nbadg

Joined 11 years ago

Karma
1,066
Submissions
298
Member since
Mar 21
[ my public key: https://keybase.io/nbadg; my proof: https://keybase.io/nbadg/sigs/dcldDMJ2pMTWGmilv7CGazD8sND5qukgFdfoR0WcS4g ]

https://github.com/Badg

https://nickbadger.com

@nbadg

View on Hacker News

Recent submissions

Comment · 13 days ago
For anyone else who didn't have "remote perspectives" in their personal technical lexicon: this refers to performing the ACME challenge/response check when validating the domain of a certificate signing request from multiple physical locations, and therefore via multiple physical network routes, in order to make network-level attacks more difficult.

For example, if you were validating example.com, you'd need to set up some response to the ACME challenge somewhere, either through direct DNS-based validation (DNS-01, DNS-PERSIST-01) or through a server running at the resolved A/AAAA IP address for example.com (HTTP-01, TLS-ALPN-01). In all cases, when a CA goes to validate your challenge response, it relies both upon DNS and upon the network integrity between the CA's datacenters and your DNS and/or app servers. Both of these can be subverted, eg via BGP attack, to allow an attacker to replace a DNS response, re-route the destination IP address to a different server, etc, at which point they can inject their own challenge response, and therefore issue their own (unauthorized) certificates.

Multi-perspective validation means that the CA validates your challenge response from multiple datacenters on different networks instead of just one, such that a hypothetical network attack would have to target multiple independent networks in order to successfully issue their unauthorized certificate.

More info:

https://letsencrypt.org/2020/02/19/multi-perspective-validat...

https://community.letsencrypt.org/t/multi-perspective-valida...

Comment · 27 days ago
Comment · 1 month ago
Comment · 2 months ago
Good post, bad title.

From the title alone, I'd expect a typical think-piece from someone (possibly outside the EU) about overregulation, "the solution is no regulation at all", etc. Instead, it's a solid critique of the recent packaging/packaging waste regulation debacle, from a constructive angle. The first section hits the nail on the head: "a good idea, a terrible implementation".

Unfortunately, this feels like a frequent refrain when it comes to the EU. And even more unfortunately, even just this ever-so-slightly-more-nuanced take seems to frequently be drowned out by the two extremes -- "all regulation is bad and we need pure unadulterated free market capitalism" or "all capitalism is bad and we need pure unadulterated regulation" -- which are by far the two loudest voices in the room.

The OP has some good suggestions about this particular regulation (which should definitely be considered! Fix things are broken; don't just throw the baby out with the bathwater!), but I'd personally be interested to see things that try to understand and treat the root cause instead of yet another symptomatic regulation. Maybe walking further down the path towards federalization? Iunno, but if I had a dime for every time I've thought "good idea, bad execution" as an EU resident... I'd have a lot of dimes.

Comment · 2 months ago
This shows a profound ignorance for how much of modern life, especially within a bureaucracy, is powered by banal software like office suites.

If you can cripple the everyday workings of government, even temporarily, by shutting off access to Microsoft word, then that is a serious security concern. End of story.

Comment · 9 months ago
This is a sensationalist piece of not-news.

The CSU/CDU Union party (from which Merz comes) has been, at least in recent historical time, consistently pro-nuclear (at least in terms of their actions). They have consistently voted to lengthen contracts with nuclear providers and consistently advocated for pro-nuclear policies, even when the power companies themselves had long since committed to ceasing all nuclear power production in Germany.

Additionally, the exit out of nuclear power was decided following public outcry after Fukushima -- ie, still squarely within the Merkel government. Merz has been consistently anti-Merkel.

So put into context, the article is saying "the current chancellor of Germany, Merz, thinks leaving nuclear behind was a strategic mistake!" while ignoring "whose party has consistently been pro-nuclear, whose predecessor, who (by the way) Merz doesn't like and frequently and loudly disagrees with, only presided over the decade-long phase-out in response to public outcry following a major nuclear disaster".

IMO this is about as newsworthy as what he ate for breakfast.

Comment · 9 months ago
I mean, for retail investors outside the US, the question you're asking boils down to „does purchasing power parity follow popular US domestic market indices?“, to which the answer is a resounding no.

There may be some offset for goods imported from the US, but that's a minority of consumer goods globally, and even then, the purchase currency will usually still be the local fiat, and then the attractiveness of the US index fund still has to be weighed against the performance of non-US-based indices in that same local currency as opportunity cost.

Comment · 10 months ago
Putting aside, for a moment, a lot of important questions around (gestures broadly at the political situation in the US), what are the economic implications of a conflict between the US and Venezuela?

Is this likely to increase inflation? And what does this mean for FX -- are we likely to see a further weakening of the dollar, particularly against ex EUR?

Comment · 10 months ago
Certainly for many applications, the autoint approach would be fine.

The benefit of uuid in this case is that it allows horizontally scalable app servers to construct PKs on their own without risk of collisions. In addition to just reducing database load by doing the ID generation on the app server (admittedly usually a minor benefit), this can be useful either to simplify insert queries that span multiple tables with FK relationships (potentially saving some round trips in the process) or in very niche situations where you have circular dependencies in non-nullable FKs (with the constraint deferred until the end of the transaction).

Comment · 10 months ago
I'm also not a huge fan of leaking server-side information; I suspect UUIDv7 could still be used in statistical analysis of the keyspace (in a similar fashion to the german tank problem for integer IDs). Also, leaking data about user activity times (from your other comment) is a *really* good point that I hadn't considered.

I've read people suggest using a UUIDv7 as the primary key and a UUIDv4 as a user-visible one as a remedy.

My first thought when reading the suggestion was, "well but you'll still need an index on the v4 IDs, so what does this actually get you?" But the answer is that it makes joins less expensive; you only require the index once, when constructing the query from the user-supplied data, and everything else operates with the better-for-performance v7 IDs.

To be clear, in a practical sense, this is a bit of a micro-optimization; as far as I understand it, this really only helps you by improving the data locality of temporally-related items. So, for example, if you had an "order items" table, containing rows of a bunch of items in an order, it would speed up retrieval times because you wouldn't need to do as many index traversals to access all of the items in a particular order. But on, say, a users table (where you're unlikely to be querying for two different users who happen to have been created at approximately the same time), it's not going to help you much. Of course the exact same critique is applicable to integer IDs in those situations.

Although, come to think of it, another advantage of a user-visible v4 with v7 Pk is that you could use a different index type on the v4 ID. Specifically, I would think that a hash index for the user-visible v4 might be a halfway-decent way to go.

I'm still not sure either way if I like the idea, but it's certainly not the craziest thing I've ever heard.

Comment · 10 months ago
For those that can't get it to load (it takes a minute, and I noticed my desktop's fan kick it up a notch while things were getting initialized, so... YMMV): this is a portfolio site done via a cozy-gaming-style AWSD game where you drive around in a jeep-like thingamabob. There are some cute easter eggs, including a sort of... shrine to each of the socials, which you can run into with your car and knock over (though the links remain clickable, of course!). It also looks like there's some degree of global state; for example, you can "sacrifice yourself to the gods of chaos" (ie drive into a portal) and a counter on the side of the portal goes up, presumably for everyone (since I certainly didn't drive into it 1700 times myself!). There's a strongly consistent art style, and just generally... seems pretty polished. Or at least, that's what it felt like after 5 minutes of driving around.

All in all I'd say, I'm impressed, and enjoyed it. Though I think the HN title ("handsdown one of the coolest 3D websites") is maybe a bit much. It's an extremely-well-executed portfolio site; no more, no less.

Comment · 11 months ago
> I didn't mean that you could 3-D print tiny laparoscopes or even visible-light metamaterials; I meant that you could 3-D print machines for making tiny laparoscopes and visible-light metamaterials.

Huh, thanks for the clarification, that's an angle I hadn't considered.

> I think you're overlooking the part of the iceberg that's currently below the waterline of economic feasibility.

Hm. I think to a degree you probably have a point; I certainly agree that people tend to overlook the explosion of new development that is made possible by drastic cost reductions, though with the aside that having price insensitive applications is often instrumental in developing the technology that enables those cost reductions in the first place, because it allows for profitability early on in the technology's maturation, as opposed for "well it won't be profitable until we hit X milestone in Y years".

That being said, it's not clear to me how many mass-market biological applications would be possible under reasonable regulatory regimes. Maybe I'm just showing my ignorance when it comes to small-scale biological applications, but can you name some examples? (Or is this more of a "you never know until somebody does it" kind of thing?)

Comment · 11 months ago
I'm not trying to say that there aren't plenty of applications for small scale mechanical devices, but rather that the applications where FDM-style 3d printing would be an appropriate manufacturing process are likely to be largely biological.

Biological applications (of which tooth and bone would of course be included) are extremely well-suited for additive manufacturing because they're frequently one-offs, and therefore cannot scale, and oftentimes highly insensitive to price. Mass market products are a whole different ball game; even for applications where there isn't currently an economical manufacturing method, I'm very skeptical that there's a path where AM could be scaled out to the volumes required to sell the end component at a commercially viable cost.

To be fair though, I didn't do a good job expressing that, because I just took it for granted that it would be clear that large ratios between feature size and nozzle size are rarely economical for FDM-style AM, which isn't necessarily an obvious observation.

Comment · 11 months ago
From TFA, they're using it to print bioinks. Think scaffolding for cell cultures.

At these kinds of physical scales, biology is almost certainly a much larger market than mechanical applications. A 20 um line width (slightly less than one thou for US folks) is certainly a tolerance you might encounter on a drawing for subtractive manufacturing, but for addative, feature sizes that small will be strength limited.

Comment · 11 months ago
Having used both extensively, Geizhals doesn't hold a candle to McMaster. McMaster is, bar none, the single best e commerce website I've ever used (if you already know what you're looking for, and definitely still top shelf if you don't).

But McMaster and eg Amazon are optimizing for different things. McMaster knows its clientele isn't going shopping, they're solving problems. As such, McMaster focuses on helping your solve your problem and get back to work. Amazon, on the other hand, is focused on just selling you "as much 'anything' as possible" and wants you to spend as much time there as possible in the hopes that you'll stumble on an impulse buy.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton