance has a 1,616 character-long URL with 1,572 characters of base64-encoded JSON state:

> {"interval":"week","periodicity":1,"timeUnit":null,"candleWidth":4.3486590038314175,"flipped":false,"volumeUnderlay":true,"adj":true,"crosshair":true,"chartType":"line","extended":false,"marketSessions":{},"aggregationType":"ohlc","chartScale":"linear","studies":{" vol undr ":{"type":"vol undr","inputs":{"id":" vol undr ","display":" vol undr "},"outputs":{"Up Volume":"#00b061","Down Volume":"#ff333a"},"panel":"chart","parameters":{"widthFactor":0.45,"chartName":"chart"}}},"panels":{"chart":{"percent":1,"display":"F","chartName":"chart","index":0,"yAxis":{"name":"chart","position":null},"yaxisLHS":[],"yaxisRHS":["chart"," vol undr "]}},"setSpan":{"multiplier":5,"base":"year","periodicity":{"period":1,"interval":"week"}},"lineWidth":2,"stripedBackground":true,"events":true,"color":"#0081f2","stripedBackgroud":true,"eventMap":{"corporate":{"divs":true,"splits":true},"sigDev":{}},"customRange":null,"symbols":[{"symbol":"F","symbolObject":{"symbol":"F","quoteType":"EQUITY","exchangeTimeZone":"America/New_York"},"periodicity":1,"interval":"week","timeUnit":null,"setSpan":{"multiplier":5,"base":"year","periodicity":{"period":1,"interval":"week"}}}]}

The un-base64'd JSON dictionary is 1,162 characters long, 569 of which is composed of just the key names (48 percent!), and most of the remaining fields likely contain their default value. If this was instead encoded in protobuf, the key names wouldn't need to be included, since fields are referenced by their field ID, and default field values would take up little-to-no space since when the default value is present it isn't encoded into the structure. I presume that, if done efficiently, you could likely make an equivalent representation in protobuf that is 1/4th or even 1/8th the size. You also get, for better or for worse, what is essentially obfuscation for free (yes, you can read out the packed format, but without an equivalent protobuf struct definition it's still hard to tell what field is which, and the entire operation becomes much more labor-intensive).

Comment · 4 years ago
Take a look at https://github.com/jwoglom/pumpx2, I’m working with the AndroidAPS folks currently to make it more broadly available. xDrip integration would happen via AAPS.
Comment · 4 years ago
While I’m not a certified security professional, I have looked pretty closely at Tandem’s mobile pairing and remote bolus implementation and it seems to have been designed in the right way. After initializing a Bluetooth connection, the phone and pump complete a handshake wherein a 16 character alphanumeric key appears on the pump screen and you need to enter it on your phone, which then uses it as a shared HMAC symmetric key. Status information and responses then occur in cleartext once authenticated, while bolus operations require messages to be signed with the initial key.

That being said, on the chance that there is a security flaw here I’m willing to eat my words…

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton