wolfgang42

I’m confused about for this assertion, for two reasons:

- My understanding is that OCSP stapling stops leaks, because the browser can get OCSP data from the server instead of needing to fetch it separately.

- Last I heard, Firefox was in the process of removing OCSP responder checks (precisely for privacy reasons) in favor of CRLite-based revocation checks—are you sure they didn’t remove whatever setting you’re referring to from the UI because it’s no longer relevant?

Yes, the modifications you need to support it are trivially obvious (literally just replace “4 bytes” with “8 bytes” everywhere in the spec) and have been implemented by a number of authors, some of which this page links to. I guess it’s nice that they’ve been “officially” acknowledged, though.

CDB is an interesting format, optimized for read-heavy write-rarely[1] random lookups on slow media. This isn’t a very common requirement these days, but it’s convenient for very specific use cases.

[1] You “update” by overwriting the entire file. This is remarkably fast and means that there’s no overhead/tracking for empty space, but it does mean you probably want this to be a fairly rare operation.

I rolled my own cdb reader library for a project a few years ago, and wrote up my notes on the format and its internals here: https://search.feep.dev/blog/post/2022-12-03-cdb-file-format

We have no idea whether the signal had a pattern because the only recording we have of it consists of averages over 10-second samples, so any modulation <10s (or patterns larger than the 72s recording) would have been lost. It could have been an AM broadcast of a herd of circus elephants playing the William Tell Overture for all we know.

From the article:

there are about 230 billion* links that need visiting

* Thanks to arkiver on the Archive Team IRC for correcting this number.

Also when running the Warrior project you could see it iterating through the range. I don't have any logs handy since the project is finished but they looked a bit like

  https://goo.gl/gEdpoS: 404 Not Found
  https://goo.gl/gEdpoT: 404 Not Found
  https://goo.gl/gEdpoU: 302 Found -> https://...
  https://goo.gl/gEdpoV: 404 Not Found

No they really are trying to enumerate all 230 billion possible shortlinks; that’s why they need so many people to help crawl everything.

I know puns are considered the lowest form of humor, but I still appreciate the occasional bit of levity to lighten the mood in serious discussions.

I think what you want is to just make a function and pass it the values:

  const template = ({name}) => `hello ${name}`;
  const n1 = template({ name: 'joe' });

The judge’s report[1] lists twenty-eight different classes of failure, including:

- Confusing and buggy UI causing clerks to duplicate or mis-enter transactions

- Inventory getting “stuck” in branches after the product was discontinued; the attempt to remove it hid the inventory but caused its value to reappear on the books again each accounting period

- Failing touch screens entering spurious purchases overnight

- Incomplete rollback of distributed transactions

- Byzantine failures during hardware replacement causing multiple transactions to be assigned the same ID and overwrite each other

- Fujitsu employees with unaudited write access to the production database making one-off modifications

- The point of sale system simply telling the clerk to give too much change back to the customer

There’s no “one bug” here; the main failure was that those responsible continued to dismiss any problems as users being either in error or outright malicious, despite massive amounts of evidence that the system had technical flaws. Better quality software would have reduced the problems, but no system is bug-free and in many cases very little effort was made to identify the root causes of problems, much less to prevent similar ones from happening again.

[1] https://www.judiciary.uk/wp-content/uploads/2019/12/bates-v-...

Expecting Friends Journal to explain quakers is like wanting the IETF to tell you what a computer is; the target audience for this article are people who are way beyond needing an introduction to the topic, though of course on the Internet articles can end up in unexpected places.

A brief and reductive explanation: The Religious Society of Friends (colloquially “Quakers”) are a religious movement (nominally Christian, in practice often agnostic) which originated in England circa 1650. A core part of the theology is that God might speak to anyone, so worship generally consists of sitting around in silence until someone hears from Him and stands up to repeat the message, hence why the article is drawing parallels between that practice and Zen Buddhism.

You might be thinking of Mormons? I’ve never heard of the CIA recruiting Quakers and I don’t think it would go particularly well if they did.

For whatever it’s worth, zeekstd seems to come with a CLI tool: https://github.com/rorosen/zeekstd/tree/main/cli

Recently I showed somebody https://search.feep.dev and they opened the browser network tools and went “Where’s the XHR? Where’s the JavaScript?? How did you change the URL?”

They had no idea that <form><input></form> is all built in to the browser and you can make GET and POST requests without any frontend code. (Not that this is a new problem, <a onclick="document.location='...'"> has been a thing for decades at this point...)

A working domain needs one validation every ~60 days, but these zombie domains sound like they’re making multiple requests per hour (per the article, twice daily would still take 10 years to hit the limit) which is a massively disproportionate amount of resources.

there is nothing preventing the development of software to overwrite data before unlink(2) is called.

It’s not that simple: this command already exists, it’s called `shred`, and as the manual[1] notes:

The shred command relies on a crucial assumption: that the file system and hardware overwrite data in place. Although this is common and is the traditional way to do things, many modern file system designs do not satisfy this assumption.

[1] https://www.gnu.org/software/coreutils/manual/html_node/shre...

The client only needs to get indexes for the specific search; if the index is just a list of TF-IDF term scores per document (which gets you a very reasonable start on search relevance) some extremely back-of-the-envelope math leads me to guess at an upper bound in the low tens of megabytes per (non-stopword) term, which seems doable for a client to download on demand.

[Tim Berners-Lee is] famous for helping create the initial version of JavaScript

You may be thinking of Brendan Eich? Berners-Lee is famous for HTML, HTTP, the first web browser, and the World Wide Web in general; as far as I know he had nothing to do with JS.

Hence the (relative), yes. Did “dedicated hobbyist” not tip you off that I wasn’t thinking about how to maximize market share?

Yeah, the (relative) rise of Kagi and Marginalia show that from a technical perspective, this is within the grasp of a dedicated hobbyist.[1] If Google continues their current trajectory, and overwhelming numbers of AI crawlers don’t cause an unsurmountable rise in CAPTCHA pages, I hope to see an upsurgence of niche search engines that focus on some specialty small enough that one or a few people can curate the content and produce a much better experience than the current crop of general Web search engines.

Self-plug: I run such a search engine (for programmers) in my living room, at <https://search.feep.dev/>. I don’t spend a ton of time maintaining it, so I’m interested to see what someone really dedicated could do.

[1] I wrote a 2004-vs-2014 comparison, and things have only gotten better since then: https://search.feep.dev/blog/post/2022-07-23-write-your-own

Mini vMac is better suited for this, but it checks the ROM’s checksum, so I couldn’t boot with mine—it’s not in the recognized list.

You can compile Mini vMac without checksum verification (either yourself or with the variations service[1]), which will allow you to use unknown or completely custom ROMs, though you need to be aware that it patches the ROM (it doesn’t emulate the original floppy hardware; instead it pokes a custom driver in where the original one ought to be) so if your ROM doesn’t line up with the original you will have problems with random chunks being overwritten.

I’ve done this so I could use Mini vMac to learn assembly language: the Mac has the convenient property that pixels on the CRT are 1:1 the contents of a chunk of RAM at a fixed offset, so you can get very immediate visual feedback about what your program is doing. I just set up an assembler to dump raw machine code and named it "Mac128K.ROM" and Mini vMac picked up on it fine.

[1] https://www.gryphel.com/c/minivmac/var_serv.html - though since Paul Pratt disappeared a few years ago nobody is quite sure how the server is staying up

I assume a big reason is cookies, which are specced to be shared across the two versions: an attacker could relatively trivially trigger a request to http://example.com. which would get example.com's cookies, but not the HSTS upgrade that would prevent them from being sent in plaintext.

I did a whole writeup of this situation a few months ago: https://search.feep.dev/blog/post/2025-02-20-state-of-stacke...

TLDR: it seems like they don’t want to, but there was enough uproar when they tried to stop that they reluctantly brought them back, behind a dubious clickthrough agreement which asserts “should I distribute this file for the purpose of LLM training, Stack Overflow reserves the right to decline to allow me access to future downloads.”

Markdown as specified lets you break out HTML whenever you want, and even understands the difference between inline and block tags. Most places where you can use markdown support this.

Personally I’m also a fan of https://github.com/pugjs/pug , which is an alternate syntax for HTML that I find easier to work with when I need the full power of HTML but don’t want a thicket of angle brackets.

I’ve bumped into a robot bat, though that’s not quite the same thing. (They made a userscript to change CAPTCHA boxes to say “I am not a human”.)

I’ve told your story about Mr. Test to several people over the years but I’ve never been able to remember where I got it from. I’m glad to have finally found it again, and thank you for the anecdote!

20 GB of JSON is correct; here’s the entire dump straight from the API up to last Monday:

  $ du -c ~/feepsearch-prod/datasource/hacker-news/data/dump/*.jsonl | tail -n1
  19428360        total

This is entirely missing the point. Until more or less everybody shares this opinion, being publicly labeled as such will still have adverse effects.

The item in question, and presumably the rest of his collection, was purchased in the form of an attractive resin display cube containing an absolutely minuscule amount of radioactive material: https://www.luciteria.com/element-cubes/plutonium-for-sale

just piling on ugly radioactive waste in your bedroom

This is an egregious mischaracterization which detracts from your otherwise excellent comment. Lidden was working on collecting the periodic table in decorative display cases.[1] I don’t get the point of coin collections either, but that doesn’t mean I would describe one as a “grubby heap of heavy metals.”

[1] https://www.luciteria.com/element-cubes/plutonium-for-sale

Some relevant discussion/pointers to other notes on this sort of proposal can be found here: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/AutoconfVa...

(The conclusion I distilled out of reading that at the time, I think, was that this is actually sort of happening, but slowly, and autoconf is likely to stick around for a while, if only as a compatibility layer during the transition.)