LeonM

in Switzerland there is a thing, that if a product or service has the name "Swiss" in its name, then it can be sold for any price regardless of quality

That's just basic marketing. You'll see that in most countries, I don't believe that it is unique to Switzerland.

For example: in the US you'll see many products that say "made in America" on the box. Those will likely outsell competing products, even if those are cheaper and better quality still.

And similarly: if you try to sell the "made in America" product in a different country it'll likely by outsold by the "made in [country]" products there.

The title makes it sound like they just did a seed round, but the seed round was announced in August of last year [0].

Their website landing page is now also showing the software is no longer maintained. No mention of why they made this decision, my best guess is they burned through their seed money and were unable to attract further investments.

[0] https://www.tensorzero.com/blog/tensorzero-raises-7-3m-seed-...

I was wondering the same thing. I had never heard of Portal before seeing this post. Actually had to pause the video to search what a Meta Portal even is...

Too bad because it looks like a neat device. This feels the same as discovering a neat SaaS product through a "XYZ is shutting down" post on HN.

For on-the-go compute I am using a 2017 12-inch Macbook (AS1534). This is a lesser known model, it was simply called "12 inch MacBook" (not air or pro) [0].

It has the aluminium body, it is ridiculously thin (3,5mm thinnest point, 13mm thickest point, feet included), it weighs just 920 gram. It charges via USB-C. It has a very good 2304 × 1440 (16∶10) IPS "retina" screen.

I run mine with MacOS/Linux dual boot, I charge it using my phone charger. It keep it in my go-bag at all times. I never have to worry being without it.

What to love:

- Super small, yet very sturdy.

- Can be found for relatively cheap (I paid €300 for mine 2 years ago)

- Really nice screen.

- Keyboard size is really good, though travel is obviously minimal with such a thin laptop.

- Plenty of battery life (and new batteries still available at Mac store last time I asked)

- upgraded model has 1.4Ghz dual core i5, 16GB RAM and 512GB SSD, which is still more than enough for on-the-go use.

What not to love:

- Has only 1 I/O port (USB-C), which is also used for charging.

- No longer receives MacOS updates, if you find a 2017 production model you get updates up to MacOS 13.

- Linux support is not great. The WiFi/Bluetooth chip (BCM15700A2) is not fully supported in Linux, WiFi works but Bluetooth doesn't. Audio via headphone jack works, but speakers don't. There are some experimental patches to get BT and speakers somewhat working, but it's not great.

If you can find it, get a late production model (2017) with the 1.4Ghz CPU upgrade, it will have 16gb RAM instead of 8gb (earlier models) and receive MacOS updates up to MacOS 13.

[0] https://en.wikipedia.org/wiki/12-inch_MacBook

Glitching attacks are typically performed by switching the supply voltage at quite high frequencies, a typical low-voltage detection won't trigger a reset under such conditions. And this is also why glitching attacks are often performed by spiking higher voltages, not lower. See for example Joe Grant's latest video on breaking crypto wallets [0].

Low-voltage detection is usually implemented as simple comparator which should trigger instantly, but often only on a single Vcc pin, and due to the decoupling caps found on a typical circuit design there is effectively an RC circuit that filters short fluctuations of supply voltage. So most low-voltage detection implementations only trigger on 'longer' periods of low voltage.

Traditionally low-voltage detection features (like brown-out detection) are there to guarantee functionality of the uC itself or the device the uC controls. It is typically not intended as a defence measure against these types of attacks. In fact, 15 years ago it may not have been much of a concern.

[0] https://www.youtube.com/watch?v=MhJoJRqJ0Wc

Similar story, I had a customer who wanted me to change the entire UI of a legacy application, because some information would not fit on the ancient 1024*786 15" desktop monitor of one employee, meaning he would have to use horizontal scroll constantly.

I recommended them giving this employee a larger monitor, not only would that be much cheaper than having me rebuild the entire UI, it would also boost this employee's productivity. Not to mention that swapping a monitor takes 10 minutes, changing a UI probably weeks.

Customer insisted to change the UI, because "if we give him a new monitor, everyone in the office will want one". I nearly got fired for responding with "Great! Then everyone can benefit from more productivity!".

In the end we did change the UI, I believe the total cost was something like 30k. The customer had maybe 15 employees, so new monitors would still have been much cheaper.

A few months later their offices were remodelled with expensive designer furniture, wooden floors and custom artwork on the walls. Must have cost a fortune. In the end, the employees still worked on ancient computers with 15" monitors, because new computers didn't fit the budget.

I don't think that it would take that much.

It is my understanding that the A18 CPU is pretty well understood already. AFAIK it doesn't have the new architecture that is keeping the Asahi team from supporting the M4 and M5 for example.

But I guess we'll have to wait for devs to get their hands on a Neo device

I'm not sure what Hector's personal choices have to do with not "trusting" a piece of software? It's open source, so if you don't trust the quality of the software, then just inspect it yourself?

Also, FWIW: Hector/Lina is no longer associated with Asahi anymore.

I'd take that claim by Mecha with a huge grain of salt.

How are they going to fund 7 years of support for a device that sells maybe a few thousand units? How are they going to guarantee they will still be around, and interested in maintaining the device drivers in 2033?

The Linux kernel project will remove the device drivers from the mainline kernel if they are no longer actively maintained and in use. So it is very likely that the support will be dropped from the mainline kernel way before 2033, as there probably won't be any users of this device remaining, and the original developers long gone.

Call me negative, but I expect that this company wil just vanish after some time. The team will just move on, maybe even start again under a different name, but there will be nobody to be held responsible for promises and claims they made in the past.

I do the same. I can SSH into my router at home (which is on 24/7), then issue a WOL request to my dev machine to turn it on.

You don't even have to fully shut down you dev machine, you can allow it to go into stand-by. For that it needs to be wired by cable to LAN, and configured to leave the NIC powered on on stand-by. You can then wake up the device remotely via a WOL magic packet. Maybe this is possible with WLAN too, but I have never tried.

Also, you don't need a Tailscale or other VPN account. You can just use SSH + tunneling, or enable a VPN on your router (and usually enjoy hardware acceleration too!). I happen to have a static IP at home, but you can use a dynamic DNS client on your router to achieve the same effect.

I used to work as a freelancer back in the days. I worked a lot for a customer became a good friend. At first I'd work on his projects, but this ultimately shifted to a model where I'd work on projects for his clients, I would bill him, and he would add his margin and bill the end-customer. It worked out great this way.

One day I got a call from him saying that our 'mutual' customer had an urgency job. They were supposed to do a national roll-out of a new payment system, but seemed to have forgotten about a bunch of legacy PoS systems that were still operational and couldn't easily be replaced. Because I was seemingly the only one that was still familiar with this particular system (I worked on it once in the past), the end-customer approached my friend whether I would be available to do this quick. This was in late November, and the rollout was planned for Januari. Because this end-customer is a government org, I realised we'd be guaranteed they wouldn't be working during the holidays (which, in my country is typically 2 weeks for Christmas and new-year's), so really we had only 10 days or so to get it done in time for their team to test it before they holiday shutdown.

I didn't feel like doing such a complex job on such tight deadline. So, I quoted a much higher rate than normal. I also quoted for a multitude of hours that I thought was required, due to the typical overhead that this large end-customer would surely incur. Finally I also added a retainer fee, because I knew that if problems would occur (likely on the last day before the rollout), I'd have to drop anything I was doing and work for them.

I got the job.

I worked feverishly to meet the deadline. I cancelled commitments on other projects, paid an extortionate amount for testing hardware and overnight delivered to my office, bought very expensive testing gear, signed all the NDA's required to work on PoS card payment interfaces, etc. I then worked basically round the clock for 10 days straight to get it done. I did get it done in time, submitted the code to the repository and fired an email to the team-manager that it was in fact done a day early. ...I was greeted with an auto-reply the manager would be on holiday till mid-January, which was the week that entire new payment system had to be rolled out nation-wide.

I wasn't feeling great about it, but my friend urged me to send the invoice for the work I had done, and also the retainer for the rest of December and January. This would allow the customer to write of the expenses in the current calendar-year. I sent the invoice, it was the most amount of money I'd ever invoiced, and I'd normally invoiced per month, this was for a mere 10 days.

December passed, no response from the supposed review team. I stayed on stand-by, declined any other work, stayed sober during the various new-year's office parties, always brought my laptop along, etc.

January came and went. Still no response from the code review team. The new payment system was due to be rolled out mid-january, but nothing had happened. The company had done extensive ad-campaigns beforehand announcing the new payment convenience for their end-users, so the only 'feedback' I saw were frustrated users on Twitter. I still felt bad about charging for the retainer.

This kept going. At some point I did stop sending invoices for the retainer. My friend always paid me in advance (the end-customer was notoriously slow to pay, though did always pay in the end), and I didn't want to cause him too much exposure.

To my knowledge, the software I wrote was never used in the end. To the public it was stated that the PoS systems were simply too old to be upgraded (not true, obv) and that they'd replace them 'soon'. It is now 4 or 5 years laters, the old PoS terminals are still there, sans the functionality I added.

By pure coincidence, years after the job I found out that an old friend of mine, who was also a freelancer at the time, was tasked around that same time by the same customer to do a code-review of a supposed PoS system upgrade. Without realising, he reviewed my code! He was under the same time pressure, and did the code review during Christmas to deliver the results on time before the national rollout in mid-January. He also charged a huge amount of money for it, was also paid, and also never heard about it again. At least he said he remembered being impressed by the quality of the code, and didn't find any defects. So that's about the best outcome of the project I guess.

My takeaway from this: If you are a freelancer, and a large customer wants something done in a hurry, charge more than you ever dared, don't feel bad about it. You'll find that suddenly there isn't as much of a deadline anymore. If the customer declines due to the price, you should be happy for dodging a bullet.

I bought the top of the line TV from Samsung in 2011. The 'smart' functionality services went offline after a year or two, which means all 'smart' functions no longer work and I am now happily using it as a dumb TV.

Eventually every smart TV becomes dumb when they inevitably shut down the backend services.

Story time!

I've had a very similar problem with my cable internet circa 2010. It must have been DOCSIS 3.0. Multiple times a day my connection would stop working completely. The modem's 'connected' and 'carrier up' and 'carrier down' lights were on, and I had LAN communication with the modem, but no data would pass though on the WAN side.

From the management page of the modem (I later learned you weren't supposed to know about) I could see the upstream and downstream carriers were correctly established and still operational, but on the IP (PPPoE) level the TX (upstream) packet counter was increasing, but the RX (downstream) packet counter did not. Releasing the IP on my router (remember, it was PPPoE), then waiting 10 minutes or so before renewing the IP via DHCP would bring connectivity back.

I would call to my ISP (the largest ISP in my country) to try to resolve the issue. Every. Single. Time. I had to explain to the support employee that yes, I did disconnect and reconnect power, yes, my computer's software was up to date, yes, I did try connecting via LAN directly to the modem to eliminate any possible router issues, etc.

Now, at this point in the story I should point out that I held a degree in electrical engineering, specialising in embedded systems and high-speed data transmission and also had just about all Cisco networking certifications. I was more than qualified to design cable modems myself, imagine the frustration wasn't able to fix this issue.

One night I came home to the same problem, called customer service again, fully prepared to do the 'dance' of answering every basic troubleshooting question. But to my surprise, the guy on the phone seemed legit knowledgable. When I described him the symptoms I saw from the modem's management page he was rather surprised that I managed to discover that functionality, but said he knew what the problem would be then.

The support employee was quickly to confirm that someone in my neighbourhood hard-coded his IP-address instead of allowing DHCP (a common trick back in the day to get a static IP on a residential cable connection), and that that IP was clashing with the IP their DHCP would assign to my router's MAC address. He asked me what brand of router I had, and had to explain to him that it was a self-built OpenBSD box. His response was: "great! then you probably know how to spoof the MAC on your WAN interface then?". I did, I changed my MAC to a value he gave me, and immediately my connection came back up. He explained me that any MAC address starting with AB:BA (named after the band) was reserved for a special block of customers with this kind of issue.

We continued chatting a bit about DOCSIS, networking technology, modulation types, OpenBSD (it was also his favourite OS) and much more nerdy stuff. At some point I asked him, respectfully, how someone with his knowledge ended up at the support helpdesk of an ISP. He then told me he was the ISP's CTO, in charge of all network operations, and that he was just manning the helpdesk while his colleagues were on a diner break...

Alyssa works for Intel now, so I doubt she'll be doing much contract work for Valve anymore...

For what I remember, most of the DNS root servers used to run Bind9 exclusively. I'm glad to see that this is now more diverse with NSD and Knot also being used (see table 4 in the report).

Nothing against Bind9, but it is almost exclusively maintained by the ISC, so the DNS's future used to depend heavily on the ISC getting the funding needed to continue operating.

I don't understand your sentiment against Cloudflare here.

Cloudflare also delivers a rather large portion of said public infrastructure free of charge. They also released a few of their own projects as FOSS, and regularly contribute.

Granted, the centralisation part worries me too, but it feels like a bit of a cheap shot against CF just because they are a large player.

Yeah, please let this guy tackle Lenovo next.

My Lenovo X1E regularly burns 20% of its CPU cycles on some high frequency recurring interrupt. I did get pretty far with debugging it, but eventually gave up since I can't justify spending so much time on fixing a 'professional' laptop that I paid top dollar for.

It also has a multi-GPU setup that has never worked reliably under Linux, which is ironic as I opted for Lenovo due to its supposedly good Linux compatibility.

Switching between GPU modes is a hit or mis, waking up from stand-by often results in a blank screen, screen flickering, sporadic high fan speeds, etc. And then there's the coil whine, which seems to be fixed in some BIOS versions, then returns in the next. Supposedly it has something to do with power-saving measures.

Since I owned it there have been at least 20 BIOS version releases for 'improved performance and security', but none seem to actually fix anything. It's such a mess.

/rant

My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google.

I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google legitimately. By reading back the code in that email, the attacker was able to claim the Google account as theirs, thus access the Gmail inbox to reset the Coinbase password and access the authenticator backups from the Google Drive.

I would be very curious to see the original message headers of the email though.

What you're saying makes little sense.

Yes, SPF (the original design) is horribly broken and trivially bypassed. The most prominent design flaw is that the inbound SMTP service uses the SMTP (rfc5321) MailFrom address for SPF validation, which is not the same sender address shown to the recipient, they can only see the the message (rfc5321) 'From' header address. SPF originally didn't require the domains in the MailFrom and From addresses to match, so an attacker would simply use a domain they control in the MailFrom address, and the 'spoofed' domain in the From header.

That was in 10 years ago though. DMARC fixed this by adding the alignment requirement, meaning that the domains in the MailFrom and From address must match. By default the alignment policy is 'relaxed', meaning that the MailFrom and From domains can differ in subdomain, as long as they share the same organizational domain. Setting the SPF alignment to strict (aspf=s) like you mention in your post requires the domains to match exactly, with no subdomain differences allowed.

So, it doesn't matter that Google doesn't use strict SPF alignment in the DMARC policy, the fact that they have DMARC already adds the requirement to SPF validation that the domains must match.

Yes, google.com and gmail.com use the same IP ranges in the respective SPF policies, but Gmail will never allow you to send email addresses from a domain that you do not own. This is why domain validation is required when you set up Gmail with a custom domain.

The only scenario where your explanation would hold up, is if the attacker was able to gain control of the DNS of a subdomain of the google.com domain, and successfully validated it as a custom domain in Gmail, then send emails from that subdomain in rfc5321.MailFrom address and the google.com domain itself as the rfc5322.From domain.

From my experience, most businesses (or at least the developers working for them) actually would like to donate or pay for support on the OSS projects they rely on. The problem, at least from my experience, is that it is hard to do so due to legislation, compliance, etc.

Example: I once convinced my employer to donate to some open source projects we relied on. They did, then few months later they got slapped on the wrist by the authorities for not being able to prove where these overseas payments were going to, and that these payments weren't used for funding terrorist activities.

Similarly, I used to contribute to an OSS project, we did get asked by some corps to do paid work like bug fixes or features. The problem was that they required invoices in order for them to be allowed to pay us, so we needed to register as a company, get a tax number, etc. I was a freelancer at the time, so I offered to use my business registration to be able to invoice, then split the profit amongst the contributors. Then the very first paying 'customer' immediately hit us with a 20-page vendor assessment form asking about my SOC2 or ISO27001 certifications, data security policies, background checks of my 'employees' etc. Then I got confronted by my accountant that distributing the payment amongst other people would be seen as disguised wages and could get me into serious legal problems.

Granted, this was some years ago, things have gotten better now with initiatives as Github Sponsors, KoFi and Patreon. But at the same time legislation has gotten more restrictive, doing business with large corps is difficult, expensive and very time consuming. It's not worth it for most OSS maintainers, and similarly it isn't worth the legal headache for the large corps to make these kind of donations.

I volunteer for a historical museum about transportation (mainly steam engines/trains) I was recently approached if I could create an 'interactive video game' to use in the educational corner.

I politely refused, of course, but I did ask why we'd even want that. The reason was simple: we receive government funding to do 'educational stuff', and kids like computer games, right?

Having employees (or volunteers in our case) to educate visitors during all opening hours is a massive challenge for most museums, so an interactive screen/game sounds like the logical solution to ensure the funding is approved each year again.

I hear the same thing from other musea that we collaborate with. Reality is that these systems are broken more often than not. Typically designed on a budget by an external developer, who is no longer employed or paid to maintain it. Employees/volunteers don't understand how the system works, so the screen just stays off.

The actual commit referred to in the mailing list:

https://github.com/openbsd/src/commit/ee2db53800abe0382657ec...

I've been here for more than a decade.

I think that is where the difference is.

The buy-vs-rent discussion is more aimed at first-time buyers. If you already own a property that is largely paid off and has had the benefit of appreciation over the time you owned it, then yes, it may be more beneficial to keep the property, as you have seen from the calculator.

If the answer was always that rent would be cheaper, then the calculators wouldn't have to exist ;-)

housing cost would almost DOUBLE

Except that you will now have the profits from selling your previous property, which you can invest. That investment payout can partially or even completely offset the cost of renting, which means your monthly costs will be much lower.

Say you make 500k by selling your house, and invest that against 6% ROI, then you make 30k/year passive income, thats 2.5k/month. So deduct that from the rent you'd pay and compare again.

I'll never forgive them for the brain fart they made of the namespace separator, though.

You mean the backslash? What's wrong with that?

The data and PD communication are both working (that was the majority challenge on the EE side, shown in his video). So it would depend on the capability of his solution to let the phone work in host mode, thus being able to provide power to the adapter.

Though I'm also not sure how the MFi situation is with those generations of iPhones, and what restrictions Apple has built in to the OS. I haven't worked with MFi for a while, and I don't know for sure if MFi chips are even required anymore for that generation of lightning devices, or whether the author has incorporated one.

EDIT: I just saw this on his website:

Any other accessory that requires power from the phone is not compatible.

So no, USB-C to headphone adapters won't work, they need power.

Either he had some money available, or he just financed. It's not that hard to get a small business loan/financing for this kind of equipment.

I don't know how many he sold, what his production capacity is, and what margin he makes, but I recon he could definitely make his investments work from the sales of the cases alone. And even if it does not, then there are also future products that this equipment enables. So a good investment if you ask me.

I work in the email industry, so I might be a bit biased on this one, but in my experience self-hosting email has actually gotten better, or at least for the outbound part, funnily enough. But I won't go into why IP-reputation is a thing of the past, for the risk of having to write a very long post that'll be downvoted anyway.

The biggest problem that I personally see with self-hosting, email in particular, is that most resources you find online are outdated, based on superstition, or simply plain wrong. There is a lot of heated debate around running email services, and many bitter comments from people who tried once and got burned.

Self-hosting a personal email service, or any kind of service for that matter, isn't impossible. The internet is still based on free and open standards (the RFCs). But it is free like speech, not beer. Running your own services will cost you resources. Most of which is your time, but some may also be money (for example: ML-capable hardware, certificates, licenses, etc.).

You'll have to be willing to learn, and more importantly: willing to accept that it is a lot of work to setup and maintain any self-hosted services, not just email. You have got to be willing to read through the RFCs, study the errata, read the documentation of your software, be willing to spend time in configurations, being sure you understand your settings, set up lab environments to study both ends of the service (for example: the inbound and outbound service in an email transaction).

Self-hosting is a great learning experience, a fun hobby even if you enjoy such things. It'll allow you to explore all sorts of tech throughout the entire networking stack. But due to the amount of work it takes to setup and maintain, it'll never make financial sense to self-host, at least not in a professional setting. Cloud-hosted solutions, email being a good example in particular, have the benefit of scale: they are dirt-cheap and work really well. It makes zero financial sense to self-host any email service beyond personal use. Unless hosting is your core business, don't be tempted to self-host anything, focus on your actual business instead.

I’m roughly around 40bpm at the moment, down from ~60bpm 10 years ago

To put that into perspective for other readers: I've been running for about 10 years also, but typically 2x a week (10k mid-week, 15~20k weekend), I have no real data on my heart rate from when I started, but at rest I'm now typically at 60bpm.

I measure almost daily due to medication and having a minor heart defect, and I have noticed that if I skip a week of running, it'll slowly go up, averaging at ~62bpm, but when I train for a (half) marathon I typically increase my distance a bit and try to train every other day (~3x/week) then my heart rate a rest goes down a bit to be consistently below 60bpm (58bpm avg).

40bpm is very low, for non-athletes this would be considered dangerously low, but I guess daily running at OPs distance would classify OP as an athlete. Also keep in mind that heart rate differs per person, some people just naturally have a low heartbeat.

He shows other truckers his one and they are all so surprised about the quality of this European truck, them getting the feeling that the US truck industry has been sleeping for decades in terms of evolution.

As a European visiting US/Canada I once struck a conversation with a truck driver who had a really cool vintage semi, with lots of chrome and flare. I told him that I really liked the look of his truck, but that vintage trucks of that age would never be allowed on the road again in Europe, at least not for commercial jobs.

He then told me his truck was basically brand new...

Besides me making a fool of myself, I really grew an appreciation for the EU having rules about semis, especially in the noise department. Yeah, US domestic semi trucks are cool in their own way, but the constant noise of clutch fans, air brakes, 'jake' brakes, 'stack' exhaust with no of mufflers, etc. would drive me insane.

In (most of) Europe, all vehicles are subject to strict noise and emission rules, and many larger cities are now congestion zones which prohibits larger/older diesel powered vehicles from entering the city. Same for my city, where most trucks and busses are now electric. Since it happened gradually the change wasn't all that noticeable, that is until you go somewhere else and hear (and smell!) a diesel powered bus/semi drive by... We like to complain about all the 'stupid' government rules, but when you go to a place without those laws you really start to appreciate them, it truly feels like taking a step 'back' for the worse.

https://en.wikipedia.org/wiki/Radium_ore_Revigator