Unlurker|Replay|About
HBO Obtains DMCA Subpoena to Unmask 'Euphoria' Spoiler Account on X (torrentfreak.com)
•
If it's not actual video material but just talk about what happens in the next episode before it's released, does that really fall under copyright? I can see it being an NDA breach or something but otherwise not
•
The issued subpoena requires X to share information sufficient to identify the person behind the account. This includes names, addresses, telephone numbers, email addresses, account numbers, IP addresses, and any other contact or billing records held by the platform. Taking TF's reporting at face value, would twitter be able to sufficiently identify a user? Does Twitter have the address, real names, etc. of its users?
•
Twitter has IP addresses at the very least. HBO will then subpoena the account's ISP. If the account had the checkmark pro plan or whatever it's called, it may have or be able to obtain legal name and address for payment details, or its payment processor (Stripe I think) would.
•
I have never used X/Twitter so I don't know how it works, but don't you have to seek out an account in order to read it? X won't just throw a spoiler at you unsolicited, right?
•
TFA mentions what the actual issue is (it's not simply spoiling people)
•
This is what TFA seems to say: > Unlike the DMCA notice, where WBD used “video” to describe the content, the declaration to the court by Michael Bentkover classifies the infringing content as “summaries of unpublished, character, setting, and plots of a forthcoming series”. Isn't that simply about spoiling people, or what's the "crime" here? The article also says "Copyright generally protects the expression of a work, not the underlying ideas or plot descriptions", so I'm still unsure what the actual issue is, besides the misuse of DMCA.
•
It really didn't. Unlike the DMCA notice, where WBD used “video” to describe the content, the declaration to the court by Michael Bentkover classifies the infringing content as “summaries of unpublished, character, setting, and plots of a forthcoming series”. This distinction may matter, as a summary of a plot may not enjoy the same protection as a leaked video. Copyright generally protects the expression of a work, not the underlying ideas or plot descriptions. I interpret that as they just didn't like that someone posted the summary, and they are trying to use the DMCA to do a job that wasn't intended by the law's creators.
•
I think they algorithmically show you content designed to provoke engagement
•
No there is a feed, if you follow a topic such as a show you probably will get exposed to it.
A compelling title that is cryptic enough to get you to take action on it (ericwbailey.website)
•
Hacker News Parody Thread (2013) http://bradconte.com/files/misc/HackerNewsParodyThread/ Discussion (589 points, 189 comments): https://news.ycombinator.com/item?id=5326511
•
Reminds me of Schizopolis movie (by Steven Soderbergh): >Fletcher Munson: [sunnily, on homecoming] Generic greeting! >Mrs. Munson: [warmly] Generic greeting returned! >[they kiss and chuckle at each other] >Fletcher Munson: Imminent sustenance. >Mrs. Munson: Overly dramatic statement regarding upcoming meal. >Fletcher Munson: Oooh! False reaction indicating hunger and excitement! https://www.imdb.com/title/tt0117561/quotes/
•
An obvious attempt to insert a link into my own vibe-coded project, in the pretense it is either relevant or related.
•
An opinion about the design of the website.
•
An expression of surprise and appreciation that the author, an expert in his field, is actually a HN participant.
•
A niche reference almost no one gets, except one.
•
Feels similar with cold email.I used to think it was mostly about better copy or subject lines, but lately it feels like timing matters way more. Same message, different moment, completely different outcome. Have you seen cases where timing mattered more than the message itself?
•
A comment not about the article, but rather about the perceived quality of the HN comments.
•
Anyone struggle with the large font size? I can only consume about 2 lines, maybe three lines at that size before I struggle with tracking. The article itself was in fact delightful once I zoomed out a bunch.
A comment based on the reading of the title that could only be conceived if the commenter didn't bother to click the article at all.
•
A snide and vitriolic remark that observes on how the first paragraph actually addresses the concern of the person which hasn't read the article. A further continuation on this being representative of the state of modern online discourse.
A comment complaining this was obviously written by an AI, and the standard template is a tell. A philosophical observation about what that says about the state on online discourse. Link to the Dead Internet Wikipedia page.
•
A response appreciating the comment above for saving ones time.
A comment at Hacker News which provides a nuanced critique and which gains plenty of upvotes as a lot of users agree to the comment's sentiment.
•
A comment disagreeing with the central argument, presenting factual evidence for why it’s mistaken. Downvoted for an hour before balancing back out to a score of 2.
Peers vote to ban pornography depicting sex acts between stepfamily members (theguardian.com)
•
WHAT are you doing, step-peers?!
Ok I'm just gonna straight up ask: do people actually like "oh no stepbrother" porn? What's with the huge proliferation of it? I only watch it because it seems like 80% of the well shot, quality porn is step family shit, and I'm wondering if I'm participating in some kind of bizarre feedback loop where step family porn happened to be a category that started getting higher quality production value, which got more views, which led to studios erroneously believing people were watching because they have a step family fetish. I just try to ignore that aspect.
•
I typically watch porn with the audio turned off, because all of the dialog is just so bad in one way or another. I'm not there for the dialogue, and I don't care about the fake set-up before the actual porn starts happening.
Some ministers had opposed the amendment and suggested the new ban would have been difficult to implement because, under the law in England and Wales, it is not illegal for adults who are step-related to engage in a sexual relationship. This is amusing to me. Legal to do, but not legal to film.
•
> This is amusing to me. Legal to do, but not legal to film. I don't know if it's amusing but the comparison is incorrect. Doing it in public is not legal. These laws are about the public part not about the doing part. Carlin's quote in this thread suffers from the same problem, he was eager to say something amusing, instead of correct, and did it prematurely.
In the infamous words of George Carlin: "Selling is legal, and fucking is legal; but selling fucking is not legal."
•
Moving your finger is legal, holding and aiming a gun is legal, pulling your finger to fire a gun is sometimes not legal. Framing the gun debate as a restriction on finger movement would also not be productive.
> "Selling is legal, and fucking is legal; but selling fucking is not legal." I don't get it. The literal interpretation is a clear joke, as you say. So what's the point that it is making? To be clear, I think the law discussed is stupid. I also think the argument that if both parts are legal they should also be legal together is wrong. What am I avoiding?
•
I'm referring to the two other jokes you quoted.
Fair point, but I have been very suppressed how many normie friends have gotten a VPN since our state mandated age checks for adult content.
•
What you're pointing out is true insight. It's not just anecdotes, it's lived experience. Not nuanced solutions. Not tradeoffs. But normies friends as the real litmus test of effectiveness. You don't _need_ to look further, you have all the evidence you already require.
Industrial design files for Keychron keyboards and mice (github.com/Keychron)
•
I love the design for the ergonomic mouse. Are there any plans for split keyboard or something Corne style?
Not a lawyer, but as I understand it the license is a matter of copyright, and the copyright only applies to the design files. So as long as you're making that keyboard for yourself then you should be good to do anything you want with the keyboard, because it is no longer using the license at that point. Now, what is interesting is if someone were to blatantly violate the license and start manufacturing commercial keyboards. I believe their only recourse would be to revoke their license of the design files, and then it would be copyright infringement. The thing is, I don't know how copyright law would handle any damages. I don't know if making a physical product could be a violation of copyright, regardless of if you had a license to use the design in the first place. I could definitely imagine a company trying to enforce this, and a judge throwing it out because it should have been handled with patents. Again, not a lawyer, just speculating on a forum.
•
> Not a lawyer, but as I understand it the license is a matter of copyright, and the copyright only applies to the design files. So as long as you're making that keyboard for yourself then you should be good to do anything you want with the keyboard, because it is no longer using the license at that point. What if I take the design, print it, include the thing in a staged photo, and sell prints of the photo? What if I skip the printing and use the design files as a basis for a rendered photo or animation? What if I print the design, then use a 3D scanner to recreate a file from the physical artifact?
Hasn’t Creative Commons disavowed or at least really downplayed the NC license for exactly these reasons? There are so many ambiguities and headaches involved that the only advice I’ve ever seen is not to use it.
•
I'd love to see more info on this
I'd consider another Keychron (my first mechanical since a couple of AT and PS/2 Model M and variant devices I had years and years ago) and I like some stuff about it and definitely like the price, but would look for a model with a few differences next time and probably skip Keychron if I couldn't get all of these fixed in one of their boards: 1 - Longer battery life (I have a bluetooth + plug-in model). The battery life is crazy-low, even when not in use and the lights are turned off. I keep it plugged in all the time, as a result. I don't really get why it can't last, idle, about as long as a game controller does (many weeks! And those don't have much space for batteries). 2 - No light pattern button. That thing exists only to accidentally hit and switch it away from "gently and evenly lit" which is one of the very-few non-insane patterns available. Brush it by accident, there goes a minute or so of your time getting it back to something that's not trying to look like a disco ball. And it's right on the corner, so you will hit it by accident when moving the keyboard around or reaching for something just past it. Easily my least-favorite thing about the board, despite how bad the next item is. 3 - Mine has a kind of tray-design around the edge, resulting in about a 1/8" lip, that looks very cheap to assemble (so that's nice, lower price) but means it collects EVERYTHING out of the air and is a pain in the ass to clean. It also makes it look kinda like someone's 3D printed hobby project. Like it's an ugly keyboard, both because of the design and because it's visibly collecting dust and hair just a few days after its last keys-removed full cleaning.
•
You can remap/disable all light shortcuts using web app https://launcher.keychron.com/#/keymap
No it's design files. Like CAD stuff.
•
Pretty sure @jhogendorn was being tongue-in-cheek to call out (semi-related) questionable behavior from Keychron.
Launch HN: Twill.ai (YC S25) – Delegate to cloud agents, get back PRs (twill.ai)
•
I’ve been developing an open-source version of something similar[1] and used it quite extensively (well over 1k PRs)[2]. I’m definitely believer of the “prompt to PR model”. Very liberating to not have to think about managing the agent sessions. Seems that you have built a lot of useful tooling (e.g., session videos) around this core idea. Couple of learnings to share that I hope could be of use: 1) Execution sandboxing is just the start. For any enterprise usage you want fairly tight network egress control as well to limit chances of accidental leaks or malicious exfiltration if theres any risk of untrusted material getting into model context. Speaking as a decision maker at a tech company we do actually review stuff like this when evaluating tools. 2) Once you have proper network sandboxing, you could secure credentials much better: give agent only dummy surrogates and swap them to real creds on the way out. 3) Sandboxed agents with automatic provisioning of workspace from git can be used for more than just development tasks. In fact, it might be easier to find initial traction with a more constrained and thus predictable tasks. E.g., “ask my codebase” or “debug CI failures”. [1] https://airut.org [2] https://haulos.com/blog/building-agents-over-email/
•
> Run the same agent n times to increase success rate. Are there benchmarks out there that back this claim?
•
How does this compare to Claude Managed Agents?
•
Claude managed agents is a general-purpose hosted runtime for Claude. While Twill focuses on SWE tasks. And so the SWE workflow is pre-built (research, planning, verification, PR, proof of work). Twill is also agnostic to the agent, so you can use codex for instance. Additionally you have more flexibility on sandbox sizing on Twill
Why I'm Building a Database Engine in C# (nockawa.github.io)
•
That seems great, I have seen a few similar dbs written in java that say the same thing, that when written correctly you can get the perf very close to C, but at that point you are just writing C with a different syntax. You don't win on any in the security guarantees, so at that point can we just not build everything in wasm and then we can interface it from both dotnet and the jvm?
•
I would be less worried about the GC pause, than the need to reserve some memory for garbage collection. Any reduction in available memory is going to tend to mean a hit to performance.
I wonder why he didn't use AOT compiling if he's worried about JIT warmup.
•
It wasn't discussed, so we're left to speculate. If I had to guess, I imagine that the .NET JIT has actual benefits: the variety of architectures has gotten enormous and JIT is likely a performance win after warmup.
Bluesky April 2026 Outage Post-Mortem (pckt.blog)
•
I don't really understand this architecture, but I thought Bluesky was distributed like Mastodon? How can it have an outage?
•
Great write up... curious about the RCA. Thanks!
All support to other decentralizers but nothing never goes down.
•
1000x redundancy makes it vanishingly unlikely. Although I know we're due for a pole shift so all bets are off I suppose.
> What I had missed is that we deployed a new internal service last week that sent less than three GetPostRecord requests per second, but it did sometimes send batches of 15-20 thousand URIs at a time. Typically, we'd probably be doing between 1-50 post lookups per request. That’ll do it.
•
less than ideal if I had to be frank.
1D Chess (rowan441.github.io)
•
Very cool. Reminds me of 1D Pacman: https://abagames.itch.io/paku-paku
•
Don't know when was the last time I had so much fun with chess. Quite intuitive, clicked on the first click. Would enjoy so much if there were more of these, feels like an obligation-free chess puzzle.
I won after four attempts. Pretty sure it was perfect play so yes white has forced win
•
Yeah. I think 1. N4 leads to a white win. It's fairly easy to verify that a black rook move will lead to a white win (1...R5 2. R2 and 1...Rx4 2. Rx4 N5 3. Rx5#). So the critical line is 1. N4 N5, but then 2. Nx6+ K7 3. R4 also leads to a win: 3...Kx6 4. K2 K7 5. Rx5# and 3...N3+ 4. K2 N5 5. N8 Kx8 6. Rx5#. There are probably other ways to win too.
is that str.replace(g,t) ?
•
No. I am actually too highly regarded for measly single dimensional game
Maybe I'm not good enough at chess to understand the strategy here, but how would castling be useful in this 1-D game? Castling in a normal game protects your King and activates the Rook. In this 1-D game, your King starts out protected behind the Rook. If you castle and end up in a _ R K N position, your king is exposed and your Rook is trapped behind the King, useless, with no way to ever get it back out. The Rook seems essential for mate, and its power has been eliminated.
•
Exactly. Feels like R K N would be a more suitable initial position in which castling would swap the king into safety, provided it has not moved and is not in check... Though maybe in that case the best first move for both is to castle and we are non the wiser (back to the original starting position)
It's a stalemate because while the king can't move, he isn't under active attack. There is nowhere he can legally move, but he's safe where he's at.
•
That rule caught me up too. In regular chess if it is your opponents turn and their only piece is a king in the 1,8 square, and you have rooks in the 2,1 and 8,7 squares that counts as a victory does it not?
You can't trust macOS Privacy and Security settings (eclecticlight.co)
Is this a bug, security vulnerability, or just an oversight? It’s not clear to me. As a precaution would it be a good idea to run that reset command for all apps?
•
It’s Apple’s performative “security” (showing popups and asking the user for all sorts of permissions) overlapping with some pragmatic choices about how files and folders work. For me the gap is in Settings & Privacy - 1) it should be clear that the app has been given permission and 2) it should be harder to give permission once you’ve explicitly disabled it. 3) (nice to have) Apple should get rid of permissions that make you restart the app because it’s 2026 lol.
•
These are considered security UI bugs. They are a subcategory of security bugs, since they result in users lacking control or awareness over permissions. If this were a Chromium bug it would get a CVE.
There's another "security UI" issue in the latest macOS, that's been there for at least a few versions. I go into "Privacy & Security", "Full Disk Access". A bunch of apps added themselves in there (Anki, Fission, Microsoft Autoupdate, WhatsApp), the toggle is disabled and I've never enabled it. Ok, whatever. But when I go into "Files & Folders", and under those apps I see "Full Disk Access" in gray. Apps that have Full Disk Access toggled on look identical, with "Full Disk Access" in gray. What the hell am I supposed to make of that? Is it a bug? Do they have full disk access? Is the UI trying to imply that those apps are solely controlled by the FullDisk toggle and are ineligible to request granular permissions for Desktop/Documents? Or that they are eligible, but haven't requested it? Or maybe they did request it, and I granted it, but I don't get to see it? Who knows?
•
That is really poorly worded by Apple, because if I understand it correctly, the "Files & Folders" list is just a list of apps that have requested Full Disk Access/FDA (or other locations). It's really confusing that some of those settings can be toggled on/off, while the Full Disk Access is greyed out and can only be toggled under "Privacy & Security". To add to the confusion, toggling FDA off just protects a few selected folders that Apple decided are extra sensitive, like: Messages ~/Library/Messages Safari browsing history ~/Library/Safari Cookies ~/Library/Cookies Identity services ~/Library/IdentityServices Spotlight data ~/Library/Metadata/CoreSpotlight Phone call history ~/Library/Application Support/CallHistoryDB Facetime data ~/Library/Application Support/Facetime TCC database ~/Library/Application Support/com.apple.TCC.db "Normal" files and folders on your disk (including Desktop, Documents, Downloads, network volumes, and removable volumes) can always be accessed (even with FDA permission revoked!) after a simple prompt. [1] [1] https://support.apple.com/guide/security/controlling-app-access-to-files-secddd1d86a6/1/web/1
Whoa you are bringing back some memories. And it absolutely was a magic fix. I stand by it.
•
I remember verifying it really DID fix some problems (just not all) and it was so easy to do you might as well always do it. (You could see permissions errors in the logs that would go away after running it, which often didn't really fix anything but could make it faster since it didn't have to error out.)
I'm sure there are some great ones, but it was 5-10 years ago when I last read one, and it was fantastic. It's nearly impossible to do a web search for it right now, probably because of Google's bias towards recency. I know it's been linked on Hacker News many times, so maybe somebody else has better info here. Even if you're not an Apple fan, these sorts of stories are kind of great for learning about product development and companies in general, I think. jwz's stories of Netscape are also phenomenal. (Just don't click on any HN links that go to jwz.org, or you'll have to clear cookies to see any content there in the future. He's not a fan of the exploitation that startups frequently do to their employees and views HN as a primary channel of promoting that exploitation.)
•
You just reminded me of one of my favorite Jobs / Carmack stories: I had the privilege of working with John Carmack as a technology evangelist at Apple when he ported Quake III Arena to Rhapsody, Apple’s internal name for the OpenStep/Mach kernel based MacOS X. I enjoyed John's reminiscence about working with Steve and Apple and thought I would share a few of my own memories from that time which provided me with some of the most satisfying moments and lessons of my career. John was the first game developer I ever worked with. Three weeks after I sent him development hardware (an iMac) he informed me that the PC and Mac versions of Quake III Arena were in “feature parity.” I still recall my shock upon reading that email from him. John agreed to come to Cupertino and meet with several teams to share his development experiences with them. I picked him up in the lobby of the Fairmont Hotel in downtown San Jose. He stood unassumingly in the lobby, framed in the background by a Christmas Tree. On day one, we met with several internal teams at Apple. I was accustomed to see 3rd party developers emerge somewhat awed by their meetings with Apple engineers. In John’s case the reaction was reversed. I’ve never seen anyone grok complex systems and architectures so quickly and thoroughly as John. Amusingly, he walked around the Apple campus unrecognized by all but for the occasional, former NeXT employee. On Day 2, John was to meet with Steve. I never knew whether it was by design or not, but on that day John wore a T-shirt that featured a smiley face with a bullet hole in the forehead from which trickled a few drops of blood. After an hour of waiting for Steve in IL1, he marched into the room, and immediately mistook me for John Carmack, extending his hand to shake mine (we had never met). I locked eyes with Steve Jobs and looked down significantly at the Apple badge on my belt. Without missing a beat, Steve shifted his extended hand to John's. That’s when Steve noticed the T-shirt and the meeting, as soon as it had begun, took a turn for the worse. Steve’s jaw muscles visibly tensed and he became stone-faced. Clearly deeply offended by John’s T-shirt, he sat down at the conference table and looked straight ahead, silent. John kicked off the meeting by saying, “So I’ve been working with MacOS for the past month and here’s what I learned.” His #1 concern (at an extremely high level) concerned OpenGL permissions and security for which he felt Apple needed a better solution than what he’d learned about the day before in meetings with the graphics team, even if it came at a slight cost in performance for 3D games. This was, suffice to say, typical of John in that he was approaching an issue from an objective engineering perspective and arguing for the most technically correct solution rather than pushing for something that might be of benefit to his personal projects. Steve listened and abruptly said, “That’s not what we’re doing!” Then he looked at the three Apple employees in the room and asked, “Is it?” I confirmed that what John was raising as a concern came from a meeting with the graphics architecture team the day before. Without batting an eye, Steve stood up, tramped over to a Polycom phone and dialed from apparent memory the phone number of the engineering director whose admin informed Steve that he was at an offsite in Palo Alto. Steve hung up, sat down, and about 30 seconds later the phone rang with the engineering director on the line. Steve said, “I’m here with a graphics developer. I want you to tell him everything we’re doing in MacOS X from a graphics architecture perspective.” Then he put his elbows on the table and adopted a prayer-like hand pose, listening to and weighing the arguments from his trusted director of engineering and from the game guy with the bloody smiley-face T-shirt. And what happened next was one of the most impressive things I’ve ever witnessed about Steve or any Silicon Valley exec. Early on in the discussion, the Apple engineer realized that “graphics engineer” in the room was John Carmack. And he realized that he was going to need to defend his technical decision, on the merits, in front of Steve. After extended back and forth, the Apple engineer said, “John, what you’re arguing for is the ideal …” He never made it to the next word because Steve suddenly stood bolt upright, slamming both palms onto the desk and shouting, “NO!!!!” “NO!!! What John is saying is NOT the ideal. What John is saying is what we have to do!!! Why are we doing this? Why are we going to all this trouble to build this ship when you’re putting a TORPEDO IN ITS HULL?!!!!” All of this was said with the utmost conviction and at extremely high volume. To his credit, John, seated directly next to a yelling Steve Jobs, didn’t even flinch. What was so impressive to me in that meeting was not the drama so much as it was that Steve Jobs made a decision on the merits to side with John on a technical issue rather than his longstanding and trusted graphics engineer. He overcame his original distaste for the T-shirt and made the right call. Most CEOs would have dismissed John’s comments or paid them lip service. Steve listened to both sides and made a call that would have long lasting implications for MacOS. As a comical aftermath to the story, John next told Steve point blank that the iMac mouse “sucked.” Steve sighed and explained that “iMac was for first-time computer buyers and every study showed that if you put more than one button on the mouse, the users ended up staring at the mouse.” John sat expressionless for 2 seconds, then moved on to another topic without comment. After the meeting ended, I walked John to the Apple store on campus (this was before there were actual Apple stores) and asked him on the way what he thought of Steve’s response to the mouse comment. John replied, “I wanted to ask him what would happen if you put more than one key on a keyboard. But I didn’t.” Good call, John
Don’t applications running under your user account have access to your user’s home folder by default?
•
The entire point of macOS's TCC was supposed to be to make that not the case anymore.
Sure. But the proper api call to make is selecting a picture. Not access to the photo library. That is an api design flaw, and simply a bad / obsolete implementation by the app developer. The complaint of the OP is that he can still open a file which is in the downloads folder. But that’s not what the user is doing. There’s no reason to give folder access at all. (Except for file sorting apps etc). The only “reason” would be that it’s more difficult for developers to atomically overwrite a file in the same locations. And quite frankly, they should (and perhaps already do) have api calls for exactly that. I think this is why many apps request access sometimes.
•
I'm trying to think of a scenario where a users hits Open and picks a directory but does not want the software to have access to the contents of that directory. If you don't want it to access a folder, then don't open a folder in it. This behavior gets used all the time in things like opening a folder in your IDE so it can access the whole project. The OS does allow file pickers that can only pick files and not directories (set canChooseDirectories = false), and if an app has no legitimate reason to need a directory they should do that, but the fact that you can grant permissions isn't the problem. What they need to fix is that you're granting permanent permissions with no indication that you've done it and no way to remove them. To anyone at Apple reading this - please do not draw the conclusion "permissions to access a previously opened file or folder should expire after 24 hours" there are already more than enough permission prompts.
The problem with Mac’s sandbox system is that it’s giving me some PTSD of Windows UAC. It’s inventing a solution to a problem that might exist in small doses, but instead gives users permission fatigue. I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but for power users is infuriating at times. Multiple restarts of Mac and various processes (and when you realize not enough scopes have been granted, another subsequent restart). I think Mac forcing all users into its sandbox system has been one of my least favorite impacts since upgrading macOS, leading to the enshittification of macOS. The craziest thing is background processes started by Terminal/iTerm (such as tmux) can inherit Terminal or iTerm’s elevated status even when Terminal or iTerm are no longer running, dead, or killed. So you’ll have a bunch of elevated processes without the elevated parent or grandparent process running—it makes me feel the whole permissions scheme is more performative than actually useful.
•
> I personally think the traditional *nix model has served us quite well The problem is that it has the https://xkcd.com/1200/ problem for almost all normal end-users.
Someone at Apple should watch some of their old ads. https://www.youtube.com/watch?v=8CwoluNRSSc
•
The best part is that this kind of popups have been introduced with OS X Lion in 2011, which only came 4 years after Vista.
France to ditch Windows for Linux to reduce reliance on US tech (techcrunch.com)
•
Who do they think writes Linux? The European Commission? They’re on the US tech stack whether they want to be or not, and nobody in Europe has the will or resources to pull a China and make their own alternatives. More’s the pity.
The age of the Linux desktop might actually finally be coming Personally I think we are at an interim period for a big player to emerge and take over this space. If enough governments in the EU start switching over to customized linux distros theres a big chance for someone like Nokia to come in and develop their own approved distro with proper MDM and GPO-like management functionality baked in . On top of that it could be great to see SteamOS continue to gain share and become more than just something people run on gaming purpose hardware. And thirdly would love to see a more simplistic but super lean and functional OS built on something like the BSD.
•
Yeah, I think if Windows 11 is going subscription based (plus all the copilot pushing garbage and even more baked in ads) that will be a strong incentive to switch to Linux or SteamOS. I barely even play games enough anymore to make a desktop worthwhile. Might just jump to Mac only.
big player + (standard) linux desktop may well be coming, but that means losing the semi-anarchist bazaar mentality. Will the standard be gnome or KDE or XFCE or ...? If gnome, version 2 or 3? Firefox or chrome as the default browser (or derivatives like waterfox or plain chromium ...)? AI integration? The moment you're developing for people with no IT experience and no CS degree, you're going to have to make tradeoffs like Microsoft or Google or Apple have to make today, and somehow deal with the "curl ... |sh" problem.
•
Why does there need to be a standard application for everything? Is there a default pencil vendor? A default printer vendor? Paper? Car manufacturer? Taxi company? Just let people buy/get whatever vendor/application they like. I rather see more interoperational standards.
I've been using linux as a daily driver since the start of the year. There's still a long ways to go before things "just work". It's about equivalent to windows right now in terms of frustrations, it's just that frustrations are more along the lines of "this is a bit wonky" instead of "this is malicious / was their intended behavior". It's gotten a LOT better, don't get me wrong, but it's still far off from what a typical user would need. I'd love to see either Valve or Nvidia really put in effort into creating their own hardware/software integration on a level that Apple does. I think it'd go a long way to legitimizing it.
•
Thank you for saying something I've been saying for awhile: Linux definitely has jank, but I'm not convinced it's more janky than Windows. I think people are so used to Windows' awfulness that they kind of forget about how much bullshit is associated with it. Linux has bullshit too, though it's getting better, but when people talk about Linux jank they're always smuggling in an implication of Windows having less jank, which I don't concede at all.
•
Do typical users care that much about a bit of jank, though? All the “typical users” I know are on spyware infested Windows laptops and just interpret the horrible shabbiness of the whole experience as being normal.
•
Yeah, for example a bunch of my system updates began showing scary error notes because somehow there is a header inconsistency between the amdgpu driver and the kernel. I'm not regretting my choice, but it's also something where the average user can't just call Linux Support and get a "run X and it'll fix it" solution.
> " theres a big chance for someone like Nokia to come in and develop their own approved distro " Microsoft bought Nokia's devices and services division for Windows Mobile in 2014. https://en.wikipedia.org/wiki/Microsoft_Mobile
•
They killed any Linux device development at Nokia in 2011. Still salty about Elop shooting down a project we had spent 5 years working towards. The holistic platform security for a combined phone/tablet base system would have been really interesting.
Yes I do mean that. Google is one of the only companies in the Linux space who takes security seriously.
•
There is no security when the US government can legally compel Google to do whatever they want. This is why foreign governments want to move away from big tech. Turns out the imperial boomerang impacts many things, especially when previous orders are easily destroyed (because only one country was benefiting).
And switching to Google achieves the aim of getting away from American tech giants?
•
I don't think it's a wise thing to do at this point in time. There is more risk by not depending on America.
I applaud France for this decision. Windows is basically legal spyware and adware at this point
•
Like most Microsoft products, Windows is a tool that benefits mostly from aggressive early marketing and successfully convincing everyone that they need this product, and by the time everyone realizes how terrible the product is it's too late because everything already depends on it. They have done this everywhere; Microsoft Office is everywhere and terrible. Sharepoint used to be everywhere and is terrible. I know they bought it, but LinkedIn is nearly required everywhere and terrible. Teams seems to be increasingly used everywhere and terrible. And of course Windows is everywhere and terrible. As far as I can tell, there is not a single thing that Microsoft does not half-ass. They're not a software company, they're a marketing company that sells software.
For people with a level of technical literacy that has them interested in posting on HN, sure. But for typical government workers? I imagine the differences are going to be pretty significant. They're not programmers or "devops" people. We're talking about users who are going to do almost everything through the GUI, and who will associate the "distro" with the default choice of DE/WM/etc. stack in whichever flavour of whichever distro it is. Understanding what a "package manager" even is, will be the responsibility of "IT" specialists. Assuming they don't decide that only, say, Flatpak-installable software can be approved. We're talking about massively bureaucratic institutions that have been steeped in Windows orthodoxy for decades. That's the administration policy they know, so it's what they will forcibly adapt to Linux. You're going to need user retraining because the GUI has its own file manager program and no matter which one you choose (and they will choose exactly one) it is not Explorer . Because LibreOffice is not the Microsoft Office suite , and neither is any of its FOSS competitors. And so on and so forth. There's no telling what idiosyncrasies people depend on. In organizations like this I really doubt you can count on everyone being generically computer literate. I really doubt that generic computer literacy (as opposed to demonstrated competence with specific applications ) was ever part of the hiring requirements.
•
> But for typical government workers? I imagine the differences are going to be pretty significant. They're not programmers or "devops" people. How much retraining do you need for "click on the orange and blue spinny fox thingy and wait for your email to come up"? > because the GUI has its own file manager program and no matter which one you choose (and they will choose exactly one) it is not Explorer Nobody is ever going to use it. They're going to use a web browser. > There's no telling what idiosyncrasies people depend on. Funny way of spelling "Firefox bugs", but whatever. > In organizations like this I really doubt you can count on everyone being generically computer literate Basic adult literacy is computer literacy. If you can read you can use a computer.
>All distros are basically identical. Have you ever used the Linux OS??
•
Yes, since it came on two 1.44MB floppies.
This comment is completely out of touch with how typical office workers use their computers. "Package manager" is your feldspars. But it's even worse than that, because you don't train for the typical employee, you train for the least-technical employee lest they become completely useless overnight.
•
> because you don't train for the typical employee, you train for the least-technical employee lest they become completely useless overnight. "Click on the blue and orange spinny fox thingy" is easy for even the thickest user.
>Are people designing aircraft carriers in Fusion? I don't know, but I have watched people designing high-speed trains in CATIA.
•
Big players use CATIA and Siemens NX almost exclusively. I don’t know many using Autocad, maybe architectural firms.
I hope it succeeds and I hope they document the experience and invite interested parties to see how it was setup and how (well) it works in order to encourage as many governments and organisations as possible to do the same.
•
For sure, I would love for this approach to spill over to the US and cause them to sever any contracts they have with the EU member nations
Helium Is Hard to Replace (construction-physics.com)
If demand keeps growing (as it has been), we've got ~40-60 years of "cheap" reserves left. As helium prices start to increase, you've got price shocks down the supply chain. There's about 40-70 billion cubic meters of economically recoverable (assuming future technology development + price increases). The complete total upper end of known geological reserves is ~60-100 billion cubic meters - that's about correct in terms of order of magnitude even if we find new deposits. Current consumption is 180 million cubic meters/year. At a growth of 3%, you've got 80-140 years before we run out. At 5% growth it's 50-90 years. Saying "I'm not worried about it" is true in the myopically selfish "I personally won't have to care about it". It's conceivable that your children will be dealing with it and definitely grandchildren in a very real existentially meaningful way.
•
Maybe we will build chips in space in vacuum?
It's very hard if not impossible to do predictions over century timescales. How relevant are 1926 resource problems to today? If you wrote your comment in 1926 you would be talking about rubber, fertilizer, coal, wood or oil, and 4 out of those 5 are mostly solved today. At those timescales, mining the moon or Jupiter for helium might be realistic, so the limits of earth are no longer upper bounds.
•
We're definitely not mining the moon for helium, but might well end up "mining" the gas giants.
Despite all the online rhetoric, and the popularity of mis-naming political movements, sometimes I think the people who hate America the most and want it to fail are Americans themselves.
•
> sometimes I think the people who hate America the most and want it to fail are Americans themselves. That's because the US (and the UK) are about the only countries in this world that haven't had the entirety of their legal, economical and political system completely revamped at least once in the last 100 years - most countries average more than that. At the same time, such a revamp is desperately needed - the issues with the status quo are reeking - and everyone knows that it is highly, highly unlikely to get that done by ordinary democratic means due to the sheer inertia of hundreds of years of fossilized bureaucracy and individual/party interests. And that is why so many people tend to vote for whoever shouts "destroy the country" the loudest - and not just in the US (MAGA) or UK ("Reform"), but also in Germany (AfD), Spain (Vox) or Italy (Salvini/Meloni), where economic inequality and perspectivelessness has hit absurd levels. Let it all burn to ashes, burn everything, even if one goes down with the fire, eat the rich, and try to build something more sane this time.
•
Nah; last but one job I had an Iranian coworker, and I asked if the way the regime calls Israel and the US the "Great Satan and Little Satan" was serious or a quirk of translation. Apparently the regime is quite serious about the US being the actual devil.
•
It is not a matter of hate or love. But the fact that people in charge doesn't give a fuck at any other thing beyond their personal interests. But this problem is not exclusive to America.
I think that's broadly true: both sides want America to fail when the other side is in power in order to prove they're right.
•
Classic enlightened centrist take. One side yells when the other dismantles the institutions that let the country work, so both sides are equally bad.
•
I don't want "the other side" to fail, and I absolutely don't wan the U.S. to fail when they are in power. I want the U.S. to succeed, and for "the other side" to be competent and fair.
Supply chain nightmare: How Rust will be attacked and what we can do to mitigate (kerkour.com)
•
We're going to be launching Chainguard Libraries for Rust in a few weeks, this article perfectly calls out the issues. crates are somewhat better designed than NPM/PyPI (the dist artifacts are source based), but still much worse than Go where there's an intermediate packaging step disconnected from the source of truth.
•
rust fixed memory safety but left build-time trust wide open. What’s the realistic path to fixing this? sandboxed builds by default, or stricter provenance (sigstore-style) or what?
How would that work? Rust "crates" are just a compilation unit that gets linked into the resulting binary.
•
By using the type system. You define your type constraints at the module interface point and when you try to link the third-party module into that interface the compiler ensures that the constraints are satisfied. Same thing the compiler is already doing in simpler cases. If you specify that a third-party library function must return an integer, the compiler will ensure that function won't unexpectedly return a string. Just like that, except the type system is expanded to enable describing more complex behaviours.
"Negative" views of Broadcom driving VMware migrations, rival says (arstechnica.com)
•
It couldn't possibly making a simple software update cost 21x the previous cost to run the software to the point changing to a competitor is cheaper than maintaining VMware.
Agreed! I switched from VMWare to Proxmox a few years ago because Proxmox supported a wider range of network cards that were more common in the cheap desktop computers I use in my homelab, whilst VMWare almost required an Intel network card (which was usually fine for server hardware). It was a surprisingly easy transition that I have not regretted one bit. I'm not sure whether there that was an actual migration path, without reinstalling servers from scratch. Homelab meant it didn't quite have the requirements of a production system...
•
I'm kinda hoping AI agents pass the threshold of being able to reliably do a complete production migration sometime this year. We've got a couple years left on the vmware contract, and it's just obscene what they've done, with the price hikes, degraded support, etc. At this point they're more an enterprise scheme to maximize license profiteering for compatible software and OS "per core" licensing in conjunction with hardware platform providers. It'd be cool if the support were worth the price, but in most enterprise cases, you're going to save a lot of money if you pay enough full time staff to purchase, build, maintain, and operate a virtualization environment compared to what the enterprise platforms provide. In most cases, you'll save more than enough to keep a better specced system completely redundant with spare hardware on hand.
Was VMWare dying prior to the acquisition? I don't really know the financials but that wasn't the impression I had.
•
VMWare din't have a growth trajectory and didn't have a reasonable expectation of one. You don't make these kinds of sales when you're circling the drain, you do it when you can see that future coming for you.
Code is run more than read (2023) (olano.dev)
•
Once I wrote the perfect piece of software. It was so perfect that there was literally no bugs for months. How could this have happened? Well, the code was shipped but no customer was running it in production.
Does the ">" mean "greater than" or is it meant to symbolize an arrow in a ordered sequence?
•
Good question, to my it was "greater than" but now I read it again with the other interpretation ... and it still makes sense? Weird.
I have a 2009 Citroen and the battery is secured with a bolt that is under the battery compartment and to access it you need to go under the car with a very long wrench, who engineered it is a psycho
•
Since Dante wrote _The Inferno_, there has been a circle in Hell added where car designers are endlessly changing the spark plugs on AMC Javelins, bleeding brakes on Ford Escorts, and similar maintenance tasks which the design made more difficult than is reasonable.
Anthropic's Claude Mythos isn't a sentient super-hacker, it's a sales pitch (tomshardware.com)
•
And this attitude is how you get compromised in the near future. No reason to expect capabilities of models are going to stop.
•
The whole announcement is full of FUD and fearmongering. They say they can't talk about 99% of the findings, they claim one of their experiments went "public" and posted to some very obscure websites no one has heard of, but didn't disclose which websites were these... They are saying "trust me, bro, I have a superhacker model" and proceed to show 0 evidence that it is what they are hyping.
•
I think we are learning as we go along much of what goes on in the world. E.g. even though LLMs can generate code and we have agents - the profession of software engineers is not being destroyed. The demand for software engineers in the labour market is still strong. Also a thing that wasnt spoken about loudly (and for good reason) is that code is not perfect - this means bugs/vulnerabilities are there. And the reality is, it is optimal to have done this - for it were not done, the release of software and the moving of resources towards other projects would slow. Aka slowing down economic activity.
When these models come out and/or the responsible disclosure period elapses, I wonder if the naysayers will admit they were wrong, or if they'll just continue naysaying the latest bit of news about AI. In my view the naysayers always simply been moving the goalposts, and never admit when they were wrong. "AI just produces slop" -> "AI can't write useful code" -> "AI can't take SWE jobs" -> [we are here]
•
And there were people like you claiming that the jobs of SWE's would start imploding the moment LLMs could generate sufficient code that could be considered production grade. You, just like 'them' are no better. It would be better if all those on the extreme ends could be muted - the truth is closer to the middle.
•
Nearly all big tech code is AI written today. What about that isn't "production-grade?" Didn't Oracle just lay of 30k people, Meta plans on laying off thousands more this year, Microsoft and Amazon have already done layoffs in the name of AI? And it's impossible for new grads in CS to find a job. You would have to be insane to study CS in college today. My big tech org hasn't hired interns in over a year. I don't think anyone claimed " all SWE jobs would disappear by April 2026," but two things have come true: - AI can write nearly all new code at today, and it does at many companies. (People were very skeptical when Dario claimed this would happen just over a year ago) - AI has fundamentally de-valued programming. Code is cheap. So at what point should naysayers update their priors? Is it when they are proven wrong about cyber risks a few months from now? I genuinely want to understand how many times someone needs to be wrong to re-think their perspective.
•
With all due respect, you sound like a bozo - Ive seen you edit your post about 5 times. What matters is the aggregate activity in the labour market - for which - the activity associated with demand for software engineers is healthy.
Yup! It's so scary good we're not gonna sell it - change our minds... by investing gazillions of dollars. Well, one thing is for sure: if it exists, Palantir will be using it!
•
They are selling it, just not to script kiddies. Or do you think Apple, the Linux Foundation, etc are just participating in a massive conspiracy/rugpull?
•
So, suddenly, you see, open-source projects, which thousands of hackers have been trying to hack for decades, are gonna get hacked by an LLM. I need to see at least one such mitigation by Mythos, then we can assess the situation.
US summons bank bosses over cyber risks from Anthropic's latest AI model (theguardian.com)
I hope these banks are complaining how Anthropic is preventing them from accessing their latest model and giving preferential treatment to other businesses.
•
At least one of those banks is already in the partnership, and we don't know how many they reached out to.
Tangentially related, but how does one protect themselves against the bank account/brokerage being hacked? Can you print out a proof of funds/securities owned to take to court to be made whole?
•
Your screenshot/PDF is kind of worthless since it's trivially editable. Still a good idea to have it. Banks are required by law to be able to produce account balances in a few days. In some countries the are required to submit them to account protection institution regularly so that if a bank fails they can quickly reimburse people to prevent panic spreading to other banks. You can probably request some sort of notarized proof of accounts, but it will probably cost you $100.
> ignites a new digital "cold war" Already been going on for over a decade - export controls on dual use technology like Xeon processors already began being enforced back in the Obama admin. > until the launch takes place It's already launched. Some companies had access to Mythos for months. > fuelling the hype This is true. Commercially available models from a year ago are already good enough from an offensive security perspective. Their big issue was noise, but that could be managed.
•
I was in the industry when key lengths for SSL were different between US domestic and US products for export. That’s one reason so much Open Source cryptography software expertise built up in Europe so quickly.
•
Much of that muscle was already well built in Western Europe well before the SSL stuff because of KU Leuven, COSIC, and IMEC. The issue is by the late 2000s to 2010s, most European organizations didn't take advantage of that base despite being US comparable in the 1970s-90s.
Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to access admin panels and some random memes, obviously, hundred more like those that are ALREADY solved and KNOWN by the developers themselves. You literally have developers that still use cleartext DNS (apparently they are ok with their history accessible by random employees outsourced)
•
I read your list and all of that is normal computer use. How can it be reckless to use a computer normally?
•
normal doesn't mean "right", we have piled-up a ton of bad decisions and users that are aware should now better than default settings.
"Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about." I agree that cyber security is taken too lightly. However, I think that many developers don't actually know about vulnerabilities. In many companies those reports get filter through other teams and prioritized by PMs. The devs tend to do their best at meeting the afressive schedules the penny pinching business people set.
•
I frankly believe that many know what they are doing, take the average freelancer, developing for multiple clients on the same workspace (suicidal and ethically wrong on top of it) without even disk encryption enabled or straight up syncing everything in cleartext to dropbox.
•
Or they're a freelancer because they arent good enough for a big salary job
Promoting the model as potentially dangerous might backfire with the government banning it from being released by executive order.
•
That's probably a contributing factor as to why they already partnered with all the biggest tech companies.
> the government banning it from being released by executive order. There's no legal mechanism for the president or the government at all to do that.
•
There's no legal mechanism for the vast majority of what the president has done. Often it happens anyway, along with some protests, some resignations and maybe an eventual court case reversal months or years later.
Will you eat your words when you find out major vuln disclosures have been happening for decades?
•
They obviously meant on an unprecedented scale.
•
Sure, and healthy skepticism before proof is a sign of wisdom. Which makes taking claims from companies at face value…?
Which is exactly what Anthropic understands the situation to be. They state at the beginning of the Glasswing blogpost that Mythos is not better than the best vulnerability researchers. But it doesn't have to be to become a tremendously big deal.
•
There is not just a lower barrier to entry. The best use of a tool will still be made by the most knowledgeable users. So we’re looking at lowering the bar some, but another big deal is the scale at which the top experts can work. That might actually be the longer lever. Imagine a top expert burning tokens across whole repo histories of a few dozen projects looking for likely but unconfirmed flaws, then having the model flag and rank those suspects for their own review in triaged order.
The effects of caffeine consumption do not decay with a ~5 hour half-life (lesswrong.com)
> It's also cripplingly addictive. That very much depends on the medium. It's virtually impossible for a nicotine naive individual to get addicted to losenges or gum.
•
I’m going to need a source on that
I now like bitters and soda, and I didn’t like bitter as a kid, so I think there might also be shifts in favor of bitter unrelated to coffee. Perhaps the same thing that leads people to appreciate spicy or sour as experiences broaden.
•
Years ago, somewhere I read that children have a genetically-based urge to avoid bitter flavors, since they may signal natural poisons, whereas adults can judge better, so the urge is lessened. (And even if that source were true, that wouldn't make the genetic effect an absolute; it would depend on individual genetics and the variable expression of those genes. And probably on the individual's experience, either as a child or as an adult.)
> I've not gotten that kind of profile out of anything but fairly-expensive beans roasted within the last couple of weeks, though. Good beans will last more than 2 weeks, but yes—just as you wouldn't judge all sushi based on gas station sushi, we shouldn't judge coffee based on months-old pre-ground grocery store roasts.
•
> we shouldn't judge coffee based on months-old pre-ground grocery store roasts. Next you'll be claiming that we shouldn't judge sushi based on months-old grocery store sushi.
It's a particular variety of "everyone else is wrong (and maybe a bit stupid)". Like, sure, sometimes you get popular nonsense like recovered memories or accidental fires can't be as hot as intentional fires or shaken-baby syndrome or bite-mark analysis. But a lot of times, everyone isn't wrong and you've just overlooked something critical or misdefined the problem.
•
> Like, sure, sometimes you get popular nonsense like recovered memories or accidental fires can't be as hot as intentional fires or shaken-baby syndrome or bite-mark analysis. But a lot of times, everyone isn't wrong and you've just overlooked something critical or misdefined the problem. The older I get, the more I find that everyone is wrong. It's fucking astounding how much stuff either was never actually checked, or is true only under very select circumstances with those caveats being widely ignored. For example at work right now we have been using a test for 40 years that was developed around the idea that our product absorbed air - chemical variation would lead to extreme differences in results and you can't retest an item for at least 24 hours because it will still be affected. Turns out that none of that was true, all the error we were getting was from temperature change, the items can be retested after 45 seconds. 40 years and no one took 30 minutes to verify this claim which costs us millions of dollars per year. And this is just the example from this past week. I've probably seen several hundred such cases of completely unjustified claims being treated as gospel truth. I can't speak for the countless things I've never tested, but if nearly everything I do test is wrong, across numerous fields full of very intelligent people, it doesn't give me much confidence about everything else. We live in a world that values simplicity and confidence, not nuance and rigorous verification. I've gotten to the point where I don't trust anything without verification, not even my own past work.
CPU-Z and HWMonitor compromised (theregister.com)
To our new generation of human shields willing to use software releases less than a month old, we salute your sacrifice.
•
Not fair take, cpuz and hwmonitor are often used on new installations of PCs (or at least for me) to verify hw specs and stuff. Or when I need to do some upgrade work for a desktop computer. I just go to the trusted site, download what's there and get going. This is not an npm package that a dev is updating on day 0 of its release for being a "human shield", it's literally the first version which comes up when DLing the new software.
I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?
•
I don't know about other managers, but nixpkgs has hashes of the package I'm installing, and is a git repo, so I can easily check that no one has force pushed, and I have the full history of package changes over time.
•
Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist or in the case of yesterday's Wireguard / VeraCrypt discussion, think it's an evil capitalist scheme to control the world. Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations.
It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.
•
It is possible but visible, and it means burning an identity, so it's not irrelevant
some comments purportedly (i did not verify) from one of the maintainers: > Dear All, I'm Sam and in I'm working with Franck on CPU-Z (I'm doing the validator). Franck is unfortunately OOO for a couple weeks. I'm just out of bed after worked on Memtest86+ for most the night, so I'm doing my best to check everything. As very first checks, the file on our server looks fine ( https://www.virustotal.com/gui/file/6c8faba4768754c3364e7c400a9d79ccbece156087be607583619f11a09cb064 ) and the server doesn't seems compromised. I'm investigating further... If anyone can tell me the exact link to the page where the malware was downloaded, that would help a lot > Thank you. I found the biggest breach, restored the links and put everything in read-only until more investigation is done. Seems they waited Franck was off and I get to bad after working on Memtest86+ yesterday :-/ > The links have been compromised for a bit more than 6 hours between 09/04 and 10/04 GMT :-/ so, it appears that the cpuid website was compromised, with links leading to fake installers.
•
Glad that they figured out the issue and fixed the links. When I first read this, I assumed it was actually the sketchy ads that are run on www.cpuid.com. These are the real ads I just saw on a single download page for CPU-Z: "Continue to Download", "Install For windows 10, 11 32/64 bit Get Fast!", "Download", "Download now from PC APP STORE", or "Download Now For windows 10, 11 32/64 bit". Many of them appeared multiple times on the page. The real download links don't even say they are download links. I love the winget CLI in this situation. This is all you need: `winget install CPUID.CPU-Z`.
Back in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.
•
Tenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices. The alternative (tho not practical in many cases) would be RO media like RW-DVD.
And CSI: Miami, which kept the vibe alive through the 2000s and "educated the masses" on how IT works. Beep boop, I'm in.
•
The counter-hacker double-keyboarding sequence was inspiring.
FBI used iPhone notification data to retrieve deleted Signal messages (9to5mac.com)
•
This is the same issue that got a local drug organization busted some time ago - their entire α-PVP cooking operation was busted after one of the gang members was caught during a sale, his iphone was confiscated and the entire org was right there in the notification history. I guess that's what you deserve if you trust apple with your operational security.
•
I don’t know why anyone trusts Signal. People keep talking about them. I thought it was clear years ago that they were a sketchy company
So Signal is sending the notifications through Apple's ecosystem somehow, presumably to save battery life by not having a persistent connection to Signal's servers? That's what I think happens on Android, too. When I had Lineage years ago, I had a persistent connection to Signal as the notifications didn't come through Google. Unfortunately there was a persistent notification for the persistent connection with no way to remove it. After these news Signal should ask the users ASAP and on new installs something like: > Do you want the notifications to pass through Apple (no privacy, better battery) or through Signal itself (better privacy, but less battery life due to the persistent connection to Signal's servers. It should be as part of the setup wizard, not inside the settings. Correct me if I've misunderstood something.
•
There is no other way to send push notifications on iOS, you have to use APNS. When the app is active you can switch to your own local socket connection, but as soon as it goes into the background those connections are lost. Pushes can also start the app in the background if it hasn't been used in a while and has been evicted by the OS. You can send push notifications with your own encryption on top, which I believe Signal does, so Apple can't see it on the APNS side, but your local extension to decrypt the content is still subject to the user's settings, and part of the notification history if you put message content in the notification.
•
In my recollection, which may be imperfect: 1. On android if Google Play isn't available (or you install the no Google apk version) it'll use a websocket for notifications. Apple doesn't allow a persistent connection except through their own notification framework. 2. In either case Signal doesn't send message contents through the notification framework (not even encrypted). Once Signal receives a notification the app wakes up and reaches out to the signal service directly for actual encrypted message. 3. Regardless when signal shows the contents of your message in the notification menu of your device your device keeps a record on your device of that message content. The FBI here didn't get anything from apple, once they had the apple device unlocked they looked at the notification database on the device to get the message contents. This isn't really any different from the fact that if the FBI has your unlocked phone they can read your signal messages. The notable bit is that the notification database retains messages even after the app is deleted.
•
" if the ___ has your unlocked phone they can read your signal messages. " It's worth noting you can add an additional security check pin/bio/pass to signal that is different from your phone unlock. The protester had also uninstalled signal from phone (even with access to the phone, they would not have access to signal, if they had reinstalled signal, and some how got the security pin or passphrase, they wouldn't be able to load the prior messages, without either, no messages at all).
Putting on my user hat... "OK. Signal has forward secrecy. So messages are gone after I receive them. Great!" Oh, you didn't turn on disappearing messages? Oh, right, then forensic tools like Cellebrite can get them. You have to turn on disappearing messages. The default is off. Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Turns out Apple was doing that. There is an option you can turn on to prevent that. It is off by default. "I'll just delete the entire app!" No, sorry, the OS still has your messages... At what point does the usability get so bad that we can blame the messaging system? This same app had a usability issue that turned into a security issue just last year: End to End Encrypted Messaging in the News: An Editorial Usability Case Study (my article) https://articles.59.ca/doku.php?id=em:sg
•
I think one of the main issues is that end-to-end message encryption is a sham as long as backups are not encrypted. I could have good device security, but if the person I'm talking to does not use ADP, iMessage and WhatsApp messages get backed up with only at-rest encryption (I think Signal opts out of standard iOS backups) and possibly the same for backups of the iPhone notification database (which the article suggests as a possibility). Similarly on Android, WhatsApp suggests unencrypted backups to Google Drive by default. Putting on my tinfoil hat, I am pretty sure that Google/Apple/Meta have some deal (successor to PRISM) where end-to-end encrypted messaging is tolerated as long as they have defaults that make it possible to access chats anyway. Apple not enabling ADP by default and WhatsApp doing Google Drive backups that are not end-to-end encrypted is the implementation. Since most people just use the defaults, it undermines security of people who care. It's a 'win-win', the tech companies can wash their hands in innocence, the agencies get access to data, and phone users believe that they are chatting in a secure/private manner.
•
"end-to-end message encryption is a sham as long as" -- I agree with that but would add even more caveats. If someone can't list those caveats off the top of their head they shouldn't be pretending they aren't able to communicate securely. Just look at Salt Typhoon, every single person should be way more paranoid than they are, including government & agency officials. The attach surface and potential damage - financial and reputation - will only get worse with AI automation and impersonation, and that's for people who are doing nothing interesting and are law abiding citizens.
People keep pushing signal because it is supposedly secure. But it runs on platforms that are so complex with so much eco system garbage that there is no way know even within a low percentage of confidence if you've done everything required to ensure you are communicating just with the person you think you are. There could be listeners at just about every layer and that is still without looking at the meta-data angle which is just as important (who communicated with who and when, and possibly from where).
•
I've raised concerns about the Signal project whitewashing risks such as keyboard apps or the OS itself, and the usual response is that it's my fault for using an untrustworthy OS and outside Signal's scope. At some point there need to be a frank admission that ETE encrypted messaging apps are just the top layer of an opaque stack that could easily be operating against you. They've made encryption so slick and routine that they've opened a whole new vector of attack through excessive user trust and laziness. Encrypting a message used to be slow, laborious and cumbersome; which meant that there was a reticence to send messages that didn't need to be sent, and therefore to minimise disclosure. Nowadays everything is sent, under an umbrella of misplaced trust.
•
There is nothing secure about sending encrypted content to notifications. If it were secure, it would only notify that there is a message, with no details included.
The median user isn't going to change default settings, so your app is as secure as whatever the default it.
•
Even if I change the setting, my messages aren't truly secure against this unless all recipients do the same on all of their devices.
Pretty sure that's just iOS behavior + app design. If notifications are off, apps will occasionally prompt again to make sure you didn't disable them by accident or miss something
•
No, the OS will not do that, nor is the developer able to trigger the system prompt again when they detect the user has notifications off. Only thing they can do is present their own prompt and link out to the Settings app for the app's settings. Can't even deep link to the app's notification settings.
Sorry, I really cannot tell if this is sarcasm or not. One of the TOTP apps had a periodic test that you still knew the paraphrase. It started frequent and then backed off to like once a month. There’s definitely a benefit even if it’s annoying.
•
It depends on whether one has it stored in a password manager or not. If stored, there is no benfit. Giving users a choice would be better.
In the Signal app itself there's an option to hide the message body or both the sender and body, that way the OS wont have anything to store in the history.
•
-_- I see it now, on Android. Thanks for prompting me to recheck.
However, if this is important to you then you want Signal to stop telling Android to make the notifications. If it doesn't exist nobody will accidentally make it available. Deleting that history is good to know about after the fact, but preferably lets just not create the problem.
•
I need the notifications though. But you can set them without content. That actually works with signal because all it sends through Google Firebase is a notification to wake up the app. If you have the content turned on the app basically fills the content in the notification locally. But you can turn that off.
 Top