Hacker Newsnew | past | comments | ask | show | jobs | submit | 5ersi's commentslogin

It uses phase change (solid to liquid) to store heat at about 200 kJ/kg. Compare this to heating water in a boiler from 10c to 60c - stores 209 kJ/kg.

So we already have an effective way to store heat which can work for decades without servicing and is also cheap to produce (in terms of money and energy consumption).


I don't know why these aren't used more in building fabric. There's a youtuber who makes these phase change solutions out of various salt mixes aiming for the correct change temperature for a specific application. Eg he made panels for his shed roof (keeps it cooler in sun, warmer at night). Obviously this works better to smooth out large, reliable daily temperature swings, and offers little to someone in a constantly hot or constantly cold place.

I live in Ireland where night/day temperature swings are small. To cool my attic on a hot summer day I'd need to move that heat into a large water tank that gets used for laundry, cleaning, showers etc and is refilled from cold mains water. But fitting an air to water heat exchanger inside my attic would be a big expense and I would have to make sure I didn't freeze the attic.

Regular air to water heat pump could be hooked into my existing tank I suppose?


The name of the YT channel is NightHawkInLight[0] btw. Absolutely worth checking out. He creates materials with extremely useful properties from household materials (eg. PCM (high heat capacity), highly reflective paintings, Aerocrete (high insulation/fire resistance), ...)

[0]: https://youtube.com/@Nighthawkinlight


What about heat per unit of volume? Seems like the selling point is that a pretty small box can service a whole bathroom. Presumably it has a higher density than water and requires less insulation?

I think this is the most crucial part. External heat pumps are OK - people install air conditioners everywhere already - but most houses/apartments aren't set up for large water tanks. The interior heat storage needs to be comparable in size to the existing gas boiler.

There are also existing commercially-available residential units (e.g. Ecombi or Steffes) using ceramic bricks that are in the ~450 kJ/kg range.

Note for the confused: Ecombi achieves this by heating the bricks to dramatically higher temperatures using conventional resistive heating elements, thereby storing more energy, even though the specific heat capacity of any ceramic material is dramatically inferior to that of water.

But, as a result, Ecombi has a much lower system efficiency than a heat pump, since it's essentially just a space heater pointed at a rock. It only makes sense for jurisdictions with time-of-day variable pricing of electricity, and trades off simplicity and low initial purchase price for lifetime cost.


Thanks for the notes! I've seen them at other people's homes, but that's about the extent of my knowledge about them. (And I quickly googled a spec sheet to calculate a kJ/kg value.)

I suppose that efficiency whammy is worth it if you can use it to smooth out the duck curve. If power rates go negative then you'd be a fool not to run a space heater pointing at a rock!

Does heating water in a boiler work well with a heat pump? How about a release of energy 10 hours later (peak solar at noon, to first shower the next morning)?

I actually don't know the answer. I'm just thinking that there must be more to it, if the answer was as simple as "just heat water".


It does. However, the hotter the water becomes, the less effective the heatpump becomes. With anything beyond 60C becoming very inefficient.

With hot water tanks, they are unfortunately pretty badly insulated as well, with some of them loosing heat very quickly. Depending on how you plan on using that water, you also have to make sure the temperature never dips below ~60C to avoid legionella from spreading.

I actually think that heating your home slighly higher than you‘d usually do is the simplest and most effective approach, assuming it is properly insulated. Just rise the target temp for 1-2C when the energy is cheap and reset it once it isn‘t. Probably not as efficient, but extremely simple to implement.


The legionella thing is a little overblown fwiw. 50 degrees is perfectly adequate, and you can go lower with very little risk if you set it to briefly bump up to 60 every week or two. Even that is not hugely necessary in a domestic setting.

https://www.heatgeek.com/articles/legionella-and-water-tempe...


I have two heat pump water tanks, one Rheem and one AO Smith (our local utility heavily-subsidizes these, with a net-cost less than a standard tank water heater).

They both are rated for annual kWH usage less than the US EPA yellow label can display (for their category of tanked water heaters, i.e. competing mostly with resistive heating models).

Annually water heating is about 3% of my energy consumption.


Do you prefer one to the other? I’m in the market

The AO Smith (retail $1678) cost $250, after rebates (available to all SFH in any of TVA's power sellers, typically between Thanksgiving and NYE). With rebates the Rheem was $1000 (and is two years older).

Without rebates, they're similarly priced.

As far as reliability, they both have decent warranties and backup heating elements. Both heat water without internet connectivity. Similar performances (as far as heat output).

Overall, I feel the AO Smith is more customer friendly. Definitely easier to install:

1) AO has both top and side water connections; Rhm has one top and then one side connection (why?!)

2) AO's venting connections are far superior to Rheem's (which require custom/expensive adapters if installed in spaces <700sqft) — AO just has two standard 8" duct connectors on top... so much easier/cheaper to install into a closet. Rhm's top slit needs a $120 plastic adapter, and then ejects to the side (of a 24"D cylinder) [again: why?].

3) Rheem will not stay in ELECTRIC-HEAT (only) mode, for longer than two days — it automatically reverts to the prior heat pump option (which is annoying; you can use the app and set up a schedule to "force" electric mode... but then you have to use an app). AO stays in whichever mode you select.

4) AO is just nicer presentation. Despite a few obviously less-expensive components and design decisions... the AO is better thought-out. Just as an example, the Rheem has a threaded 3/4" socket for condensate, while the AO has a pre-installed (cheaper, too) drip tube.

5) The AO's electric vault is on the side (and not top) so a top leak is less likely to fill the conductors // corrosion. This is a better decision.

6) Rheem will likely last longer, despite being two years older. We'll see.

Either one will save you a lot of electricity + bonus dehumidification (while operating). I bought whichever was cheapest, the first time; now I would buy the AO even if ~$250 more expensive because the install is that much easier. This last rebate period I bought three =P


> Does heating water in a boiler work well with a heat pump?

Sure, heat pump hot water tanks are a thing. Air-to-water heat pumps are less efficient than air-to-air as they need to reach higher target temperatures, but it will be more efficient that straight resistive heating by a factor of 2 at low input temperatures, and 3+-ish at high summer temps.

The primary concern would be the quality of the tank’s insulation. I would hope HPHWTs are good on that but if you’re looking into that you probably want to double check the heat loss of the tank.


one difference is that a phase change stores energy at constant temperature, which may be desirable given that heat pump efficiency is inversely proportional to temperature output temperature

I feel stagnant water would be more annoying for maintenance than something like salt hydrates.

Launching alone consumes about 75-150kWh per tonne of energy for fuels only (as per ChatGPT).

Planned lifespan of Starlink satellites is 5years.


This AI 8GB HAT is $150, while better performing Pi5 8GB is $100. Makes no sense to buy the AI HAT.


Java?

Is supported on more platforms, has more developers, more jobs, more OSS projects, is more widely used (Tiobe 2024). Performance was historically better, but c# caught up.


Reified generics, value types, LINQ are just a few things that you would miss when going to Java. Also Java and .NET are both big, that's not a real argument here. Not that I would trust Tiobe index too much, but as of 2025 September C# is right behind Java at 5th place.


My experience was that .NET programs were typically more tunable for greater perf than Java for many years now even if it didn't come free out of the box which generally is what matters with performance. The ability to optimise further what needs to be optimised means that generally you are faster for your business domain than the alternative - with Java code it generally is harder and/or less ergonomic to do this.

For example just having value types and reified generics as a combination meant you could write generic code against value types which usually meant for hot algorithmic loops or certain data structures a big win w.r.t memory and CPU consumption. For example for a collection type critical to an app I wrote many years ago the use of value types would almost half the memory footprint compared to the best Java one I could find, and was somewhat faster with less cache misses. The Java alternative wasn't an amateur one either but they couldn't get the perf out of it even with significant effort.

It also last time I checked doesn't have a value decimal type for financial math which IMO can be a significant performance loss for financial/money based systems. Anything with math, and lots of processing/data structures for example I would find .NET significantly faster after doing the optimisation work. If I had to choose the 2 targets these days I would find .NET in general an easier target w.r.t performance. Of course perf isn't everything depending on the domain.


LLMs are learning in a very similar way humans are learning. So if humans can read a text (or view a video), learn from it and then use the knowledge to produce something, so can LLMs?

Copyright laws have quite strict rules on what constitutes a copy, and this was tested in courts many times. This rules also apply to works produced by LLMs.


That's a load of hogwash. Humans are only allowed to learn from books they buy or loan from libraries. We can't download books en masse from the interwebz just because we want to learn something. We're also not allowed to read stuff on websites and then regurgitate it verbatim pretending we made it. We can't even make songs that are vaguely similar to songs thag other people have made, even if they've been dead for a good while.


Okay, but in that case humans should legally be able to pirate all the books, music and movies they can or are learning from.



You must be using a dynamic language with a heavy framework? Rails maybe?

I code in Go mainly (also Java and Rust) and never experienced what you describe: simple addition of a field to a struct does nothing if not used in code. And the use is simply checked by compiler.

However, I did work alongside a Rails team which had major gripes with this. They called it brittle tests: whenever they made a simple change (like adding a field), half of their tests would fail. This really lowered devs' confidence in their codebase and slowed the changes to a halt.


Fractional reserve banking is exactly how this works, albeit banks do not "invest" the customers' money, instead they lend it.


What is a loan but an investment? What is government debt? What are mortgage backed securities?

The investments that banks can make are restricted, but it is not inaccurate to call them investments.


So if a store is trying to sell products, and you try to steal them, you are both cheating?


If I come to your house, destroy your door, steal your mom's dinner for 4 ppl, are we both cheating?

How about we compare with something actually worth comparing for? For example switching channels when there's the ad break, or turning the sound off, etc.

When I download something, I'm not "stealing it". When I block an ad, I'm not stealing either. I didn't remove 10$ from Google's bank account that was there before.


If you don't pay your electric bills you never removed money from where it was before. Does it now applies?


I signed a contract with my local power company, which I would be breaking if I did not pay them. I signed no such contract with Internet Historian.

That said, I appreciate it when content creators provide alternative ways to support them. I support dozens of creators with monthly donations and I occasionally buy merchandise when they're selling something I'm interested in. Just don't waste my time with ads.


Ah the old "physical objects work the same as digital copies" argument. Yes I would download a car. You can still drive yours. I was trying to pay you for use of the car but you insisted I drive around your deadbeat family and pay for the drive through that I don't eat.


This a a very different situation. Stores are selling products or services, and they explicitly put prices on the products.

Content available freely online is much different, as there is no price and at best the hope is that the consumer sees an ad or sponsorship and that the content creator has accurate analytics as to how many saw the ads.

Your analogy would be more akin to someone stealing access to paywalled content somehow. In that case a price was put on the content and someone took if anyway, much like shoplifting.


Video streaming sites have a cost to create.

The price is ads or paying for a paid service like YouTube premium.

So you're still stealing, you just convince yourself it's ok, and that's fine.


If you go to the store on summer to enjoy the aircon, but you dont buy anything, because you just go there with a book and read your book and leave.

Are you stealing?

The aircon have a cost. Cold fresh air cost electricity that costs money.

The price is to buy stuff from the shopping centre, that gives money to the stores that pay a rent price for the local that pays for the aircon bill.


Stealing, ie theft, requires that you deprive another person of the benefit of their property.

This is precisely why we cannot compare copying to stealing.


I'm not saying that ad blocking isn't stealing, there could be a case for that especially if T&Cs specifically require that ads aren't skipped, blocked, or avoided.

My only point there was that shoplifting and ad blocking are very different things. Stores don't make their products freely available to anyone willing to walk past enough ads along the way.


the store is donating me products with an ad flyer


What is being stolen in the case of a Youtube stream without an ad?


If you are concerned by this proposals, then you should check out current CAs trusted by your browser - all those CAs can issue rogue certificates trusted by your browser, that can be used in MITM attack.

For example, CAs present in Firefox, that might give you pause: Beijing Certificate Authority, China Financial CA, Guang Dong CA

The CA system in browsers is inherently broken and it allows state actors to MITM you and see all your traffic if they: 1. have ability to capture IP traffic (requires cooperation with ISP) 2. have ability to generate rogue certificate via cooperation with CA


Yes, but:

1. Major browsers (Chrome, Safari, Edge) only accept certificates which are published in Certificate Transparency logs.

2. If a CA is discovered to have issued MitM certificates, they are swiftly distrusted by browsers.

So it's not really viable to use the existing CA system for MitM attacks.

The eIDAS proposal would:

1. Prevent browsers from distrusting CAs which are used in MitM attacks.

2. Ban mandatory checks (such as Certificate Transparency) on certificates unless the EU agrees to them.

That creates a system that is very viable for government MitM attacks.


> 2. If a CA is discovered to have issued MitM certificates, they are swiftly distrusted by browsers.

Thats reassuring but, not knowing much about this, I have a couple of questions:

1. Is this proactively monitored for? And how? And by whom?

2. If a major state-level CA was discovered to have issued a mitm cert, would browser vendors really take the commercial hit of removing or distrusting their root cert?


> 1. Is this proactively monitored for? And how? And by whom?

Yes, security researchers like myself are constantly looking in CT logs for suspicious certificates, and I've found many, most notably Symantec issuing certs for example.com (https://groups.google.com/g/mozilla.dev.security.policy/c/fy...) and Certinomis issuing for test.com (https://bugzilla.mozilla.org/show_bug.cgi?id=1496088). Both CAs were eventually distrusted. (But Certinomis will be back once eIDAS is adopted!)

Domain owners can use Certificate Transparency Monitors to learn about suspicious certificates for their own domains. Here are some monitors:

https://crt.sh/ - allows you to search for certificates for a domain

https://github.com/SSLMate/certspotter/ - open source tool which notifies you when a certificate is issued for one of your domains

https://sslmate.com/certspotter/ - commercial service that does the same, operated by my company

> 2. If a major state-level CA was discovered to have issued a mitm cert, would browser vendors really take the commercial hit of removing or distrusting their root cert?

In 2017, Chrome and Firefox distrusted Symantec, which was at the time the world's largest certificate authority: https://security.googleblog.com/2017/09/chromes-plan-to-dist...

Symantec hadn't even issued MitM certs - they were just grossly incompetent. Distrusting them was very painful, but necessary to uphold the integrity of the CA system, and demonstrated conclusively that there is no such thing as a too-big-to-fail CA.


It looks like the Symantec distrusting was done with the cooperation of Symantec, which agreed to wind things down and transfer clients to a new provider in an orderly fashion?


Can you help me intuit what a suspicious certificate might look like in practice?


If you're a domain owner monitoring your own domains, a certificate is suspicious if it was not issued by one of the CAs that you use (e.g. you use Let's Encrypt, but you see a certificate for your domain in CT that was issued by Certinomis). If you keep an inventory of all of your certificates, then you can also cross-reference certificates from CT against your inventory, and flag any certificate that isn't in your inventory.

If you're a security researcher monitoring other people's domains, you have to rely on heuristics - e.g. if a domain has a long history of getting certs from a major US CA, and then suddenly a tiny European CA issues them a certificate, that's pretty suspicious. When I found the example.com certificate misissued by Symantec, I though it was suspicious because it was also valid for subdomains like products.example.com and support.example.com, which don't make sense for a domain that's reserved for documentation purposes. ICANN operates example.com, so I emailed their security team to confirm that they did not authorize the certificate.

The system works best if domain owners are monitoring their own domains, because only they know for sure if a certificate is authorized or not.


That makes sense, thank you.

Follow-up question: presumably, a state actor with dominion or leverage over a CA can coerce said CA into issuing a certificate, right?


Yes, though eventually the state actor would run out of CAs to coerce as all the CAs in their country get distrusted.

The threat of distrust means CAs have a very strong incentive to contest any government orders, since if they comply their business is destroyed.


In some very prominent countries there are laws with extreme consequences which not only prevent companies from contesting and not complying, but even prevent them ever disclosing such requests.


True, but then they will be found out and distrusted. So basically they'll lose business because of the government of the country they are established in.


That tracks. Thanks for helping me get a bead on this!


That's your smoking gun? CAs that issued certificates for example.com and test.com? You genuinely believe that the only possibility here is a vast conspiracy to defraud and steal?


> You genuinely believe that the only possibility here is a vast conspiracy to defraud and steal?

Care to point out where I said that?

example.com and test.com are real domains, and their owners did not authorize those certificates to be issued, so issuing them was a serious breach of the trust which CAs are expected to uphold. Furthermore, the discovery of these certificates led to investigations which turned up additional issues which are documented in detail here:

https://wiki.mozilla.org/CA/Symantec_Issues

https://wiki.mozilla.org/CA/Certinomis_Issues


> 2. If a major state-level CA was discovered to have issued a mitm cert, would browser vendors really take the commercial hit of removing or distrusting their root cert?

Pretty much every browser distrusted the root certificate from Spain's FNMT-RCM for a decade, so I think the answer's yes.


You can find more about certificate monitoring and who are involved here

https://certificate.transparency.dev/


It's not like Beijing CA can issue a rogue certifcate and suddenly a malicious actor would be able to decrypt all your internet traffic. You would have to connect to a service that uses those certificates in the first place.

An interesting experiment would be to log all certificates used by the sites you normally use, say for a month, and then look at the list for anything shady. I have no ideia if an extension exists that would allow such and experiment, but the resulting list would be much more useful.


No, that's not needed at all. If the malicious actor can man-in-the-middle traffic to victimsite.com (say using a BGP hijack), they can serve HTTPS traffic to the end user from their MITM server, secured with a certificate issued to "victimsite.com" that is issued by their own CA, and the MITM can then in turn communicate to the real victimsite.com using HTTPS secured by the real site's certificate, signed by its own CA.

Now, there are CAA DNS records, which serve the purpose of restricting the CAs that can sign a particular domain, which would of course be ignored by the malicious actor, but _could_ be checked by the end user's browser. But to the best of my knowledge, no browser does that.


This will get noticed in a matter of seconds.

But if your own government tells your own isp to reroute just your traffic over some MITM proxy, it's only you there to notice, and most probably, you won't.


In an ideal world, yes, they would by shut down in seconds. Yet BGP hijacks still occur in the real world; here's one from last month: https://slowmist.medium.com/analysis-of-balancer-bgp-hijacki...

And you're certainly right about government-mandated traffic hijacking.


You are correct that no browser is looking at CAA records, because it would be wrong to do so. CAA records don't retroactively revoke certificates that have already been issued. Their only purpose is for CAs to check them before issuing a certificate.


In the case of mainland China, it’s easy for the Party 1) issue a malicious certificate and 2) redirect your Internet traffic to MITM box. They do 2) for all the time when blackholing Internet traffic.

With certificate logs there is a chance, I don’t know how high, to catch 1).


> For example, CAs present in Firefox, that might give you pause: Beijing Certificate Authority, China Financial CA, Guang Dong CA

For someone living in the West, what are the consequences of deleting or distrusting those CAs?


You lose nothing, gain nothing. It's hard for china to reroute your traffic, and even if they did, what can they do to you after that?

It's your own government that can actually do something bad to you.

(unless you're doing some really really nasty stuff, and china wants to eliminate you for those reasons, and is willing to create a large international incident because of that).


>and even if they did, what can they do to you after that?

An example of what China can do is they can have their workers put pressure on you. Often this pressure is soft, nothing as direct as 'do X or we hurt you with Y'. And often the request, at least at the start, is for something legal and only a bit unethical if even that. A little information to help win a contract, maybe a way to advertise to you why you should go with their vendor for a product, maybe just asking you if a specific coworker seems to have any interest in some odd topic or passing you a resume of someone who seems a good fit for the job. If they can they'll push for more with increasing levels of silver and lead, and if not, they use what they did get to pressure elsewhere.


Unless it's gotten better, it's super easy for China.. My traffic to EU World of Warcraft servers got hijacked all the time. I don't know if it was malicious or just incompetent Chinese ISPs, but you feel that extra latency when it goes through China.


But this wasn't a bgp redirect, this was blizzard doing something... if chinese telcos acted as if they were blizzard telcos, there would be bgp filters and a lot of outrage in a matter of minutes. This is not a small deal.


probably none

If you run into some websites which use them the browser will tell you that the certificate is invalid; you can always reinstall them if you prefer.


I think this is a matter of assumption. For communication through mainland China, one should assume that all internet traffic is actively surveilled with probably way easier methods than CAs. On the other hand, this assumption is definitely not as true in the EU, nor do I think the Chinese government forces Firefox to trust CAs by law (talking about irony)….


The browser/CA forum’s requirement to log all issuances into the CT log takes care of this; the EU mandate hardly has such requirements while still mandating the inclusion of root certs. The approach of the browser/CA forum vs EIDAS cannot be equated for this reason.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: