Hacker Newsnew | past | comments | ask | show | jobs | submit | kennywinker's commentslogin

> It is the nature of how Hamas wages war in Gaza that is driving the assumptions here

When the bad guys use human shields, it’s on the “good guys” to somehow resist the “good guy” urge to blow the whole city up.

Hamas has killed something in the order of 800 idf soldiers during this conflict, if we exclude the ones killed on oct 7th. In that same time at least 75,000 palestinians have been killed - most of which were women and children. So, unless you’re saying this is a justified collective punishment for oct 7th, what on earth are you possibly referring to? Hamas isn’t “waging war” in any real sense.


I think he's saying that this is par for the course for asymmetric conflicts with deeply rooted insurgent groups.

So if you are going to say the handling of this conflict has more to do with Israeli training/mindset/etc and is not related to the type of conflict, do you have other armies in mind that have fought similar conflicts and done better?


Battle of Fallujah? The war against ISIS in Iraq in the 2010s?

Before the most recent invasion of Gaza started, there was an interview with an Israeli general about the imminent invasion. And when the question came up about what lessons Israel was drawing from other urban conflicts like the Battle of Fallujah, the response was a very indignant we-don't-need-to-learn-anything. Small wonder that the IDF claims to have achieved unprecedentedly low civilian casualty ratios in their invasion of Gaza when in reality, they're commensurate with WW2 ratios and well above the urban assaults of the US's Iraq War.


> Battle of Fallujah

Which one? There was five, and they generally were pretty bloody.

For the second battle of Fallujah (seems like the one you are talking about), US estimated that most civilians had already left the city. However that is somewhat disputed with some people claiming usa used that as an excuse to claim everyone left in the city was a combatant.

To quote the guradian:

> Before attacking the city, the marines stopped men "of fighting age" from leaving. Many women and children stayed: the Guardian's correspondent estimated that between 30,000 and 50,000 civilians were left. The marines treated Falluja as if its only inhabitants were fighters. They leveled thousands of buildings, illegally denied access to the Iraqi Red Crescent and, according to the UN's special rapporteur, used "hunger and deprivation of water as a weapon of war against the civilian population".

Another guardian quote:

> "There were American snipers on top of the hospital shooting everyone," said Burhan Fasa'am, a photographer with the Lebanese Broadcasting Corporation. "With no medical supplies, people died from their wounds. Everyone in the street was a target for the Americans."

> The war against ISIS in Iraq in the 2010s?

So according to https://en.wikipedia.org/wiki/War_in_Iraq_(2013%E2%80%932017... there was 200,000 killed and 5 million displaced.

To quote from the human rights section of the article "Iraqi government forces and paramilitary militias have tortured, arbitrarily detained, forcibly disappeared and executed thousands of civilians who have fled the rule of the Islamic State militant group", which doesn't sound great.

So i think it raises the question of if the Americans were really better than the Israelis or just better at the PR game.


https://en.wikipedia.org/wiki/List_of_journalists_killed_in_...

> the single deadliest conflict for journalists in all known conflicts in the history of the world, according to the Costs of War Project

Does that sound like “par for the course”?

By that measure, every other army in every other war prior has done better.

This “war” (genocide) is not normal.


This list seems to include people who were journalists but weren't killed while acting in the capacity of a journalist (as far as i can tell). If this is how you define journalist then world war 2 was certainly much much deadlier for journalists. To put it bluntly, i have my doubts that its making an apples to apples comparison with other conflicts.

Yeah - for example Abdullah Ahmed Al-Jamal was killed because he was holding three hostages in his apartment, yet he was included in the list of "journalists killed" anyway.

Right. Like how any potential reader is familiar with the risks of sql injection which is why nothing has ever been hacked that way.

Or how any potential driver is familiar with seat belts which is why everybody wears them and nobody’s been thrown from a car since they were invented.


> Hopefully, this post helps clear that up!

Thanks, it did not.

OAuth and OpenID Connect are a denial of service attack on the brains of the humans who have to work with them.


A has an account at B, A has another account at C, A wants to allow C to access data at B (or to send data to B on A's behalf).

How can B be sure that C is acting on A's behalf? Can A only allow C to access certain data (or send only certain data) in order to reduce risk?

A protocol that allows for that three way negotiation is OAuth.

Like with most specs, a lot of the complexity is added in the later years, by companies that have thousands of users and complex edge cases and necessities, and they are the ones dominating the council, and their needs are the ones that push forward newer versions.

So with most specs, the best way to start learning it is by learning from the oldest specs to the newest ones, so if you start by reading or using OAuth2, you will be bombarded with a lot of extra complexities, not even the current experts started like that.

If you need to catch up, always start with the oldest specs/versions.


Wow, that was a really valuable lesson. I wish I had this one at university. But the next best time to have it, is now.

So thanks!

I'll start reading the oldest HTTP spec for funzies.


That'd be RFC (checks notes) 1945 for HTTP1.0 and later RFC (checks notes again) 2616 for HTTP 1.1. I think there's HTTP 0.9 but I went directly for 1.0

Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream, no libraries no frameworks no apache no ngninx. And I don't mean you need to rebuild a general purpose an apache like server, maybe for a landing page you can just serve a static page and you will be implementing a very small subset of HTTP.


Haha, thanks! I'll check them out.

> Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream

Sounds like a fun weekend project.


I have implemented OAuth both as a client and a server. The most complicated part is the scattered documentation, and little gotchas from different providers. In itself, the whole thing is not complex.


That's just a very confusing diagram of the process, which has multiple separate boxes for the same entities.

The diagram on Microsoft's page[1] for that exact same scenario/flow is much clearer IMHO.

[1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2...


I hope this was meant as a joke…

Why would it?

The first diagram is literally all over, with just small labels to remind you that this box over here relates to that box over there.

The Microsoft diagram clearly show the parties involved, who they communicate with and in which sequence.

As I mentioned in another post, I found the MS pages very helpful to understand OAuth 2.0, and the clear diagrams was a large part of that.


The diagram shows five boxes, apparently each representing a server, but I am not at all clear on which (of exactly two?) legal business entities controls certain of those servers.

I use OIDC in my home lab (with Authelia). It is very simple to work with it.

I do not understand what I am doing and trust the docs, but it has never been a particularly difficult setup.


> I do not understand what I am doing

I would argue that then you do not "have to work with them", you are merely using products built with them.


The article is answering a request for explanation of how it works, however. In other words, they do want to understand.

No you're thinking of SAML.

SAML is the devil. If it weren't for its XML aspects we'd probably not have bothered as much with alternatives.

SAML is bad semantically too, not just because of XML. SAML is arguably the worst cryptographic standard ever created.

> SAML is arguably the worst cryptographic standard ever created

The PGP packet has entered the chat.


Completely agree. OAuth, Auth0, Okta, OIDC.

Except discord’s verification applies globally, while matrix is only aiming to implement it for users who live somewhere where it is required by law.

The list of locations with those laws is growing very large. From the post:

> Last summer we announced a series of changes to the terms and conditions of the Matrix.org homeserver instance, to ensure UK-based users are handled in alignment with the UK’s Online Safety Act (OSA). Since then Australia, New Zealand and the EU have introduced similar legislation, with movement in the US and Canada too.


...and while we have no choice but implement it on the matrix.org instance, other folks running their own servers are responsible for their own choices.

Discourse?


I think the issue here is that companies (and govs) are choosing the worst possible solitions to a real problem because it benefits them. Gov wants it for control, companies want it to sell ads and mine data. They team up, and screw everyone over while overlooking other viable solitions


But is a photoshopped image of an ID a fake id? Do you possess it? A photo of an id isn’t an id, it’s a photo. Ceci n'est pas une pipe


I suppose that's tongue-in-cheek? Otherwise I can only wish you good look in court with that defense. ;)

In my jurisdiction, it's clear- cut: yes, that would constitute a forgery.


I guess I assumed it’s illegal in that you are using an image to tell a lie in a transaction… like any other kind of forgery - but what i’m actually unsure of is posessing a jpg of an altered drivers license illegal? Seems different than a physical license.


But how does Discord sue you? On face might be a crime, but in reality it is expensive for Discord to sue someone just because of an ID.

Of course I agree this doesn’t worth it. If they force an ID I would just abandon the platform.


I was referring to the concept of "ceci n'est pas une pipe", and that even just digital forgery of an ID can constitute a crime that can be prosecuted independently from anybody suing.

Of course I highly doubt they'd sue. They either just don't let you in or you abandon them. I'm with the latter.


I’m not a lawyer, but i’d guess that possessing a jpg of a fake id is treated differently under the law than a physical forged id. Once you use it to defraud someone, that’s probably treated the same, but just owning the jpg?


Yeah I agree. There is always some risk about government ID. Long gone the day that ppl could forge one relatively easily, when ID was just a piece of well made paper.


The “arrests” are being done in a deeply unconstitutional way. Acting to uphold the constitution is beyond speech, it’s a duty of all americans.


Are these federal officers? They’re men in masks with camo and body armor kidnapping people off the streets and refusing to show identification beyond a patch that says “ICE”.

That is who is alleged to be impeded.


Yes, they are federal officers. There is no pattern of mass kidnappings by impersonators occurring here.

Interpreting masked officers in tactical gear as kidnappers, or claiming that a patch saying “ICE” is insufficient identification, is not a legally valid basis for suspicion or resistance.


The fuck it is.

Sure, most of the people kidnapping people off the streets and incarcerating or deporting them without due process in violation of the constitution are federal officers. But unless they identify themselves clearly, you’d be stupid to not resist.


Insurrection is a choice with consequences


Rounding resisting kidnapping up to insurrection is an impressive feat. But please, stay on your knees, the rest of us will stand up for you.


> Farmers traditionally employ machines to achieve their harvest

Most food is picked by migrant laborers, not machines.


It depends on the crop. Corn (Maize): Harvested using combine harvesters that pick, husk, and shell the grain. Sweet Corn might be the exception. Soybeans: Harvested using combines to cut and thresh the plants. Wheat, Barley, and Oats: Harvested using combines to cut, thresh, and clean the grain. Cotton: Harvested mechanically using cotton pickers or strippers. Rice: Mechanically harvested with combines when the stalks are dry. Potatoes and Root Vegetables: Lifted from the ground using mechanical harvesters that separate soil from the produce. Lettuce, Spinach, and Celery: Mostly hand-harvested by crews, though automation is increasing. Berries (Strawberries, Blueberries): Primarily hand-picked for fresh market quality, though some are machine-harvested for processing. Tree Fruits (Apples, Cherries): Mostly hand-picked to prevent bruising, though some processing cherries use tree shakers. Wine Grapes: Frequently harvested by hand to ensure quality, especially for high-end wines. Peppers and Tomatoes: Processed tomatoes are machine-harvested, while fresh peppers are largely hand-picked.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: