Hacker Newsnew | past | comments | ask | show | jobs | submit | eGQjxkKF6fif's commentslogin

Whats the outlook for Linux with that


this is on our radar, we should have a linux build in 2-3 days!

we have macOS and windows build as of now.


Cool. Waiting on that to try it out.


Whats the roadmap looking like for Linux?

I don't have Mac or Windows.


this is on our radar, we plan to have it ready by early next week!

still a team of 2 people, so bunch things on our plate.


Check the client debug logs mine has the verification for the enclaves in it although I'm on an intel i3 but that makes sense for Intel's remote attestation that its verifying the enclave's unique hash and showing the MRENCLAVE hexes of the expected result.


But without the source being available you still need to trust vp.net to be providing the correct hash to compare to, right?


Intel's remote attestation verifies that, with the hash you can use Intel's remote API which is what the client is doing, Intel gets the hash the server sends, verifies it using their encrypted key set and then tells the client that it's valid and verified. Not all processors have SGX capability to verify the hash. Intel provides tools to do the manual verification if you utilize SGX

https://www.intel.com/content/www/us/en/developer/tools/soft...

So you can verify locally and Intel's API also does the verification.

When an SGX Encalve is created, the private key to it goes within it, it can't be accessed. That's the security.

It's a good read if you look in to the tech on Intel's website.


It verifies that something is running in the enclave. Without the source you can't hash it yourself (don't need an SGX capable system for that, just the SDK) to verify that it's the actual code running.


it would be verifying that WireGuard (https://www.wireguard.com/repositories/) is within the enclave, yeah?


Have no idea since there isn't any code available for review. Technically what's running in SGX could just be what's enough for it to attest to it's existence [sidenote: how can I be sure this is even the SGX handling my connection and not just any SGX?]. I really like this idea but even if the code was available most users are still just trusting vp.net (won't be doing their own verification [and doing it everytime the hash has changed] but trusting vp.net's own claims in their own client, it's similar to the criticism of many E2EE messaging solutions, everything might be fine over the wire but I'm trusting their client not to collect or transmit anything before encryption or after decryption). If I could build my own client and lock it down to a hash of published SGX code then I'd be happier, or perhaps if an external party would handle the verification. Looking forward to explore this better when any code is made available.


Trying it out, so far so good. Worked on my mangled Linux install.

I have and have been using Proton VPN which the free version. If you use it for bittorrent, even to download a Linux ISO which is what I did, will straight up DNS hijack you and feed you a web page instead of the web page you're looking at to scream at you that BitTorrent is only allowed if you're a paying subscriber.

So.. that means they can just access and re-route your traffic however they want and make you see whatever they want.

Fascinating use for SGX Enclave tech, I see in the client debug logs show API hits that do the verification. I'm on an intel i3 with gigabit connection and am pulling 800mbps up/down.


When VAC was originally introduced, CPUs only had 32bit architecture, not that 64bit hindered anything; but you could inject cheats in a near infinite amount of way, or have cheats read from memory directly, or have cheats do things especially through video drivers. Hell, glitching your nvidia drivers and setting things like Negative LOD Bias would allow you to see through textures in some cases (wall hacks)

It's been a cat and mouse game since the dawn of gaming and e-sports.

Fun fact: CS 1.6 competetive had what was called "Organner" when teams switched over from CAL to CEVO (first paid e-sports online league) and as well as ESEA which is acclaimed for its anti-cheats; the pro players you see/saw such as n0thing, summit-1g (not saying he did cheat, he wasn't pro in CS1.6, 1g was a pug team that meant 1st generation and a lot of us were in it) -- but everybody in the pro scene around that did cheat, or had cheaters on their team.

n0thing was banned from CAL rigorously for cheating in CAL-Premier and rejoined with complexity after ringing for other teams in CS1.6 matches (ban evading). he's admitted to cheating in CS 1.6, and found fame with Counter-Strike 1.6'd Evil Geniuses organization which encompanied the old compLexity roster.

These dickheads went on to make fortunes; not to say that they weren't good in their own respects, but people such as n0thing openly admit, and will admit if you ask them on the stream if they cheated in 1.6 to get to where they're at.

You could inject cheat codes through your mouse drivers at LANs and if you set a low FOV aimbot, it was undetectable: IE triggers when you aim at their chest, aims up to hit the head; and had advanced net code modifiers to land bullets in places you weren't aiming all together.

Knowing this, completely ruined the pro scene and wanting to watch these matches and personalities all together. To know how many legitimate players out there were passionate about these games, looking to go pro, and really enjoy competing at the highest levels couldn't because the skill gap was so significant, and then even more so because pro players had undetectable cheats.

Still to this day it is virtually impossible to detect hacks, however games such as DotA2 make it signifcantly harder to cheat by only sending frames/updates when it should; rather than old games sending all player data. I believe Valorant has a decent system but all in all; I helped run the leagues and the level and problem at which cheating was occurring, was known about, and not being able to prove what you know, would make you SICK if you ever enjoyed competing in e-sports.


Yet another reason why fighting games are the superior competitive scene. The only "cheat" you could realistically see at an offline event is macros, and the chances of a macro increasing your win rate are slim to none. And there are so, so many good offline events. Online there are more potential ways to cheat, but nobody really cares. Just blacklist the player and move on.


Reminded of the Super Pichu story where someone modded his ISO of Melee to increase Pichu's stats during a Melee tournament.


Fucking agreed. But if you check out street fighter on youtube with 'Street Fighter mike ross tool assisted' https://www.youtube.com/watch?v=pWS3Kq5p77k

You can inject cheats directly in to the Xbox's back then directly through the fight sticks

You'd know though if somebody was cheating so not sure how crazy the SF scene had cheats but check out tool assisted; when I originally saw it I just put my head down


Yea but boring or too complex, just not fun to watch. There is a reason CS and DoTA/LoL is waaaaay bigger :)


You cannot tell me fgs are "too complex" and then mention DOTA in the same breath.

I personally prefer watching a game that doesn't have downtime. Watching teams buy items and walk around is not interesting. So, so much downtime in all these big team games.


Smash is a great spectator esport but... Nintendo hates the scene.


Csgo added it a few years ago as well. Works in fps games with simple maps.


It would show on people's accounts though and in in Counter-Strike scrims and matches if somebody had a VAC ban on their record/profile you just kicked them if you could and found a new team to play.

So while engine specific, people still judged you, especially in pubs (public servers)

Been a _long_ time since I've played. Fucking cheaters.


Simple. The execs steal all the innovative IP, start new ventures, drain HP dry with its encredible decision making; completely fuck the Linux devs, use their works and contributions to OSS in the new ventures and then new waves of innovation/competition came about and what was settled upon was whatever looked profitable on quarterlies so servers, and printers.

I'm not saying that's what happened. But, it's a capitalistic type world.



Same. Replacing elements in with DOM in webdev is surprisingly fun with websockets too.

Having to know and learn 300 clunky frameworks, 97 different syntaxes it gets old.

HTML. CSS. Javascript.

Ask the AI to give me a markdown to html converter, good2go


> Ask the AI to give me a markdown to html converter, good2go

Why would you do that? There are dozens of libraries which do exactly that. Instead of AI you can ask npm or pip, heck you can even ask CRAN[1].

1: https://cran.r-project.org/web/packages/markdown/index.html


Exactly. It tells me the same things. It'll often give me the require() for javascript on packages I should use.


Personally, I don’t see the point. Searching for markdown libraries is not hard, a good library (the same that will show up first) will show you usage instructions at the top. You can copy-paste those and be done.

Also modern JavaScript uses import, require() is very 2015. If the AI is recommending you use require() I would suggest a better one.


Looking at all of these arguments and viewpoints really is something to witness.

Congratulations Cloudflare, and thank you for showing that a pioneer, and leader in the internet security space can use the new methods of 'vibe coding' to build something that connects people in amazing ways, and that you can use these prompts, code, etc to help teach others to seek further in their exploration of programming developments.

Vibe programming has allowed me to break through depression and edit and code the way I know how to do; it is a helpful and very meaningful to me. I hope that, it can be meaningful for others.

I envision the current generation and future generations of people to utilize these things; but we need to accept, that this way of engineering, developing things, creation, is paving a new way for peoples.

Not a single comment in here is about people traumatized, broken, depressed, or have a legitimate reason for vibe coding.

These things assist us, as human beings; we need to be mindful that it isn't always about us. How can we utilize these things to to the betterment of the things we are passionate about? I humbly look forward to seeing how projects in the open source space can showcase not only developmental talent, but the ability to reason and use logic and project building thoughtfulness to use these tools to build.

Good job, Cloudflare.


It literally says in the post it’s not “vibe coded”. That has a very specific meaning of not reviewing the code at all and accepting everything.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: