klysm's comments

On: TLS certificate lifetimes will officially reduce to 47 days

[klysm]

CAs exist on the intersection of reality (far from ideal) and cryptography.

On: When College Might Not Be Worth It

[klysm]

Social scene in college is pretty hard to beat

On: CVE program faces swift end after DHS fails to renew contract [fixed]

[klysm]

There are going to be all kinds of messed up incentives if this is funded from industry.

[throitallaway → klysm]

True, although Google's Project Zero seems to be run pretty well.

[worthless-trash → throitallaway]

Different goals, not cve related.

[airhangerf15 → klysm]

Like there aren't any messed up incentives with it funded by the government? Um, Vault 7? Snowden? PRISM? Did you literally just forget the past two decades of domestic spying and the NSA withholding critical vulnerabilities they were currently using?

[Ferret7446 → klysm]

Like what?

On: Systemd ParticleOS

[klysm]

I'm not sure nix is aimed at the same kind of things here. ParticleOS seems to be a logical continuation of the effort that systemd has been putting into TPM2, boot security, signing, and immutability.

On: Nix Derivations, Without Guessing

[klysm]

Is there any technical pathway for changing the underlying hash function? Similar to how git is kind of stuck on SHA1, what would it take to get this onto SHA512?

[chriswarbo → klysm]

I think it could be done in a backwards-compatible way, since existing hashes fit a known pattern; e.g. (silly example) store paths using SHA512 could be distinguished using prefix like 'sha512_'. One problem would be cache misses and duplication of files.

I'm not completely up to date on Git's hash situation, but it seems to me like SHA256 is usable; but only for new repos. I imagine lots of existing infrastructure assumes SHA1 hashes though, and would break for silly reasons like different lengths.

Relatedly, Nix has a new feature called `git-hashing` which can use Git tree hashes to validate fixed-output derivations, rather than requiring two separate hashes; e.g. the following `fetchTreeFromGitHub` function uses a single `tree` argument for a Git tree ID, rather than needing separate `rev` and `hash` arguments:

  { owner, repo, tree }: (pkgs.fetchFromGitHub {
    inherit owner repo;
    rev = tree;
    hash = builtins.convertHash {
      hash = tree;
      hashAlgo = "sha1";
      toHashFormat = "sri";
    };
  }).overrideAttrs (_: { outputHashMode = "git"; })

Unfortunately, this git-hashing functionality only works for SHA1; so it's a good example of the infrastructure around Git not allowing us to move away from SHA1!

On: America Is Backsliding Toward Its Most Polluted Era

[klysm]

The problem is we have a strongly factional two party system where the most productive strategy is to reap hatred between the factions. This is mostly a consequence of our plurality voting system.

[93po → klysm]

We also have a political environment that tries to gloss over the ways the two parties are similarly problematic and damaging while championing the idea that "we're the party of all things good and right and the other people are responsible for all bad positions".

Dems and Republicans alike support carbon emitting methods of power generating that result in over a million deaths a year worldwide. Voting for Trmp vs Bden probably doesn't have any real appreciable effect on worldwide pollution levels.

On: Show HN: Comparing product rankings by OpenAI, Anthropic, and Perplexity

[klysm]

I’m absolutely dreading the enshitification of these models. Google views it as absolute blasphemy that products are getting recommended and they aren’t getting paid

On: Nix Derivations, Without Guessing

[klysm]

What a bizarre and arcane incantation

On: PostgreSQL Full-Text Search: Fast When Done Right (Debunking the Slow Myth)

[klysm]

Avoiding distributed systems problems. Distributed systems are so incredibly hard to get right that I will vertically scale postgres until I hit an insurmountable wall before giving in.

[cryptonector → klysm]

You can also build distributed DBs with PG. For example for a DB with multiple write nodes all you need to do is implement an event shipping model with logical replication where your servers publish their events and subscribe to others, and you need to implement conflict resolution rules, naturally. I think PG's type system can probably be leveraged to make a CRDT system on top (and I bet someone's already done it).

[roncesvalles → klysm]

IBM mainframes were created for you. Imagine you had a single computer that had multiple nines reliability. Hot swappable disk, RAM, CPU. Redundant power supply. Redundant network stack. OS designed to never need restarting. That's basically what a mainframe is, and IBM sells billions of dollars worth of them to this day.

[hobs → klysm]

People ask me - "but can we just distribute it because everything in one basket makes me uneasy"

Yeah distributing state among 10 nodes, totally easy, fine, good.

On: Dockerfmt: A Dockerfile Formatter

[klysm]

The project should certainly also be formatting its own docker file via a docker invocation

[thedougd → klysm]

And built in a multistage Dockerfile.