litchralee

joined 3 years ago

I'm also poised to agree: setting the output air regulator to a low value does not change the reserve pressure in the tank. I suspect maybe Peppycito thought OP was talking about the governor, which is what controls when the pump turns on and off.

But even then, the most common design of governor only adjusts the peak reserve pressure (aka when the pump turns off) but the minimum reserve pressure (aka when the pump turns on) is usually a fixed value subtracted from the peak reserve. Usually the control for this is inside a box and turned by a screwdriver, because of how rare it is to adjust the reserve pressure.

That said, there is genuine merit in reducing the reserve pressure, if there's an explicit objective to prolong the life of the pump as much as possible and the air loads are not very significant. But this usually isn't the case for small residential air compressors, because those pumps tend to be built very small and thus oversubscribed.

[–] litchralee@sh.itjust.works 3 points 3 days ago* (last edited 3 days ago)

I skimmed this article, but I'll revisit it later because MPU protections have always intrigued me, in terms of being a much smaller subset of the protections afforded by an MMU. That said, for work projects, I've only ever been able to make use of MPU regions for coarse-grain protection (eg prevent the DMA-dedicated regions from being accessible by everything) and not for per-task protection. So I'm always interested in ways that more isolation can be applied, precisely because it keeps code honest, which isn't a bad thing. It's no different than having software asserts.

[–] litchralee@sh.itjust.works 4 points 4 days ago* (last edited 4 days ago)

IANAL. If a bank signs the copy they receive back from the counterparty, then generally yeah, it would be enforceable. Contract law demands that result, because otherwise there'd be no point to the words on the document. Working in the other party's favor would be any lack of notice shortly after the bank signs the contract, because the longer the bank takes to notice a problem, the easiest it is to prove that they did not exercise the appropriate care when signing, incurring all consequences as a result. Missing more and more opportunities to recast or renegotiate the contract, that's a poor position to defend.

That said, the other party must not have made any implied or explicit statements that the bank could have relied upon. Returning the modified contract to the bank in an email with the words "please find the signed contract attached" (my emphasis) could ambiguously imply that the original contract has been unmodified except that it has gained the other party's signature.

Whereas the words "please find my signed proposal attached" would dispell any and all ambiguity, because it would clearly be a proposed contract by the other party, not the bank's original proposal. Alternatively, a blank email with just the attachment is no statement at all, implied or explicit.

To be clear, a bank would almost certainly contest the contract, even if they don't have a leg to stand on. And the usual reason for this -- besides litigiousness -- is that it's the only way for the bank's business insurance to pay out. Or at the very least, an attempt to slightly lower the damages by opening settlement talks.

[–] litchralee@sh.itjust.works -3 points 4 days ago (2 children)

This looks amazing. That said, you may want to have a look at rules 7 and 8 for this community.

[–] litchralee@sh.itjust.works 15 points 5 days ago* (last edited 5 days ago) (2 children)

Contributors: Claude

Please kindly see Rule 8 of this community and its associated post.

[–] litchralee@sh.itjust.works 28 points 6 days ago* (last edited 6 days ago)

I'll offer the contrarian answer: FOSS does not guarantee secure software; in-fact, neither does proprietary software, nor government software, nor anonymous software.

As others have mentioned, assurances about software come from audits or by trusting someone reputable who has done the audit. Delivering security guarantees is not what most FOSS projects are meant to do.

So what exactly do FOSS projects do? Why are they any better than proprietary software? The short answer is that FOSS is about continuity. You can and will find FOSS projects from 30 years ago, which have been kept updated so they can run modern machines. The folks doing that didn't need anyone's permission to do that; they can just do it.

Meanwhile, if Adobe of MSFT declare that a certain proprietary software suite is going EOL and will not receive any more security updates, then the user base is SOL. FOSS gives a potential route away from this fate, if someone or some group is willing to put the elbow grease into security updates. Even if it's just one person.

So in the short term, there are no security assurances for either proprietary or FOSS. In the long term, all software cannot escape the unstoppable march of time and vulnerabilities. But at least FOSS has a chance to be corrected, years or decades later.

[–] litchralee@sh.itjust.works 5 points 1 week ago* (last edited 1 week ago)

For handling international traffic under ICAO rules, ATC is indeed supposed to be done in English.

But if we take a look at some of the terminology in aviation, the French words cannot be ignored. Mayday and pan-pan are from the French venez m'aider and panne.

When radio silence is required, a station might command "SEE-LONCE" but this comes from the French word for silence. Though I think this is a rarity in aviation.

And then outside of aviation radio, the French left their mark on aircraft parts names: fuselage, empennage, aileron.

[–] litchralee@sh.itjust.works 13 points 1 week ago* (last edited 1 week ago)

An intriguing question. I do agree that even the ultra-rich had an eye-opening time during the pandemic, but I don't agree that their wealth acts as a singular shield, which if pierced would herald their downfall.

When someone has the resources of tens of billions of dollars, the principle of defense in depth is both practical and is most prudent. For each of your points that suggest the ultra-rich were vulnerable, it might actually prove the strength of their fortifications.

they were conceivably vulnerable to the same indiscriminate illness as everyone else.

The thing with disease is that it cannot teleport: the transmission vector must convey person to person, through airborne particles, or some other physical means. What the ultra wealthy can -- and do -- buy are exotic islands or chalets in faraway places from other humans. Meaning that once there's notification of a pandemic, they are best positioned to flee to whichever of their overseas fortresses as they may choose. Meanwhile, the masses have to hunker down at home, which is their only refuge, and hope for the best.

the government can and will shut down your business

The ultra-rich leave the daily operations of their businesses to professional managers. It has been a staple of prudent management for decades to have disaster preparedness plans and business continuity plans. You may have seen some form of these through wildfire or earthquake notification systems, so that a company can confirm which of their employees are accounted for. But such systems also serve as a planning exercise, in case a natural or manmade disaster takes out an entire industry.

The businesses of the ultra-rich already plan for things like the loss of most of the world's hard drive production capacity due to flooding and the closure of EU airspace due to volcanic ash. These aren't as detailed as those specific situations, but are about the business impacts: what it products can't get to customers? What if required materials can't reach the factory? What if war breaks out domestically and the production line is taken over by the government?

Not to minimize the impacts of the pandemic, but the difference is that it activated multiple continuity plans simultaneously, an unprecedented scenario but otherwise not unrecoverable. Fortune favors those who make plans.

Indeed, a part of many business's plans during a catastrophic situation is to -- unsurprisingly -- beg the government for aid or a bailout. After all, if they can get the taxpayer to partially implement their plan, they will. And business lobbying for a bailout only requires a telephone and a contact list, so the ultra-rich's lobbyists were kept busy in the summer of 2020.

What is most telling is that the USA stock markets recovered in the latter half of 2020. The ultra-rich have plenty of resources to survive a few months of disruption, as they have more runway to wait things out than, say, a typical working class household that needs rent relief or faces eviction.

universal income model is not only possible, it is completely affordable and can be quickly implemented.

One of the most under-assessed aspects of the ultra-rich is that they find ways to make money whichever way the wind blows. Even in a UBI scenario, they can still make bank if they are the sole vendors of certain commodities.

In fact, a UBI system which automatically tracks inflation is essentially a license for vendors to also increase their prices with exacting precision, perfectly in-time with inflation. This is why a UBI system should not be implemented on its own, but alongside other social safety nets and regulation on the "demand side" of money. That is to say, business regulation (eg rent controls, anti-monopoly rules, banking reform) are all part-and-parcel of a long-term plan that defeats economic inequality. They are not separate pieces, but the ultra-rich can still take solace that not everyone recognizes this yet.

The war of information would still be on their side even if UBI were voted into effect today.

The luxury services that their money had always effortlessly bought could be quickly ended by decree, scarcity, and the loss of human labor to illness.

I didn't exactly care to track the happenings of the ultra-rich during the pandemic years, but did they actually suffer such scarcities? Their business empires recovered by the end of 2020, and it's not like rich people don't just find other intrigues to spend their time on. Rhetorically, what is a few billion here or there?

Were the ultra-rich terrified? Probably, but only for their paper valuation. They themselves would have been physically fine, and since there was no proletariat uprising during this time, they basically just made money during those years. Essentially, a financial blip but their lives move on. Maybe they'll build more bunkers for their holiday homes.

