Hacker News new | past | comments | ask | show | jobs | submit | beefhash's comments login

I sort of wonder if there's going to be a barrage of exploits held until end-of-life that's going to be released now.

EDIT: I'm already aware that the system has been exploited to death and back, so I'm mostly curious if people haven't already dumped everything.


There's actually quite a large community of 3DS hackers: https://old.reddit.com/r/3dshacks/

I was able to hack mine(though I don't use it much anyway) fairly easily. My brother did it to his so he could dump DS carts onto the SD card for better portability.


There are some cool homebrews still made: https://gbatemp.net/threads/wip-wumiibo-amiibo-emulation-for...

I suspect 3DS hacking community will stay active for long time as it's the only cheap (second hand 2DS), wide spreaded, hacked portable console available.


Indeed, I know some hacks were being held back until end-of-life. For example the author of SoundHax (one of the most important tools in 3DS hacking) said he was holding something off: https://twitter.com/nedwilliamson/status/874594459744423936

However this all assumes that updates will stop, and I'm not so sure that Nintendo would even announce such a thing.


you know they'll sneak updates forever worded like: General system stability improvements to enhance the user’s experience.

to patch exploits.


> Why use C11 over C99?

C11 gives you noreturn and alignas. Alignas can be pretty useful for low-level development in particular. Just hope you don't need variable-length arrays because those got changed to optional.

> Or even why use C99 over C89?

Several very big things: Native bool, stdint.h (fixed-width int types with known sizes ahead of time), long long, snprintf, not having to declare all variables at the top of the block (and now you can do for (size_t i = 0; i < sizeof(strbuf); ++i) because of it).


Designated initialisers.


For C99, don't forget // C++ style comments!


snprintf is pretty great for any sort of logging or error messages.


Open always wins, but that doesn't necessarily mean that it'll be qualitatively better, which is what your parent comment seems to hint at.


age only covers authenticated encryption. minisign/signify covers the signing part.

Everything else is either not used in practice or needs to be shifted to a dedicated protocol.


Here's the fix to e-mail: Centralization.

You can't curb abuse in a federated model. This is an issue that's been plaguing the fediverse as well. IRC networks, though not federated, have had to each individually ban spammers and other problematic users.

Google (GMail), Yahoo, Microsoft (Live/Hotmail), Yandex, QQ Mail. That ought to be enough for everyone. EDIT: and mail.ru


In China, your national ID is required to get a phone, and when you sign up for WeChat, that identity is tied to your WeChat account, and then to your bank account. That's the centralized solution.

Soon, the US will have "Real Americans have a RealID". That was supposed to turn on next month, but it's been put off for a year due to the epidemic.


Meh. I’m not bothering with “RealID.” I live somewhere that driving isn’t required so I don’t need an up to date drivers license and I very rarely fly anyway. I’m sure I won’t be the only person doing this.

I’m hoping (and reasonably hopeful) that some lawsuit will nerf it before I ever actually need it. Many people already argue it’s illegal.


Many people in the US (if they can afford one) will continue to drive a car, RealID or not. You're in the small minority...


I don't know QQ Mail. The rest doesn't allow anonymous signup, which I consider essential for privacy.

Google&co extort a phone number if they don't have enough tracking information about you and yandex shadow bans you (you can login, but don't receive any emails).


> Google&co extort a phone number if they don't have enough tracking information about you and yandex shadow bans you (you can login, but don't receive any emails).

Uhh no. Its for anti spam. Imagine if someone created a bunch of email addresses in one go without the phone requirement. You could abuse the 15 gb per account allocation pretty easily, or you could use those emails for spamming others.


I have a 10 year old gmail account. Every time I log in (from a residential IP) there is a 50% chance that it'll reject me despite entering the correct password, demanding a phone number.

> Its for anti spam. Imagine if someone created a bunch of email addresses in one go without the phone requirement. You could abuse the 15 gb per account allocation pretty easily, or you could use those emails for spamming others.

That may be the goal. But it also makes using the internet anonymously very hard, since getting a phone number are linked to real names in my country.

There should be less invasive solutions, like rate limiting sending of emails from new accounts.


>using the internet anonymously

Use:

-Protonmail not Gmail

-Swisscom myCloud not Drive

-Neocities not blogger

-Matrix (Element) or Signal/Wire not Talk/Whatsup/etc


If that was it then they would only require a phone number after there has already been a new account creation from your IP address that month, or support any number of alternative rate limiting strategies that don't have the same privacy implications.

Any website that requires your phone number is doing it for tracking purposes. Which is the same reason why you should never give it to any of them.


My ISP gives me a dynamic IP. I could turn off my router for a few minutes and be someone "brand new". Or I could use IPv6 (if my ISP actually invested in it), and have every web request use a different IP.

The only surefire way to curb abuse is to make sure the abuse is not cost effective for the abuser. For spammers trying to make a buck, make it so it costs them more to send their spam than the value they reap from it. For non economic spammers (politics, trolls, etc), it's a lot harder, but there's always some price that it becomes not worth it for their influence/"fun". This was the approach Bernstein was trying to do, but based on the article it sounds like he underestimated the cost of storage as technology improbed.

The hard part is adding this cost in such a way that does not drive away or punish real users. An email system that costs $10/month isn't going to be used by many spammers, because any reasonable administrator will ban obvious spam and they won't get their $10 to cover costs before being shut down. But it also limits the customer pool; most people are not going to pay $10 a month of email when free services are available.

Phone numbers are definitely not perfect, but they are trying to solve the problem of "What do most people have and would not invoke any additional cost on them, but would invoke additional cost on spammers?" Yes, phone numbers are relatively cheap, but there is still some backtracing/ownership checks that can be performed, and ones from more "trustworthy" blocks will still cost a buck or so. Suddenly spammers need to make at least a $1 from the account or they are losing money.

Domains are another way spammers are often dealt with: if it costs $10 for a ___domain, you have to make $10 from the ___domain before it is blocklisted, or again, you are losing money.

I can't think of any myself, but if you have any ideas for a model with comparable high costs to spammers but low cost to real people, that fulfills your privacy expectations, I'm all ears. However, costs generally are better enforced in a more centralized model as opposed to a federated/privacy respecting model, so I suspect it will be incredibly difficult to find a solution that actually enforces the appropriate economic goals.


> My ISP gives me a dynamic IP. I could turn off my router for a few minutes and be someone "brand new".

They can do the same thing with phone numbers. Buy prepaid SIM cards in bulk, use each one to create an email account, then sell them all again to recover the money because they still have 99% of the prepaid data left. This is less annoying for spammers than regular people who have to do this, because the spammers benefit from technical knowledge and economies of scale.

> An email system that costs $10/month isn't going to be used by many spammers, because any reasonable administrator will ban obvious spam and they won't get their $10 to cover costs before being shut down. But it also limits the customer pool; most people are not going to pay $10 a month of email when free services are available.

It doesn't have to be $10/month, it only has to be $10 on account creation, or $1. The legitimate user is going to have the same account for ten years, the spammer is going to lose their account inside of an hour.

The problem there is we still don't have an easy anonymous digital payments system, but requiring payment details is about as bad as requiring a phone number. In theory this is where cryptocurrency could be useful, but only if it becomes easier for regular people to use it.

You could also do similar proof of work things. For example, user doesn't want to provide a phone number? Fine, here's your email account, which can receive emails. If you want to send emails, install Folding@home or similar and submit X many work units. With email apps this could be completely automated; you install the app, your phone is plugged in overnight, the next day you can send emails.


> Or I could use IPv6 (if my ISP actually invested in it) and have every web request use a different IP.

But you'd be using the same prefix, which I'm sure some good soul would map, so you anyone who cared would correlate all of your accesses just as if you had a fixed IPv4


I would like to know how it is done at protonmail, where, last I checked, one does not need a phone number to register an account.


I don't think so. We could win so much of the spam fight by just making signed messages mandatory. Would there still be some spam? Sure. But it's better than handing over all email to a few select companies.


The problem right now is that big email providers commonly regard all of your email as spam even if it is signed.


A lot of the spam these days is being sent via hacked computers. You'd get signed emails from individuals, only those individuals wouldn't know they are sending them.

It's the same problem with DDOS. Some providers tried to mail out letters "hey, your computer is involved in malicious things, please get it fixed", but that just lead to a lot more support requests that the ISPs can't handle. So we just accept that botnets are a thing.


It is unlikely you would know the people that had the hacked computers. So that case would be the same as no signature at all. Otherwise the spammers could just make up their own valid signatures.


It seems like it's still a federated model, or will you only be able to send Google mail to another Google user?

I suppose the joke is that email has already evolved into this model, for most people.


hey, can you please add mail.ru to the list above?


No, the poster already said the above should be enough for anyone. /s


Upstream moving faster than downstream Linux distributions can possibly keep up with.


The proper solution is for upstream to behave.


If you're solution to the issue is, that upstream may only depend on 10 year old API/ABIs, then I'll gladly misbehave. Why should I hold back my software for old, but still supported distributions like RHEL 6?


There's a lot between "depending on 10 year old APIs" and the "we release every 7 days, you can only assume last week's version is supported" that is all the rage these days.


Once people pay me enough to maintain old versions, I'll gladly spend some time on it. Until then I'd rather look forward and use my limited time on things I care about and if a new API allows me to do that quicker, easier or more reliably, then I'm all in.


Indeed, C11 and C18 don't bring a lot. I'm glad that they don't because backwards compatibility and roughly predictable development of the language is important to me.


> You also have the long, complex and constantly changing list of rules which need to be applied for each update. They are very strict about noting down the copyright of all the files, for example (which I can understand to some extent).

Tracking licensing information very strictly makes sense.

Other than that, however, the Debian packaging process is something only a lawyer could love.


Wiimmfi is closed source software, however. If you actually want to look at how the internals worked, the independent altwfc project[1] may be much more interesting.

[1] https://github.com/barronwaffles/dwc_network_server_emulator...


Nitpick: The name of the Swiss entity appears to be “RISC-V International Association”, notably an association, not a foundation.

[1] https://riscv.org/about/history/#international


Only because Switzerland doesn't have the typical 'Foundation' structure as found in the US. For all intents, it's a nonprofit Foundation but since they're now domiciled in Switzerland they use the "Association" nomenclature.

https://en.wikipedia.org/wiki/Swiss_association

From their registration:

> The purpose of the association is the promotion and development of free or open source hardware and software technologies and applications for use on computer systems with a focus on the development and implementation of a free and open RISC-V instruction set architecture (Instruction Set Architecture, ISA). The association pursues a non-profit and not a financial, self-serving or commercial purpose. For this purpose, the association can, among other things, promote and finance research and development initiatives and other activities and participate in other companies or cooperations that are geared towards the main purpose.

https://www.zefix.ch/en/search/entity/list/firm/1429598


They used to be the "RISC-V Foundation", but changed name when they moved.


Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: