Hacker Newsnew | past | comments | ask | show | jobs | submit | more AceJohnny2's commentslogin

> ensuring there's no malware somewhere that's been added in the build process

i.e. supply-chain safety

It doesn't entirely resolve Thompson's "Trusting Trust" problem, but it goes a long way.


Is it possible for mortals to rebuild gcc from scratch? Can I start with some minimal, auditable compiler (tcc?) and build up to a modern gcc? Or would it be some byzantine path where I need to compile gcc v1998, then perl, then Python 1.8, enabling you to compile gcc v2005, which lets you build Python2.3, etc.


It is a byzantine path, also because gcc switched to C++ at some point (for no good reason IMHO). But there is a project that maintains such a bootstrap path: https://www.gnu.org/software/mes/


Mh. Though, if you have deterministic builds for GCC, imagine how much of a problem some nerd in Northern Washington or Scandinavia with their own strange C build chain would be to inject something strange into these compilers into the build process.

Like, you spend millions to get that one backdoor into the compiler. And then this guy is like "Uhm. Guys. I have this largely perl-based build process reproducing a modern GCC on a Pentium with 166 Mhz swapping RAM to disk because the motherboard can't hold that much memory. But the desk fan helps cooling. It takes about 2 months or 3 to build, but that's fine. I start it and then I work in the woods. It was identical to your releases about 5 times in the last 2 years (can't build more often), and now it isn't somewhere deep in the code sections. My arduino based floppy emulator is currently moving the binaries through the network"

Sure, it's a cyberpunk hero-fantasy, but deterministic builds would make these kind of shenanigans possible.

And at the end of the day, independent validation is one of the strongest ways to fight corruption.


It is sort of like that. It's been documented: https://github.com/fosslinux/live-bootstrap/

(This is an alternative to the Guix/Scheme thing).



There has to be some backpressure on the supply chain. I appreciate that you used your clout to make the issue public, but sometimes I worry that it only goes so far as our little echo chamber.


If it's any consolation, the video I posted on YouTube is getting some traction.

If it can get a good number of views, maybe it can at least generate enough impact to cut off a few hundred units of sales. That won't make a massive impact, but it's better than nothing.

If Bosch allowed me to update the firmware of my unit to not lock out features, I'd maybe consider doing that locally over an ad-hoc connection. Wish they would've just included Zigbee, Z-Wave, or Matter instead.


I can almost guarantee that I will now start seeing references to this in dishwasher recommendation threads on forums and Reddit now. And it won't be me doing all of it, I swear! :)


> There has to be some backpressure on the supply chain

Sure it would be nice, but just like all things, not to be pessimistic or fatalistic—the HN rejection of something doesn't practically matter to most companies. I mean, why is it is that Steve Bannon is the loudest voice against technofeudalism today? Why can't we get louder and get other people listening?


Make stickers and go put them on the units at the store. Send Bosch a picture of how you've improved their labeling along with a nice note indicating that you'll do it again if they don't change their ways.


That'd probably get you banned from the store if they find you doing that and at best, it's only going to get the message out to a few customers until the store staff remove the stickers.

Jeff's using his internet fame to reach far more people. I previously thought that Bosch were a good brand (only had a blender and a temperature controlled kettle from them though), but now will avoid them.


Ok, but not all of us have internet fame. I've found that my "here's where to pirate this textbook" stickers are not typically removed. Maybe sellers of dishwashers are more diligent, who knows.


Fair enough. I do enjoy seeing various subversive stickers put on lampposts etc. Maybe complaining on the internet and putting stickers would be a better tactic, but placing stickers probably takes more effort.


Perhaps there's an opening in the market for an appliance company that brands itself on self-repair and self-hosted connectivity? All most people want is "push button and do the thing as long as I live".


Maybe there is, maybe there isn't.

I mean, we all know what people say they want and what they'll do when/if they buy something may be two totally different things.

And: creating a dishwasher (or $appliance) that does its actual job good enough to be worth buying isn't something that can be hacked up in a weekend or two.

Edit to add: maybe - as Bosch pretty much has figured out how to make good diswhasheres - it'd be easier and more approachable to hack, rip out, replace the control electronics. Chances are this is going to work on more model than the one...


The calculation about whether to repair something or not usually hinges around labor and material costs vs replacement cost. The more difficult something is to repair, and the more expensive the components are, the less like it is to be repaired.

It's probably also true that high turnover of goods across brands due to early replacement allows for slimmer margins and higher yields, and hence lower cost of purchase. So on the other extreme, make things break more often and sell them cheaper and more often, which seems to be the status quo.

The economic problem to solve, then, is how to encourage brands to increase the durability of their goods. There are some review publications that perform stress-testing, but few keep metrics on long-term durability in a real-world setting. At a minimum, I check consumer review sites before I buy just to avoid the worst brands, and there you do see some people coming back after a few years to leave a warning to other people. And perhaps this kind of feedback has some effect.

Hopefully people start prizing 'dumb' products, and start leaving bad reviews on products that rely on an internet connection, when they're left stranded after the connection drops out.


I want to know what dishwasher and washing machine Marques Brownlee (mkbhd) uses, and to know that is going to use his clout in this regard ... not to burden him, but he has almost 20M subscribers on YT ...


I don't know if I want an appliance recommendation from someone who launched a paid subscription app for phone wallpapers. That mindset does not seem compatible with the customer owning what they bought.

If there was any influencer I'd want to know that from it's Louis Rossmann.


Louis' dishwasher is a Blackberry ;)


Tangentially, France has had the CNIL [1] since ~1978, following a scandal about creating a national citizen's database, and exists to prevent exactly that. (I believe the objection stemmed from memories of the Petainist fascist regime during WW2)

The CNIL is why France (and now Europe) has "Right to Forget" laws. It is the direct ancestor of stuff like GDPR.

Unfortunately, I feel like the CNIL is fairly neutered nowadays. Nevertheless, it serves as historical precedent, for those who remember it exists.

[1] "Commission Nationale de l'Informatique et des Libertes" ~= "National Commission of Computing & Liberties"


This goes well beyond historical precedent. The legal system is complex, but even when Parliament approves a law, it can still be struck down if it violates fundamental principles.

For matters concerning IT and privacy, the CNIL (French Data Protection Authority) could spearhead such cancellation proceedings.

And companies doing business in France should watch out—CNIL sanctions are no joke!

Are there specific events making you feel it has been neutered?


I wonder if not having such state database is not causing today more issues than it defends from.

In the 80s I would get it, the state was the only one able to build such a database and people were afraid of what it would do secretly with it. Nowadays, "everybody" has a database with millions of people (ex: facebook, linkedin, x, tax offices, etc.) and discriminatory actions are done based on whims/stupidity rather than on actual good data.

People will do horrible stuff because they believe in it, not because they have good data.


The CNIL is doing a ton of work to limit private databases and cross-checking as well.

It can be hard to believe from more business focused countries, but the agency setting precedents has had dissuasion effects, and most companies do end up caring about their data retention and management policies. I've been in enough meetings where UX proposal gets entirely reworked because of a simple link to the CNIL's guidelines.


I checked the list of the fines (https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil). They are definitely doing good things, but they do not seem to be very active to prevent companies to gather large databases if they can give some reason (ex: facebook / linkedin / etc.).

And I am fine if your opinion is that less data collection is better everywhere, but this idea should be applied to everybody (government & private entities). My opinion is that if you fear much more the government than private entities you give those private entities an advantage.


Linkedin has been fined for their use of personal data for ad purposes (albeit through the RGPD framework after the CNIL passed the case to them):

https://www.lemonde.fr/pixels/article/2024/10/24/donnees-per...

Facebook is also targeted under the RGPD, we've been amply seeing the news. The CNIL doesn't need to be doing everything either.

There is and will be no silver bullet completely stopping companies from building databases. I see having an active agency responding to user feedback as at least a decent counterbalance to it, when it's a complete shit show in so many other countries.

> government

Right now the government having extensive databases allows people to manage all their health payments and data in one place, including any hospital getting access to their full history when they're brought in pain barely able to speak. That also includes ease to vote on the net within minutes, check school records on a standardized site etc.

It's not perfect and probably abused in some way, but right now the net benefit at scale largely overshadows those IMHO.


Registration as an expat in the Netherlands is much smoother than in France, for things like taxes, health, pension stuff, municipality stuff, etc. (not to mention at the time I did in NL I did not know the language and I know well French). You basically register in one place and lots of things are pulled from there when needed by other branch of government.

In France at almost each new authority I interacted with I needed to provide again the same information, while for all intents and purposes the government has it already (just that in another database).

My impression is that lot of effort is wasted due to duplication (including verification, updating, lack of cross referencing) and not sure why (if the case is that "we have N databases because people can't get together to agree on one", that would make some sense ...)


> Hilarious that they have symbols stripped, but still outclassed.

Debug symbols have 0 runtime penalty, just storage. They're just another section of the binary, referenced by debuggers, and which the loader skips.

In any case, all distros break out the symbols into separate files so that they can have their (storage) cake and (debug) eat it too.


Right, I meant the humor to be that folks to not use debug flags, with my naive presumption that they did this as an optimization, only for that not to really help.


TCL is embeddable (in another program). In fact that's how it started.

That means it's a good language to extend your program. I don't know how it compares to Lua, which seems to have replaced it in that space.


Lua is simple to bolt on to your project.

Perl is a nightmare to interop! They should have won an award for that. It took effort.

Python is slightly cleaner than perl, but not much.


You mean, the interpreter is available as a library with bindings in many languages?

But then - isn't that the case for other scripting languages these days? Or are they too complex and with "strings attached"?


I can't speak for other scripting languages, but it's absurdly easy both to embed Tcl as an interpreter in a larger project, and to create a Tcl extension which implements your own commands.


You're using the same words. What is "easy" about embedding TCL that is "difficult" about embedding Perl or Python? Can you spell this out?


Sorry, missed this at the time. But I did say I can't speak for other scripting languages. All I can say is that it was much easier than I was expecting!


One can leverage Lua in PHP, I think it's handy for user-supplied logic (eg: business rules)


I like TCL a lot more for this use case, and I don’t care for Lua at all; but Lua might be a better match for embedding in an OO language.


Expect was born out of TCL, and its original syntax worked really well with TCL's.

Its popularity led it to being ported to other languages, Perl & Python being the big ones, but TCL Expect is the og


SQLite has the same origin story. (That's the reason for SQLite's confusing type system: it makes perfect sense as a Tcl type system.)



Oh I know. I’ve been thinking about keming for 30+ years. :)


OK then I'm going to need an explanation of what was clever about it. It seems like it would just be reusing the meme, no?


lol ooops, missed who I was talking to ;)


Absolutely this.

The frustration when I turn on the Steam Deck and the Apple TV goes

"Look at me. Look at me! I'm the output now"


Yup, game consoles are ground zero for this. I hit the button on the PS5 controller only to have the receiver and TV power on, then the PS4 wakes up for some reason and then switches the AVR to its input.

My Sony UHD player also seems to want to grab the input sometimes too, so maybe it's Sony that's the source of the problems haha.

And again, it's all just so maddening because it feels like it would go away if I could be like "Hey, AVR should never send power-on messages to its input devices." Because then I would just power on the device I actually want to use, it would turn on the AVR and TV, and we'd be golden.


Even better: I have some sort of Useless Machine[1] bug where turning on the TV will power up the PS5, which then puts itself to back to sleep.

[1]: https://en.wikipedia.org/wiki/Useless_machine


Oh I've definitely had this one too, where the TV powers up to the "I'm going to sleep now lol" screen from the PlayStation.


> And again, it's all just so maddening because it feels like it would go away if I could be like "Hey, AVR should never send power-on messages to its input devices."

Yeah, that sounds a weird "feature" in the first place.

If I manually turn on the UHD player/Chromecast/PS5/whatever, it makes sense that the TV also turns on and switches to the respective input.

I could also sort of imagine that if I switched the TV to some input source, it might be convenient if the device connected to that input turns on. (Not by a lot, though. You need the device's remote/gamepad/whatever anyway to tell it what to do, so the one button press saved doesn't really buy you much.)

But what makes no sense for me is the TV turning on all input devices when it's being turned on itself. When would you ever want to have the PS4, the PS5 and the HD player running, let alone as the default behavior?

That sounds like a genuine bug in the TV.

(Also, you sound as if you have some sort of "2 <-> n" setup with n input and 2 output devices. I have no idea how CEC would even be supposed to behave in such a setup. Would an input device turn on both output devices?


It's a conventional setup:

TV <- AVR <- PS4, PS5, Switch, UHD

I suspect the issue is largely with the receiver (a VSX-935), as that's seemingly the component sending a turn-on signal to its inputs.

If I could, I would have probably run everything to the TV and just done all the audio over eARC, but the TV is on the other end of a 50' HDMI cable, so I definitely need the receiver as an in-rack multiplexer.


Ah, that makes sense.


I turn off CEC all the time and my tv refuses to acknowledge it if I ever unhook the device or HDMI. Always defaults back. Drives me crazy.


Highly recommend https://www.amazon.com/Lindy-HDMI-Adapter-Female-41232/dp/B0... -- I have a couple and it's solved this problem for me completely. I hate how unpredictable CEC is when things go wrong, on top of the ridiculous 3 device limit.


What are the worthwhile apps apps on the alternative stores?


Fortnite, Fall Guys, Delta (Emulator for Nintendo DS, Gameboy, N64, NES and much more).

Torrent clients. QEMU. YouTube Apps with Sponsorblock and Adblock.


Delta is on the official iOS App Store for what it’s worth. There are also a couple apps that support watching YouTube with sponsorblock and Adblock available too.


Delta seems to be allowed (at least partially) because of the DMA and the EU.

I'd also love to hear your suggestions on those couple of apps. Last time i checked, proper apps either charge whatever they want to because of their monopolistic position(+ the cost of an Apple Developer Program to a hobbyist) , and free apps unclear if they even solve the problem are designed to harvest and sell almost everything you have.

Orion is a very rare exception in both of these cases but they weren't able to make uBO work


> Delta seems to be allowed (at least partially) because of the DMA and the EU.

Yeah, that's an important point. Delta on the App Store is most likely a direct result of the Digital Markets Act: https://www.theverge.com/2024/4/5/24122341/apple-app-store-g...


> QEMU

Isn’t it still crippled and unusable for any non ancient platform unless you have a jailbreak?

Seems like you still need to side load AltStore Classic to get the full version.


You need to be tethered to enable the JIT, without it UTM is very slow. Even TinyCoreLinux was extremely slow.


Yeah, so the EU App Store don’t really solve that since there is still not way(?) to get JIT legitimately.


that's problem with APPL's attitude, not the "EU App Store".


It’s a problem with EU’s regulations if they allow such outcome (i.e. Apple being allowed to artificially cripple third party apps).

Obviously AltStore did the best they could..

> APPL's attitude

Everybody knew from the beginning that they’ll do the minimum they can get away with so blaming Apple is somewhat pointless.


I'm genuinely flabbergasted by this thread.

> ... Everybody knew that Apple would be uncongenial, borderline malicious ...

> Therefore its pointless to blame Apple

The entire fault is on Apple. The EU that is notoriously depicted as overly bureaucratic and slow-moving managed to make the largest consumer walled garden to relax its gates and give some form of authority to people who own the damn device.

Remember, no form of official sideloading existed before the DMA.


> Remember, no form of official sideloading existed before the DMA.

MDM has long existed. In fact that was Apple's counterpoint to alternative alt-stores.

Certainly it didn't allow you to bypass any execution restrictions any further than the regular app store.

Random link: https://it-training.apple.com/tutorials/support/sup530/


I'm taking consumer focused solutions into account. No single individual could reasonably set up MDM to gain some sort of freedom


The problem has always been Apple's attitude, which the DMA sort to fix.

Whether Apple is in compliance or not is up for debate.


Delta is in the ordinary App Store, too.


That is because Apple relaxed its App Store guidelines after the DMA to disincentive sideloading.



"Did you win the Putnam?"

Sorry u/sanj & hat-tip to u/cperciva ;)


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: