Hacker Newsnew | past | comments | ask | show | jobs | submit | onraglanroad's commentslogin

...but occasional delight.

Yes, for local password authentication.

The code you linked to isn't the code for a wrong password. It's a check to make sure you're using a TTY. That code isn't to prevent brute force. The delay there is 10 seconds.

The 2 second delay is in support.c at https://github.com/pibara/pam_unix/blob/5727103caa9404f03ef0...

It only runs if "nodelay" is not set. But you might have another pam module setting its own delay. I have pam_faildelay.so set in /etc/pam.d/login

Change both the config files and you can remove the delay if you want.


> Yes, for local password authentication.

It's really really not. By default PAM has a difficult-to-disable 2ish second minimum delay for all authentication methods. However this is completely pointless for local password authentication because PAM checks password using unix_chkpwd, which has no delay. The comment I linked to is explaining that unix_chkpwd has a silly security theatre delay if you try to run it in a tty, but that's trivial to avoid.

If you want to brute force local password authentication you can just run unix_chkpwd as fast as you like. You don't need to involve PAM at all, so its 2 seconds delay achieves nothing.

It maybe does more for remote connections but I'm not sure about that either - if you want to check 10k ssh passwords per second what stops you making 10k separate connections every second? I don't think the 2 second delay helps there at all.

> Change both the config files and you can remove the delay if you want.

This is extremely complicated. See the comments in the issue for details.


No, it's very simple. Do what I said in my comment. Add nodelay to the options for pam_unix.so and set pam_faildelay.so delay=0

That's it. You didn't link to any issue and the weird mistakes and justifications you're making feels like arguing with an LLM.

You obviously can't run unix_chkpwd against a local account without root.


> You obviously can't run unix_chkpwd against a local account without root.

Wrong. At least check before you say something is obvious.

> No, it's very simple.

Even more wrong: https://github.com/linux-pam/linux-pam/issues/778#issuecomme...

> feels like arguing with an LLM

I could say the same about you, repeatedly and confidently asserting falsehoods.


No, I'm right. You can't run unix_chkpwd against a local account without root because you won't be able to access /etc/shadow to get the hash. If you think you can, explain how. Otherwise you have to use the setuid version which won't let you run it directly.

And I just removed the delay using my method. Perhaps try checking something yourself?


I don't understand how you can be so confidently wrong about something so easily checked. :D

> You can't run unix_chkpwd against a local account without root because you won't be able to access /etc/shadow to get the hash.

unix_chkpwd can access /etc/shadow because it is suid.

> Otherwise you have to use the setuid version which won't let you run it directly.

Haha you mean this?

  $ unix_chkpwd
  This binary is not designed for running in this way
  -- the system administrator has been informed
Take a look at the source code I linked about 6 comments ago!

> Perhaps try checking something yourself?

I have. You haven't.

  printf 'hunter2\0' | unix_chkpwd yourusername nullok; echo $?

I think that's more of an attempt to get a lack of a sense of humour classified as a psychiatric disorder.

Norway has roughly the population of the average US state. So I guess no-one really lives in the USA.


The crazier fact is that a hand full of cities alone in the US has a higher population than all of Norway.


most US states have a lower total population than LA county.


Let's put it more concretely: Norway has about the same amount of people as Alabama.


So nobody lives in Alabama


I understand that you're being intentionally difficult, and probably think it's quite clever, but clear to the rest of us that the original point was that Norway is an extreme outlier with their immense (oil) wealth, hydroelectricity generation and tiny population density.


People love to compare the US to an individual country, rather than a continent.

Compare a country to a state if you want to be honest.


0.1% of the population is pretty close to 0% to be fair.


The USA has 50 states.


> the existence of America's prescription drug markets drives the new innovative drugs that the rest of the world picks up for cheap.

That's the ludicrous propaganda that you've been fed but you really should be intelligent enough to dismiss it.

The world would get along just fine without you overpaying for your drugs. You pay for marketing costs.


Mostly not marketing (still large), but the R&D costs and clinical trial costs. The latter are in hundreds of millions to billions range for the entire journey from a promising discovery to an FDA-approved medicine.


Every time Ive looked into it marketing is more than half of the costs of US pharma companies - and I would suspect even more as don't know if there has much work to unmask even more of that spending via channels that can occur in ways not obviously marked as marketing or at least are really not core to research and manufacturing.

e.g. is all the "discount coupon" pharmacy rigamarole considered marketing or administration.


This is not correct. Here's Pfizer's 2025 annual report [1]. Total expenses for the year were $55.1 billion. Advertising expenses were $2.7 billion of that, or just under 5%. R&D expenses were $12.1 billion, or just under 22%. They do have a lot of SG&A, but the large majority of that is not going to marketing.

[1] https://d18rn0p25nwr6d.cloudfront.net/CIK-0000078003/908eb6a...


Advertising is only a subset of marketing. From that doc, look at operating costs: SGA was ~$11B and R&D ~$12B - basically 50/50. Pfizer is very international, so is pretty difficult to break out US operating costs and what marketing vs R&D is for just the US. But one can also assume US marketing is higher than any other nation as direct-to-consumer advertising is primarily only allowed in the US.


No. Marketing is an issue but it's not the main driver.

Everybody else uses price controls to keep prices "reasonable"--the drug companies tolerate this so long as selling to the country exceeds their marginal cost of production. They count on the US market to recoup the $1B R&D costs.

Simply mandate that a drug company can't charge more in the US than they do in any other first world country. Major earthquake in drug costs.

The "discount card" bit is basically a reduction in revenue, it's neither marketing nor administration.


Right, but the idea that Americans specifically should pay higher prices is beyond propaganda. It's Stockholm Syndrome-level delusion. Big Pharm has thrived for generations on our research universities (for the time being anyway) and had a front row seat to expanding foreign markets under US-led globalization. In return, we get the world's most expensive healthcare system and the privilege of paying too much for meds because our leaders won't cut a deal. All they have to lose is the "hundreds of millions to billions range" in annual lobbying expenditures by Big Pharma.

In a sane world - or literally any other country - that $300-$500 million in annual lobbying would be the literal difference that makes medicine accessible for those who need it. Instead, it goes to expensive lunches.


Why not just research it outside of the US if the problem is the FDA cost


You still need the same FDA approval and process to sell it in the US


Cost cut them. You think the administration won't take a bribe at that point?


Because the problem isn't the FDA cost

The problem is proving your drugs work

It's very hard and expensive to do


Agreed. I mean, where did the COVID mRNA vaccine come from? Which company makes the GLP-1 inhibitors like Ozempic and Mounjaro? Are these American companies?


Mounjaro and the next generation of soon-to-be best in class GLP-1 (Retatrutide) are Ely Lilly based out of the US.

Novo makes Ozempic, and is out of Denmark.

The mRNA stuff is a bit more murky, depends on how you squint. Best assignment there would be a split between the US and Germany I suppose?


You should take your own advice and widen your media sources.

Yes, you only get a continuous glucose monitor for free if you really need it on the NHS. If you want one otherwise you need to spend $100. It's not going to bankrupt you.


That’s the price for one monitor You need to buy a new monitor every 10-15 days. And your point about my media sources doesn’t make sense. As stated, I researched the coverage of continuous glucose monitoring because my friend got prescribed one.

The point isn’t that the UK NHS should cover CGM. I think they shouldn’t; it’s a waste of money unless you really need one. My point was about why the media pays so much attention to denials of coverage while you don’t hear about the over-coverage. You can’t go by the anecdotes. Talking about insurance covering unnecessary procedures doesn’t generate clicks.


Because he made it our business by deliberately making it public.


The UK doesn't have a constitution.


Germany does, and that's what verfassungsfeindlich refers to. Germany also uses Palantir.


The UK doesn’t have a written constitution, it does have one though. https://en.wikipedia.org/wiki/Constitution_of_the_United_Kin...


Right but if you read that page you quickly come to the quote "Parliament can make or unmake any law". Technically there is judicial review now, so there is some restrictions, but not like in a USA style constitution.


Same is true in the US though? Surely that’s what all those amendments are


That provides an easy solution: complain to your MP. At length. And then ask if the planning officer happens to be a relative, as though it has just occurred to you.

And then you might consider talking to the local paper to see if it would make a story. Also the crapper tabloids might even pay for the story.


More modern hard disks included the drive mechanism in one unit.

They used to be separate, so you would mount the hard disk on the drive to make it accessible.


Yeah, we used to have a couple of the removable phoenix platters knocking around.

Of course now everything tends to be solid state even terms like "drive" are becoming less common.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: