Hacker Newsnew | past | comments | ask | show | jobs | submit | joncfoo's commentslogin

Doesn't seem to be up =\


Found the issue - a use after free in send_response() if I close the session early due to an error. Was continuing to the next bit. Put a temp fix in place, will push a proper one later.


Still seems to have an issue, but no output before the crash. Will have to do some more debugging. Thanks for the test HN!

Source is here btw: https://github.com/GSGBen/unsafehttp/blob/main/src/main.c


hotfixing httpd UAFs is peak HN spirit :)


Whoops, should be back up now. I'll have to check logs later to see why it went down.


You're going to need a bigger host to support HN traffic :)


What is it about HN that overwhelms small servers like this? It was a small static page so I wouldn't think it'd be that much load on the server itself, even for an OrangePi like this one.

Too many simultaneous connections for his router maybe? Or too much bandwidth for his internet connection?


If they are behind a NAT/ stateful firewall there is just so much connections it will handle at once. I think OpenWRT has like 16K max by default, f.ex. So for less than 16K requests by different users/IPs… each is kept for about 1 minute I think… it quickly will go down, I guess. :)

cat /proc/sys/net/netfilter/nf_conntrack_max

Should give some details.


Do you know if using the DMZ feature on most routers instead of port forwarding would get around this limit, or if there's any other way?


With OpenWRT we can increase the limit, if needed. But it's a delicate process you need to balance out carefully depending on your router. I doubled my slots and it works fine:

It's done via /etc/sysctl.conf

> net.netfilter.nf_conntrack_max=32768

Afterwards "sysctl -p" to apply/ reload the config file. But increasing blindly is a bad idea… it needs to be done with ip_conntrack_buckets in sync for proper balance (memory use, CPU usage). Best to read upon it.

But just going from 16K to 32K shouldn't be any problem for most routers these days.


I wish submitters would try using .onion sites for small static pages, for example as an alternative URL

Fewer source IPs


A sick man died enroute to visit a chatbot which fed him a false address as its own. Meta needs to be held accountable.

We need better regulation around these chatbots.


That is slick. Offline first in the truest sense.


Unfortunately login.gov is only available for use by companies doing business with the US government.


Also login.gov isn't a government issued digital ID. It's just a centralised authentication platform for government use, much like using google or apple for authentication.

It supports the usual options for multifactor (TOTP, text, yubikey/other hardware auth/PIV cards) but for most users it probably ends up being SMS. At best TOTP.


[...] the Board reserves .INTERNAL from delegation in the DNS root zone permanently to provide for its use in private-use applications. The Board recommends that efforts be undertaken to raise awareness of its reservation for this purpose through the organization's technical outreach.


It already contains extension support (not sure why it's not prominently mentioned in in their docs though).

The built-in ones are here: https://github.com/zed-industries/zed/tree/main/extensions. There are others outside the main tree as well, all of which are accessible within the app.


> The recall involves all 3,878 of the aesthetically-divisive angular trucks that have been sold so far.

https://www.npr.org/2024/04/19/1245849907/tesla-cybertruck-r...

> That means the 3,878 trucks being recalled are likely many, if not all, of the trucks now on US roads.

https://www.cnn.com/2024/04/19/business/tesla-cybertruck-rec...

----

A couple of sources.


All of them simply cite the recall report with the manufacturing date range and extrapolate that is all the vehicles. I’ll wait for a financial figure, thanks.


You mean the financial figures that Tesla have been caught acting less than honestly with? "Financially delivered" vehicles that are no more than a VIN plate in a warehouse still waiting to go through an assembly line?

Or like in Australia, "We outsold Camry!" - and then when the media pulled vehicle registration data, well, no, they hadn't. Not even close.


Ok, I didn’t say that either. But it’s even more misleading to say they only sold 4000. Good faith preorders are sales and nobody has evidence besides a date range


Have you come across sqlc? https://docs.sqlc.dev/en/stable/

It gets rid of the crufty parts of DB interaction with Go.


I did, but didn't end up trying it. Being able to hire a Spring dev for $10 p/h vs several times that for a golang dev (plus time learning a particular codebase) just means it doesn't make sense to use Go if you want to outsource in future.

I plan to run multiple experiments in parallel, keep working the day job and outsource the ones that take off. So the more standardised I can make the tech stack, the faster and cheaper dev work will be.


$10 p/h ?

are you joking? if you can find good (I don't want really great) Spring devs for under $80.00 p/h let me know.

You can hire at that rate and everyone I hired had faked their experience and could get through the interview but did a terrible job.

So we ended up firing everyone and had 3 devs for above $110 p/h that were truly awesome who got the job done.


Yeah I'll see how it goes. Tbh at the moment I expect those bottom end devs are worse than just using chatgpt directly. I'll probably have to spend more time explaining to them what I want.

Once IDE plugins can scan the majority of a codebase it'll be easier to just write a bulleted set of requirements and let it get on with it.

But anyway I was talking to a friend who's hired some great Ukrainians quite cheaply and I hear there are some good devs in the Philippines.


Being able to hire a decent Spring (or any good developer) at $10 p/h is HIGHLY theoretical.


Any with any sense will be using chatgpt anyway. It's how I've written most of it. And it's easier to just add to a working project than set one up.

But yeah, we'll see...


This is really neat! I'm going to take it for a spin in a simple CRUD internal app.


1. I froze during a whiteboard interview where I was asked to pretty print a tree in front of two people. Performance anxiety made me implode and stumble so much that I failed to implement basic recursion :')

2. I froze again during a live coding interview when I was asked to correct code under test for a coin change problem. I couldn't get over the fact that someone was judging me based on what they were seeing live and I messed it up so badly that I told them I'm not good at live coding and left it at that >_<

FFS after ~15 years in the field having worked on firmware all the way up the stack one would think I'd be great at throwing out solutions to trivial problems off the top of my head...nope not my brain :D

I've found for myself that there's a massive difference in how someone approaches live coding. If it's a colleague or even my entire team I know that we are doing this together because we have a common goal and will support each other...unlike in an interview where it's set up to be antagonistic and that throws me off completely.


To be fair, I've forgotten how to do basic recursion (and a lot of other basic stuff) while coding with no one watching me haha. Thanks for sharing!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: