Unlurker

After 7 months, Glasswing overwelms maintainers with underwhelming findings (vulncheck.com)

This is literally an ad for a service that helps you prioritize vulns! It is incredible how often an alleged study like this turns out to be an ad for such a service. "Businesses finding ROI hard to demonstrate" -> ad for a product that helps you demonstrate ROI. Etc. > VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.

The post seems misguided or misdirected in my opinion. Not discounting the fact that the frontier models may find existing bugs, that some are labelled at the incorrect level, even some being a non-bug -- fact remains they are discovering vast numbers of issues. It also isn't the job of Anthropic or OpenAI to fix everyone's bugs, they are doing everyone a courtesy to spend their time identifying them in the first place. The bigger issue appears to be that they are finding more bugs than the developer capacity to can address.

I received 9 reports of Fil-C issues from Anthropic All of them were real bugs. None of them were false positives. The quality of the reports was exceptional. (My baseline is doing security defense on a browser engine, so my baseline has a large sample count and is probably representative of what experts are capable of.) The quality of the proposed fixes was alright. I took some of the fixes verbatim. I used most of the fixes as significant inspiration for doing it my way. The quality of the test cases was exceptional. Maybe I’m special somehow! But I just want to call out the enormous chasm between what I saw of anthropic’s capability and what TFA says

> So far, only 2 of the 442 have been exploited in the wild, just 0.45%. > almost none are being exploited Isn't the whole point of glasswing to patch stuff way before it can be exploited? If the patched code is distributed quickly- there's no opportunity (or incentive) for bad actors to craft and distribute an exploit. This reads like an attempt to spin them as not being "real" vulnerabilities.

The blog is misleading because it tries to characterize Project Glasswing's effectiveness through use of a tangentially related data source. A Project Glasswing vulnerability discovery most often occurs when a Glasswing partner points a Mythos-class model at its own, often proprietary, software. The data source (aka "ledger") is only for the Anthropic coordinated vulnerability disclosure program for open source software: in other words, Anthropic itself pointing a Mythos-class model at an OSS package, and then notifying the maintainer afterward that it had done this, and had findings to share. This OSS work is certainly useful, but the number of fixes reflects - in part - limited time availability by volunteer OSS maintainers, and Anthropic sometimes working without knowledge of the OSS project's threat model (the threat model is explicitly requested in the newer oss-scanner effort). Percentage fixed is often much higher for use of Glasswing with proprietary software, e.g., https://blog.cloudflare.com/cyber-frontier-models/ "Our research with Mythos Preview was conducted in a controlled environment against our own code; every vulnerability surfaced through this work was triaged, validated, and remediated where action was needed under Cloudflare's formal vulnerability management process."

As someone working at a bigtech co that has spent every single working day (and many weekends) since the launch of Mythos patching serious, company-ending type of security issues, these types of posts really irk me. Public datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist. We're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.

I'm sorry you've possibly been wasting your time, but this lends little credence to the idea that what you've been patching has actually mattered from a security perspective. If there isn't data available to assess impact objectively, then this is just fluff and nobody has any reason to believe you. I am unaware of any comprehensive analysis demonstrating that LLMs can identify and exploit problems in private code repositories for major enterprises any more than they do open source technologies, or that this is a growing/mounting crisis. Are you?

Have you seen any patterns for the causes of the error you have seen? For example, more training for developers? Or maybe just systems were really very complex that led to bugs?

as a bystander not even working in the sector, your witnessing is exactly what I was worried for. if an agent is wily enough to defeat a security it should also be wily enough to cover its tracks, otherwise what's the point?

Yeah I am much more worried about some critical vulnerability in, say, the controller logic for pumps at sewage treatment facilities vs. a sandbox break in Chrome (which will be patched well before the blog post...). The broad issue is that you can turn DeepSeek-v6-unhinged loose on an arbitrary IP and exploit ~everything that is not developed and actively maintained by a billion-dollar company

One example they use in the blog post is curl. Not maintained or developed by a billion dollar company. I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier

The PHP2Shell vulnerability ended up being paradoxically comforting for me. They turned frontier models loose on PHP, and the big one they found was based on a previously known logic flaw that was extremely difficult to exploit. Which makes sense: hence the need for frontier models. And in the wild, while there have been many attempts and a few simple demo successes, the practical impact has seemed to be small, seemingly constrained by the length of the chain and the diversity of PHP configs. In short, it was indeed a major vulnerability, but not magic (in the Arthur C Clarke sense). I think ultimately the fear comes down to: do you believe that code can be secured. I recognize that there is probably no objective way to deductively prove it because of the Halting Problem etc. But if one believes code can be constructed to operate to spec, then there must be a limit to the damage an LLM can do, even a very smart one. I think we are going through a phase where a lot of known triaged code shortcomings will get exposed and hopefully fixed. Sucks while it is happening. But not actually the first round of this type of evolution. And ultimately I think as before, we will come out the other side with more secure and durable technology.

The expectations of AI models in security really do seem to be magical in a way that, I think, obscures what needs to be done. Of course AI can’t magically create exploits that somehow drill through otherwise secure systems, because computers don’t work that way. It’s just a matter of not taking for granted things that worked in the past, like downloading code from the Internet and running it in a super-duper secure sandbox. A computer that isn’t connected to anything (make sure to disable Bluetooth and the microphone) is already safe. I bet eventually we’ll be able to serve static HTML pages safely eventually. Maybe not images. Font selections might have to be pretty restricted. But, at least we’ll have the useful part of the internet back.

Thus far, these agent vulnerabilities are all demonstrating million-monkey intelligence, rather than "super" intelligence, in the sense of some swarm of robo-Neo super hackers. That's consistent with my experience using them for coding, where even the best models mostly work by being persistently midwit (with infinite knowledge) more than individually brilliant. One corollary of this is probably that any project that has had an army of actual monkeys pounding on it for years is likely more resistant to LLM attack than one that has not. Everyone is worrying about individual robot geniuses finding obscure vulnerabilities in Linux, PHP, Python, etc., but they should probably be more worried about the permutations of less-known software floating around their systems.

“LLM” may not literally stand for “Lots and Lots of Monkeys”, but this intuition can nevertheless take you pretty far!

Claude is perfectly capable of fixing most vulnerabilities; if that's what maintainers want, they can just ask for it. If the concern is cost, Anthropic offers a Claude for OSS program. The reason Anthropic isn't proactively sending patches is, I suspect, that those patches would not be welcomed, because trust in the models isn't currently at the point where maintainers are willing to merge them without human review, which takes approximately as much effort as writing the patches themselves. You can imagine the wailing and gnashing of teeth about "slop PRs" and "extractive contributions" that'd be all over HN.

> If the concern is cost, Anthropic offers a Claude for OSS program. thanks! It turns out that I am apparently qualifying for it and I was unaware lets see whether Anthropic agrees

I think the most obvious chicken little sign has been that we've had no catastrophic exploits in the past year due these findings. Sure LLMs have helped reduce the attack surface and we patch things faster too, but I was really expected a few more Supermarket-level bangers.

I don't understand, it seems like every week there is a new major breach. Multiple law firms have had unprecedented breaches, dev platforms, and companies of every kind. You name it, there's been a high profile breach. At the point I wonder if there is any information left secure honestly. These are not from glasswing, but they are from LLMs.

You can have a lot of vulnerabilities without necessarily having working exploits to them, so it matters if it's just a lot of vulnerabilities without a lot of exploits.

But we've had both. Soooo?

Assume the original message said "exploits" in place of "vulnerabilities". The point stands, independent of pedantic terminology corrections. The correction is valid. It would be better if people used the right term. It's ok to correct. But it would be better if it were in addition to discussion of the actual point, not instead of it. (And the phrase "catastrophic vulnerabilities" is pretty obviously talking about exploits anyway.)

