Honestly, knowing what I know about marcan, the decision was probably the result of an overwhelming/strong emotional reaction.
Not to just shit all over him or anything, but it really sucks to see someone who is genuinely top-ten-on-earth when it comes to "real hacking" struggle so much with socialisation and mental health.
It is weird to blame the victim for reacting to being harassed by a mob. That is a normal thing to have a reaction to. Perhaps rather than blaming people's social skills and mental health, we should instead blame the culture that normalises harassing people on the internet, even to the point of suicide (as happened in byuu's case). You are basically advocating that it is better for individuals to change to accept a shitty society as a given rather than advocating for society to change to be less shitty.
I'm genuinely unfamiliar of the harassment campaign that HN launched against him.
(I am familiar with some comments debating the validity of Byuu/Near's gender identity, and marcan's extremely strong reaction to that, but no actual harassment campaigns)
This is not a dichotomy. It's not healthy to take random online comments to heart so much. It's also bad to make such ridiculous comments. Both can be true at the same time.
This diminishes what "random online comments" are. They aren't just text on a screen. They represent words that another human being has said about you. Often, words that will convince other human beings, who may take different actions or view you differently because of what they've been told, which will in turn spread virally and alter how thousands and thousands of humans see you and act towards you.
Humans are a social species. It is easy to say "just don't be social bro". When you are actually the victim of this behaviour, it is much less easy to shrug off. Having a bunch of people hate you and say horrible things about you hurts. That's not abnormal. That is perfectly normal. Is it good for your health? No, in the same way that somebody smoking next to me is not good for my health, but it's not my fault the person next to me is smoking. The blame rests with them. To some extent, yes, stepping away from the smoker is a short-term fix, although often an unpleasant one that impacts your quality of life in other ways (what if the restaraunt you like is full of smokers, what if the airport is full of smokers, etc). In the same way society eventually changed to discourage smoking around other people, we really, really need to change the culture around the internet, to recognise that the internet is actually a social environment, that there are real people on both sides of the screen. "Go touch grass" implies that the internet is not the real world, but it very much is, with real consequences, even if you can't see the other person.
I agree it would be much better if online culture improved, and I don’t think anyone would argue against that. The difficulty is that change at that scale tends to be slow and unpredictable, on the order of decades, so you can't rely on it in the short term.
Because of that I think there’s value in focusing on what individuals can control, like setting boundaries, disengaging when things get overwhelming, or stepping away from spaces that become unhealthy.
That doesn’t mean the behavior is acceptable, or that people should just tolerate it. It’s more about acknowledging that, while broader change is important, taking steps to protect yourself is the only immediate and reliable option.
> The belief that this will happen is also a malicious fairy tale to tell to people.
Cultural change is possible. It is not something that will happen, no. But it is something that can happen, if enough people choose to make it happen. Making it happen starts by pointing this out and not blaming the people on the wrong end of this behaviour.
This kind of thinking reminds me of my truly most loathed thought-terminating cliche of all time, "life's not fair", as a justification for supporting some horribly unfair status quo. True, life isn't fair, but humanity has collectively spent an unbelievable amount of effort doing all kinds of things to make it slightly more fair, one step at a time. We can make it more fair. That's what we do as humans. We bend the world to our collective will.
---
seems the comment I was responding to was completely rewritten while I was writing this. oh well.
You are derailing this discussion by keep moving it to: "This is what the world should be like", and no one is disagreeing with that here. This is not what anything I said is about.
The very first comment I replied to was insulting the victim's social skills and mental stability. This is the exact opposite of what is needed to reach "what the world should be like". Positive progress is not inevitable. It does not happen by some fate of the universe, where if we just wait things will naturally improve and life will get better. When positive progress does happen, it happens by humans consciously choosing to act in ways that make the world a better place rather than in ways that do not.
>The very first comment I replied to was insulting the victim's social skills and mental stability.
Dude, the very first comment you responded to was itself a response to someone who suggested that the frankly unhinged HN "ban" was a decision that was "not taken lightly".
They literally stuck a comment into the site banner suggesting that HN comments critical of Asahi or their devs was part of a Kiwi Farms targeted harassment campaign trying to take advantage of HN's SEO.
I don't know why you're continually upholding this fantasy, referring to marcan as a "victim", or pretending that somehow the problems of the world would all magically be solved if everyone only said positive things about other people all the time (communities like this 100% dysfunctional), but it's fucking strange and naive.
It was not a ban or anything that could even possibly be misconstrued as one. People are talking about an overreaction, but the real overreaction is here on HN. This had literally nothing to do with the topic of Asahi Linux's progress report, but somebody intentionally dredged up a year-old subject with an outright deceptive and extremely hyperbolic framing for the sole purpose of shitstirring.
> pretending that somehow the problems of the world would all magically be solved if everyone only said positive things about other people all the time (communities like this 100% dysfunctional)
This is not even remotely what I said. The issue at hand is people mobbing to personally attack and harass individuals. Earnest criticism is one thing, but there is absolutely nothing constructive or productive being accomplished by the way people are behaving on this subject.
> It was not a ban or anything that could even possibly be misconstrued as one.
That is correct. It was just a rant, really, and even then not even a long one.
> This is not even remotely what I said.
Can you clarify what you're trying to say, then? AFAIK nobody on HN is harassing marcan, Byuu, the Asahi devs or anyone else in that sort of vauge circle. We're making comments about how they might behave or present themselves publicly, and some of the comments are definitely negative - but there is no coordination or intent to belittle or anything of that sort. Just internet bitching.
(and I am open to counterexamples if you're happy to share - have people been emailing marcan personally to say "I'm from HN and you're a piece of shit"? I wouldn't be surprised if people on Kiwi Farms were doing some of that.)
This marcan person had problem with Go, he had problem with Apple fans, he had problems with linux committers, so much he left internet or something. To say everyone but marcan was wrong is just a kind of fanboyism and it hardly helps marcan.
This person liked to dish out as much as next person but display extreme reaction when served.
No it actually wouldn't. As in 15+ years of Hacker News I have not seen the same so clearly it can be so horrible that it regularly leads to such strong reaction, suggesting that for most people this isn't nearly so impactful. And very few things described could actually be called harassment, mostly it was light criticism or maybe a bit trolling.
The guy appears to have a fragile ego. Any criticism and he goes nuclear, as if he was never told "no" as a child. Sure you can have opinions about the best way to moderate comments, but I can't imagine thinking I was special enough to publicly demand how Hacker News should be run. I've worked with people like this, not fun!
Marcan was clearly mentally unwell. He delusionally thought there was some harassment mob after him. After the fallout with Linux kernel devs, the lolipedo accusations, and him being outed as the vtuber Asahi Lina, he arguably did the correct thing: deleted every social media account and abandoned Asahi Linux. I hope he stepped away from screens and spent some time outdoors.
I am not sure how what happened can be considered "being outed", the vtuber's puppeteer was obvious from day one to anyone who was paying any attention at all, it is just that a lot of people decided to uphold the kayfabe. (And I don't blame them, at least before the lkml crashout it was a pretty fun character.)
While there is overlap between vtuber communities and HN, the culture is quite different. When one does come up, it is eternally September on HN. In vtuber communities/culture, the persona of the vtuber is treated as entirely separate from the person behind it, even in cases where it's exceedingly obvious (e.g. someone leaves an agency to work independently).
At the very least, it is rude to disseminate, draw attention to, or even speculate aloud about the identity of the person behind the avatar. Typically it's considered harassment/doxxing (I believe this is because vtubing culture is largely derived from Japanese idol culture, which appears to be structured around dealing with stalkers). That is to say, "upholding the kayfabe" is a bare-minimum of respect.
I could see why people on the Asahi team considered HN to be a host of harassment, considering even a cursory search of HN turns up comments "compiling evidence" about Asahi Lina's identity (including one still-up comment that straight-up links to Kiwi Farms, which is almost certainly done for purpose of harassment). I'm not sure if Hacker News ought to be moderating comments that deconstructs pseudonyms where clear effort has been made to separate it from the person behind them, but I also empathize with not wanting to be linked to accordingly.
I do not understand why people would rather play into the delusions of a clearly mentally unwell individual for months and year on end — when they well know it's bullshit — under the guise of this somehow being in the interests of said individual and/or being fun. This, to me, is the height of selfishness clocked in disingenuous empathy.
The widespread normalisation of this behaviour, and the subsequent ~~thought~~ now real policing around the issue, is a clear mark of a deep societal ill.
Apple's whole thing is hardware + software working together. Endless other options available to Linux users. They'd also need to be prepared for people bringing laptops to stores with hardware problems that aren't running macOS. Again, more burden for Apple for no gain other than winning over a couple of dozen users.
Do you seriously think someone who installed Asahi is gonna walk into a genius bar and ask for help with it? And often enough that it becomes a burden??
And according to their stats page that sibling linked it’s more like a few tens of thousands of users.
Actions have consequences. There will always be people in the world that get pushed beyond the limits they can endure. It reminds of that CEO that got gunned down by someone that was being affected by the company profiting off of making a business of denying health insurance claims on technicalities.
I don't support this and yet I know for every harm people in these corrupt institutions are involved in, the universe gives back your due.
If you want to stop the harm. Stop harming the world with your actions in what every way that needs to manifest for you.
Reading that BBC article, how the attacker got caught while shouting at an OpenAI building, it would seem likely that this attacker is confused or deranged. Not specifically someone with deliberate evil intent.
So the headline seems to be more "high profile person attacked by lunatic" than "OpenAI CEO attacked for being evil".
Don't know what the grandparent meant by GSSAPI, that is just an API for various underlying auth methods. But what people usually use together with GSSAPI is Kerberos.
Kerberos can be very secure, much more so than CA-based or generally asymmetric crypto based approaches. Kerberos (if you ignore some extensions) uses symmetric cryptography, so it is less vulnerable to quantum computers. Use AES256 and you are fine, a quantum attacker can at the most degrade this to a 128bit level (according to current theories). Also, no weak RSA exponents, elliptic curve points at zero, variable-time implementations or other common pitfalls of asymmetric crypto. The trusted third party ("KDC" in Kerberos) distributes keys ("tickets") for pairs of user and service-on-server, so mutual authentication is always assured, not like in ssh or https where you can just ignore that pesky certificate or hostkey error. Keys are short-lived (hours to weeks usually), but there are builtin mechanisms for autorenew if desired. Each side of a key can also be bound to a host identity, so stealing tickets (like cookies in HTTP) can be made harder (but not impossible). The KDC can (theoretically, rarely implemented) also enforce authorisation by preventing users from obtaining tickets for services they are not authorized to use (the original idea of Kerberos was to just use it for authentication, the authorisation step is done by the service after authentication has been established).
Single-Sign-On with all the usual protocols is included automatically, you log in to your workstation and get a ticket-granting-ticket that can then be used to transparently get all the subsequent tickets for services you are using. The hardest one to implement is actually HTTP, because browsers suck and just implement the bare minimum.
However, the whole of Kerberos implementations is ancient, 1990s era software, packed with extensions upon extensions. You don't really want to expose a KDC to the open internet nowadays. The whole thing needs a redesign and rewrite in something safer than 1990s era C.
Oh, and there are mechanisms for federation like trust relationsships between realms and KDCs, but nobody uses those beyond merging internal corporate networks.
the weak point of Kerberos is not the Kerberos protocol itself, but the most popular implementation of it being Microsoft Active Directory.
Due to an incredible bloat of AD and entire Windows/Azure ecosystem, it has an enormous attack surface (multiply the universe of all windows ecosystem by the decades of old versions being supported for compatibility), and any vulnerability in the ecosystem (past and present) can lead to escalation and compromise of the Active Directory itself.
so is Kerberos secure? as a protocol it is fine, cause it was developed at MIT by smart people.
is MSFT AD/Windows ecosystem secure? HELL NO, stay away
Well, yes, almost totally in agreement, but: MIT Kerberos (the implementation) started out as "research-quality" code of the 1990s era. It has improved, it fares far better than AD, but the occasional exploits still continue to drop.
Doesn’t this require the server to consult the IDP on every log in, though, to make sure the id token is valid? One of the staples of ssh from a UX standpoint is that it’s peer to peer.
the difference is in /key management/. Key management is the hard part. Especially keyless SSH management. (things like sigstore's rekor/fulcio remove some complexity here). It is not "just a (manually generated) ssh certificate"
So 100% with you here...