[–] litchralee@sh.itjust.works 7 points 1 week ago* (last edited 1 week ago)

In the space of mini PCs/NUCs, this does seem comparable. But bear in mind that the entire space of "home server" is a lot bigger than NUCs. After all, not everyone just wants to host an NVMe drive or two; they might want to fit some cheaper SATA SSDs or even spinning rust, as part of a cascade of stroage, with caching on SSDs and other nice things.

Likewise, the dual LAN ports with 802.3bz support is nice, but the reality is that most networks are only 1 Gbps with some devices supporting 2.5 Gbps. Quite frankly, for server use that actually needs one or both port's bandwidth, the link would likely be better served with SFP+ slots, because of better compatibility with cheap enterprise switches available online, and because SFP+ transceivers run less hot than their twisted pair counterparts at 10 Gbps. Heck, you could even use a 40 Gbps QSFP+ NIC, which only requires a x8 or X4 PCIe slot (depending on PCIe generation of the NIC). On that note, a single PCIe slot is nice, but it does preclude the use of a double-wide GPU for transcoding use.

I would sum all this up as lacking expandability. Yes, it can be expanded somewhat. But for folks that want the capacity of an ATX-based build, this ain't it. And for folks with abundant solar power, electricity consumption for older gen chips isn't as much of a dealbreaker. It certainly checks off a lot of people's boxes, yours included, but that doesn't mean that people are "sleeping on" this, because at the end of the day, if it doesn't serve their purposes, it's not the right box for them. In terms of price, never underestimate the cost of $0.00 that is an old, unused laptop; they make remarkably decent servers for light loads.

Also, as of this writing, only the 32 GB RAM variant is available on the USA website.

[–] litchralee@sh.itjust.works 3 points 1 week ago

Corporations even before AI have sued each other, precisely on the premise that "your code looks like ours. We think you stole it" and then have a petty fight in court because their lawyers couldn't hash out a settlement.

Now with so-called AI washing, it's only going to get worse, because LLM generated code doesn't have to be 100% identical to be considered a derivative copy of the original. It all goes back to the central question: did this copy come from this original work?

The corporate IP lawyers will be making bank off of the ambiguity.

[–] litchralee@sh.itjust.works 10 points 1 week ago* (last edited 1 week ago) (2 children)

I've had similar trouble understanding this aspect in the past, so I'll share how it now makes sense to me, within the frameworks of existing IP law. IANAL.

Copyright law protects a specific, tangible work from duplication, meaning that if someone directly derives an unauthorized copy from an original work (eg scanning a book), then that's copyright infringement. However, copyright law does not simply look at whether a copy is identical to the original. There must be an analysis of the provenance of the copy: did the copy come from the original?

Two people can separately stand at the Grand Canyon visitor center and use their own cameras to take identical film photos from the same vantage point, such that the developed film is identical in every way. And yet, neither has violated each other's copyright, because neither photo came from the other. Person A can sell their copy to a magazine, while Person B distributes copies for free with their holiday cards. This is all A-OK.

The trouble is when somebody suspects infringement, because they see a copy that looks unusual similar to an original. If they decide to raise a copyright lawsuit, then the defense would like a way to affirmatively show that "no, our copy didn't come from your original". How do they do this?

In software, the approach would be to methods like the clean room approach. This is explicitly a method for legal reverse engineering, precisely to avoid copyright concerns. It works because while copyright protects a tangible work, it does not protect the ideas recorded by that work. So if somebody was given only the idea, and tasked with writing the software that re-implements that idea but without ever seeing the original, then the resulting work cannot possibly have been based on the original work. Rarher, it's just a take on the same idea, which is allowed to be similar, in the same way as the photo of the Grand Canyon. There is no straight line that connects the supposed copy to the original work, apart from the idea itself, which copyright does not cover.

With LLMs, there is zero assurance that any clean room approach was followed. By training directly on original, copyrighted works, there is a cloud of uncertainty about whether the LLM is regurgitating parts of the original (which would be infringement) or if it actually reduced the user's prompt into an idea, and then independently generated code which implemented that idea.

Copyright infringement poisons everything that is derived thereafter, so even the spectre of a doubt causes problems, because if GNU or whoever else builds atop questionable copyrighted software, that foundation collapse suddenly if someone brings a lawsuit to enforce their copyright. And those are pricey to defend, even if it's without merit.

The clean room method, when followed faithfully, is a way to discourage potential litigants from even filing a lawsuit, because it's clearly obvious that they would fail to prove a connection to the original work. Patents are a different story (where ideas are protected).

LLMs basically have the same problem as when an engineer quits and goes to work for a competitor. Will they have (accidentally or not) taken trade secrets with them and implemented those in the competitor's product? A well-advised company would go through great lengths to make sure that engineer isn't working directly on a competing product, to avoid a costly lawsuit. LLMs do no such mitigation.

 

The convention in the USA for old urban centers and new suburban sprawl is to construct a street or road with a crown that drains rainwater to gutters along both sides of the road, then have storm drains to convey the water from the gutter to some nearby creek or tributary. But why?

Wouldn't it be easier to construct the road in a roughly canal shape, so that rainwater drains towards a single V-shaped gutter at the road's center? This would cut the number of storm drains by roughly half, prevent leaves from falling directly into a drain and clogging it, make it possible to clear a drain by driving a streetsweeper over it, and also prevent a clog from flooding adjacent properties, since the road itself can temporarily impound more water until municipal authorities can clear the blockage (whereas side gutters would invariably flood the sidewalk and carry sharp debris that would damage tires entering a driveway).

Furthermore, a center drain can be built once and then retained as-is each time a suburban arterial needs expanding -- "just one more lane, bro" -- whereas side gutters are regularly demolished and rebuilt to accommodate additional lanes. By routing water away from the edges of the road, sidewalks avoid freeze/thaw cycles, and the road surfacing can be continuous from the curb: no more bike lanes in the gutter. As a convenient benefit, the "drop" off at a curb-cut from a driveway to street level would cease to exist.

And where required to improve water quality due to runoff pollution, a center drain can be excavated and rebuilt as a linear stormwater retention pond, where moderate stormwater can filter into the local soil slowly, with a predefined overflow level that will drain to the existing stormdrain pipes. This is already done for both surface parking lots as well as Interstate highways, so it's not an unproven design.

Narrow alleyways in older cities do use a central drain, so I can't see why the idea stops making sense for larger streets and roads. The only drawbacks I can envision are aesthetic -- a neighbor's excessive lawn irrigation would draw a wet line across half the street -- and that the center channel would also carry leaves and wayward soccer balls into the middle.

But even still, that doesn't seem worse than the status quo: gutters attract all sorts of detritus, but it's usually hidden beneath the wheels of parked cars until something punctures a tire. And at least in water-starved California, irrigation runoff deserves to be noticed and called out so that it gets fixed. There may even be some small road safety benefit from having a V-shape channel in the center, since it would unmistakably divide opposite sides of the street.

For larger arterial roads that have trees in the center, this seems like free irrigation and water pollution control. It even works when the center traffic lanes are converted for running a tram or light rail train.

What am I missing here?

 

cross-posted from: https://sh.itjust.works/post/61250326

A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card.

The same XSS (cross-site scripting) pattern appears to be present in MeshCore-Home-Assistant-Panel-v2 and its HACS variant

To be abundantly clear, and the post goes into detail why, this is not a bug in MeshCore but rather in how web dashboards are not properly sanitizing untrusted input. In this case, the untrusted input is via a field that any malicious MeshCore node could send.

Well worth a read and a follow on their Mastodon.

 

A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card.

The same XSS (cross-site scripting) pattern appears to be present in MeshCore-Home-Assistant-Panel-v2 and its HACS variant

To be abundantly clear, and the post goes into detail why, this is not a bug in MeshCore but rather in how web dashboards are not properly sanitizing untrusted input. In this case, the untrusted input is via a field that any malicious MeshCore node could send.

Well worth a read and a follow on their Mastodon.

 

A reasonable overview of the MeshCore architecture and tunable parameters.

Probably the only part I don't agree with is the idea that the companion/repeater dichotomy is an inherent part of the MeshCore architecture. I don't believe it is, although it's certainly part of the practical implementation. That is to say, if someone wants to use MeshCore purely as a private point-to-point link, then they can jettison the motions of companions and repeaters entirely. As a person to person mesh network, though, companions and repeaters are essential. The distinction I'm trying to draw is that MeshCore can be a lot more than text messages sent amongst friends.

While reading, the explainer for the three-tier t delay seemed especially analogous to me to how circuit breakers are arranged: a nearby power strip might have a fast-tripping 15 amp thermomagnetic breaker, the upstream main panel might be using a 20 amp curve B (moderate trip rate) thermomagneric breaker, and the utility might be using a magnetic 400 amp breaker. By their nature, thermomagneric breakers will handle localized faults that are 3-5x the rating, while the utility's magnetic breaker will trip precisely at 400.1 amps, to protect line-side equipment. Whereas if the utility breaker tripped first, it would unnecessarily black out a whole neighborhood.

Also observe that MeshCore's "flood-then-direct" behavior is identical to that of Ethernet (ie unknown unicast, then unicast), except that Ethernet frames do not get appended with the network path as they progress, which is akin to the postal service where letters arrive at their destination but with no indication of the routing. Accordingly, the MeshCore sender necessarily reserves space to store the mesh route, choosing a tradeoff between node-count (up to 64) or granularity (up to 3 bytes per repeater). This seems complex, but just like with the tax code, complexity is necessary to handle every reasonable scenario.

I will also reiterate the ongoing bug in MeshCore's encryption, which is the use of AES-ECB in the year 2026. Although it's AES-256, ECB has been a known encryption vulnerability for decades and should not have been used in the MeshCore spec. Meshtastic appears to have avoided this particular foible.

Note: the author's blog mentions in the About page that some AI is used to assist in his writing.

 

Background: I spent 40 minutes typing up a reply to a different post, but decided that it ran on for too long. I'll include it at the bottom, but I'm curious to know how much cash is still used in this country.

Certainly, a like-for-like Giro (Europe) system doesn't exist in the USA, with ACH, checks, and Zelle almost filling the void -- albeit incompletely -- which I suspect is responsible for the remaining cash utilization. But is that right? Is cash only used for when there isn't another option? Or is it a matter of consumer preference?

I can understand tipping in cash, or paying for a Craigslist purchase in cash. But maybe I'm missing another dimension? Do some folks pay rent in cash? Or taxes? I'm genuinely curious, but please make sure not to dox your finances in the comments.


My original comment

It's annoying when they get suspicious of a 25k USD withdrawal for instance (even if you managed to prove the purpose of such a withdrawal, it remains at the banks discretion whether they'll approve the transaction).

Let's break this down into multiple points:

  1. Suspiciousness of a 25k USD cash withdrawal
  2. Suspiciousness of a $25k USD electronic or check withdrawal
  3. Necessity to "prove the purpose" of any withdrawal
  4. Bank discretion and considerations regarding withdrawals
  5. Necessity of approval by the bank

I don't believe any of these five points are actually issues. As background, cash withdrawals within the USA are still very commonplace, as the country is fairly rather cash-centric when it comes to businesses, due in part to the lack of a system like Giro (Europe) that has both low, fixed transfer costs and can be sent or received by third-parties. The Federal Reserve's ACH system requires established relationships between accounts, whereas Giro does not. Debit card systems aren't a replacement for Giro either. Zelle (USA) is closer, but still isn't quite as full-fledged. Hence, businesses often deal in cash, pay employees in cash, and consumers pay other individuals in cash (eg buying an automobile).

To that end, for point 1, $25k as a cash withdrawal is not a daily occurrence but it does happen. I can't really think of ever paying for a private party used car by check, and such a cash-heavy transaction is often performed at the buyer's bank, so the seller is assured that the cash is good. In this setting, requesting to withdraw $25k cash is ordinary and mundane, if done very rarely. I doubt even prolific car buyers have this problem, but would be open to hearing evidence otherwise.

For point 2, electronic and check withdrawals have even less suspicion than cash, because they always leave traceable evidence. Money laundering concerns are reduced because the entire money trail can be reestablished later, whereas as cash can easily disappear or be "forgotten". To that end, the suspicion isn't about the cash amount but the source and destination. Even a $1 million check is not suspicious, if it's coming from a law firm's client account to a client's personal bank account. That is, again, a thing that happens fairly regularly. More down to earth, people can and do pay housing deposits by check, and property taxes are often drawn electronically. When one or both accounts to a transaction is prominent and established, there is a low probability of money laundering.

Point 3 is often though to be an issue, due to confusion about regulations for bank clerks on when to file a Suspicious Activity Report (SAR). Bank tellers are required to follow Federal Reserve regulations that aim to prevent abuse of the American financial system for money laundering. An SAR must be filled in whenever the teller: a) thinks money may be laundered, or b) the transaction is above the bank's or regulation's fixed amounts. The latter is often pegged at $10k, so this is where people think that it's disallowed to withdraw over $10k. This is not correct.

An SAR is something the teller fills in, and to do that, they might ask the customer some questions about the transaction. For the grand majority of people, the purpose is quite simple: cash purchase of a car, housing down payment, loan for a friend. Would the teller know if the customer is lying? Nope, not at all. But the SAR forms part of a trail of records, so that money laundering investigators can trace funds in the future. But note that the clerk can fill in an SAR for any type of transaction, including checks, and don't strictly need the customer's truthful answers (or any answers) anyway. An obligation to fill in an SAR does not prevent the transaction from going through. It's a speed bump, not a stop sign.

As for the actual stop signs, that's what point 4 covers. A bank obviously cannot allow a withdrawal if it would exceed the customer's balance, or if they don't physically have enough cash, or if the withdrawal is not authorized (ie not named on the account, or PIN not known), full stop. But other situations may arise where the withdrawal must be delayed, either for the bank's own convenience or because the account agreement specifically requires certain holdings times.

I quickly perused a random account agreement for Wells Fargo and the Available of Funds section describes that new accounts (less than 30 days old) will have elongated hold times for withdrawal against newly-deposited funds. This is applied in a first-in-first-out fashion, so only fully-draining the account would incur the longer hold time. In other cases, the bank may take more time but is required to inform you of that, and provide a definite date for when the withdrawal will clear. This verbiage does not distinguish cash vs non-cash, so they're within their rights to delay a check, as long as they obey their own agreement. If this is not tolerable, find a different bank.

Finally, this also gives us some insight into the default behavior for banks subject to Federal Reserve regulations, which is point 5. A bank may not deny a withdrawal of unencumbered, unheld funds (cash or otherwise), except when the bank has actual knowledge that the withdrawal definitely is for laundering. It is, after all, not their money: it belongs to the customer and they are just the regulated custodian of it. A bank can certainly advise a customer not to fall for a pig-butcherint scam, but they cannot block the customer from obtaining their own money back out. They can, as described earlier, apply a temporary, finite-time hold on the funds, but that's it.

To my knowledge, there is no Fed-regulated, FDIC/NCUA bank or credit union that requires pre-authorized approval to access a customer's own funds. I am open to hearing evidence to the contrary, but I don't believe such a thing exists. How would they even stay in business? To be clear from point 4, a bank can certainly ask for a few day's notice to prepare $50k in new $2 bills. But that's easy enough: just call the bank and verbally request the withdrawal, then collect it in-person days later.

Who is disadvantaged by this? Mostly money launderers and con artists trying to abscond with their scam proceeds. But I'd be remiss if I didn't also mention rich people that prefer to suddenly go on vacation and pay for everything in cash. But the system is designed to be no obstruction to those that plan ahead, or are dealing in such small amounts that it's not a big issue. Normal everyday people all share the costs of money laundering, so it's not fair to disadvantage them just so rich people and scammers aren't inconvenienced by their inability to plan ahead. They don't even have to plan ahead: just keep a few racks in the safe.

It is to me, frankly, a non-issue to withdraw money for me or anyone in the working or middle class, because the very issue of being "flagged by US banks" just rarely even a speed bump. And the rich folks have private banks that will gladly give them inordinate amounts of cash to spend.

What exactly is the problem here, specifically?

 

What can be done

The most glaring problem with MeshCore is that the maintainers do not openly communicate vulnerabilities. Users are left without knowledge of any problems, unable to judge whether to trust MeshCore with their private communication.

 

Here is the thing about open source, Andy: it isn't yours to fence. You don't get to ride a community's goodwill into a USPTO filing and a paywall. You don't get to turn "we built this together" into "I own this, pay me." That isn't a pivot. That's a rug pull dressed up as a business model.

And here is the thing about the "license check" you shipped: it is a 32-bit djb2 hash of the device's Android ID, XORed with the four ASCII bytes MCPP, hex-encoded. That's it. Thirty-two bits. Less entropy than a decent ZIP password. A first-year CS student could break it. You used Claude to generate the code. We used Claude to read the code. It took 19 minutes. The receipts are one click away.

 

CLAUDE CODE JUST RICKROLLED ME. I'm working on a project where part of it will involve videos, and in building out the project it created a dummy page, with made up content (relevant to me!) with two video links pretending to be something else and BOTH WERE RICKROLLs.

Note: I'm using a broad definition of "programmer" to include HTML generation, and a broad definition of "humor" that includes Rickrolling. Together, I think this is appropriate for c/programmerhumor. Mods, please remove if not correct.

 

When I moved into my home many years ago, there was this lock-box mounted to the water main on the side of the house. I figured it was one of those used by real-estate agents to store the house key for viewings, but months passed and it still remained there. No one from my buyer's agent's office had a clue what this was, and the seller of the house had already moved out-of-state.

Recently, I had some plumbing work done, and that also included replacing the main water valve for the house, allowing this lock box to come free from the plumbing. Now inspecting it up close, and looking up the model online, I realized that it has an alphabet wheel and uses a three-letter combination.

As it happens, Thanksgiving weekend was upon me, and since I was bored, I figured I'd try all the possible combinations. Just 17,576 possible combinations, how bad could it be?

The most immediate problem was that due to being out in the elements, the dial did not turn easily. It would move, but was rather rough. And since the knob is only ~1 cm diameter, this is an incredibly un-ergonomic endeavor. I had to stop after the first 100 tries, due to the finger exhaustion.

Knowing this would be untenable for the long-run, I decided to build my way out of this problem. Since a combo lock involves making rotations that almost go all the way around, I drew inspiration from rotary telephone dials, where one's finger starts with the intended number and then swivels the dial around.

But whereas a rotary telephone dial only needs 10 positions, I needed to fit 26 positions, one for each letter. I decided on each hole being 17 mm to comfortably fit any of my fingers, but that also dictated the overall diameter of the wheel. But that's good, since a larger diameter wheel means more leverage to overcome the rough lock movement. It also happens to be that this wheel has a diameter of 180 mm, which is just enough to fit in the 200 mm bed of my 3d printer.

Using FreeCAD, I designed this wheel so that it fits around the splines of the lockbox dial, which held remarkably well. I had thought I would need Blu Tack or something to keep it together.

CAD design for lockbox dial wheel

Using this wheel, I'm able to "dial" combinations much quicker using one hand, while holding the lockbox with my other hand to press the lever down to test the combination. This should be good.

(note: some parts of this story were altered to not give away identifying details)

 

(fairly recent NewPipe user; ver 0.27.6)

Is there a way to hide particular live streams from showing up on the "What's New" tab? I found the option in Settings->Content->Fetch Channel Tabs which will prevent all live streams from showing in the tab. But I'm looking for an option to selective hide only certain live streams from the tab.

Some of my YouTube channels have 24/7 live streams (eg Arising Empire), which will always show at the top of the page. But I don't want to hide all live streams from all channels, since I do want to see if new live streams appear, usually ones that aren't 24/7.

Ideally, there'd be an option to long-press on a live stream in the tab, one which says "Hide From Feed", which would then prevent that particular stream ID from appearing in the feed for subsequent fetches.

From an implementation perspective, I imagine there would be some UI complexity in how to un-hide a stream, and to list out all hidden streams. If this isn't possible yet, I can try to draft a feature proposal later.

 

I'm trying to remind myself of a sort-of back-to-back chaise longue or sofa, probably from a scene on American TV or film -- possibly of the mid-century or modern style -- where I think two characters are having an informal business meeting. But the chaise longue itself is a single piece of furniture with two sides, such that each characters can stretch their legs while still being able to face each other for the meeting, with a short wall separating them.

That is to say, they are laying anti-parallel along the chaise longue, if that makes any sense. The picture here is the closest thing I could find on Google Images.

So my questions are: 1) what might this piece of furniture be called? A sofa, chaise longue, settee, something else? And 2) does anyone know of comparable pieces of furniture from TV or film? Additional photos might help me narrow my search, as I'm somewhat interested in trying to buy such a thing. Thanks!

EDIT 1: it looks like "tete a tete chair" is the best keyword so far for this piece of furniture

EDIT 2: the term "conversation chair" also yields a number of results, including a particular Second Empire style known as the "indiscreet", having room for three people!

view more: next ›