$30M Raised to Redo the CPU (tendrils.co)

let's re-do the OS too. we only need about 10 syscalls. authorization is totally backwards (look how android runs a user per process).

How will this be better than RISC V?

Who do you expect to answer? It's a tiny future product announcement, it neither exists, nor is it a Show HN from someone involved

a man can dream

Was about time we had another Transmeta.

I always wonder where will x86 be in 10 or 20 years time. As data paths widen for SIMD, how many can they possibly cram even more generations of wider and wider groups of instruction with different opcodes and characteristics.

Do you remember the 1990s everlasting arguments about RISC vs CISC? There were so many arguments (online and magazines) saying that "soon" RISC would eat CISC. And yet, it never happened. I'll be dead before the demise of x86. More likely: The computing landscape will get more complex. Probably ARM will become a legitimate competitor to x86 outside of handheld computing, and RISC V will become a legitimate competitor to ARM for single board and handheld computing.

rVPN – stealth VPN with end-to-end encryption (rvpn.org)

On the contrary! The main market for this type of VPN is China, Russia, and Iran.

Sure, but why do you think they're marketed these services, who would it be valuable too... Most VPN companies are incredibly sus, outside of Mulvad they're mostly all incredibly suspicious imo. Western intelligence is desperate to enable the use of such tools in enemy territory so they can bombard enemy culture with American culture and make the populations eager to adopt American/Western customs and as a byproduct install leaders who are pro western ideology and less likely to be adversarial. VPNs when marketed to these countries should be seen as tools of propaganda dissemination l, in my opinion. The EFF will talk a big game about how this tech is about freedom of information, human rights and democracy.but really they're founded by a bunch of US Naval Research guys who are basically taksed with building the "cyber" infrastructure to ideologically invade adversial countries so they can be psychologically colonized. They then launder that mission with discussions about free speech and democracy. The original US Army's Psychological Operations Unit, was called the "Ghost Army" they used a patch with a ghost hovering over an implied target shooting electricity from its hands. https://upload.wikimedia.org/wikipedia/commons/7/75/Ghostarmypatch.jpg?utm_source=en.wikipedia.org&utm_campaign=parser&utm_content=thumbnail_unscaled The ghost on the patch is symbolic for beaming in signals into enemy territory to brainwash, intimidate and control an enemy population. The reason that China, Russia and Iran have nation state firewalls is because the US is so good at this, and the US wants to control any country who has any potential of competing with it. Its not because they hate freedom or something, its because anyone the US has deemed an economic or ideological opponent will be targeted in this way. We will beam signals through whatever means/protocol into a country to gain a psychological foothold in their culture, we will then convince them to kill their leaders and install US puppets. I routinely say that Starlink should make its logo the Ghost Army patch, because thats what it was built for. While it functions as a cool business, and does provide value, it was created as the ultimate propaganda dissemination tool (eventually atleast, it will be very hard to mitigate against if they can pull off some sort of cellular implementation of Starlink, which they're actively working towards). TOR and VPN companies attempted to serve this purpose, when this paradigm failed to be a general purpose tool for bypassing nation state firewalls they had to find another way so they helped Elon bootstrap a literal satallite constellation for this purpose. Its literally the Ghost in the sky waving its hand over a population with few ways to prevent its use. The VPN industry in China, Russia and Iran are weapons for this agenda.

WireGuard by itself is bare. Currently it don't have a "proper" ("official") way to make custom transport for it. Thus if you have to do it, the task is no different than writing a UDP proxy. But that UDP proxy is then an independent program, with no awareness on the states of the WireGuard instance, thus the proxy have to run in a very dumb/blind way. That's not ideal. If you want to write a network proxy, it's the best for the proxy to know as much user intent as possible, so for example it knows which request should be retried, which should be given up as fast as possible if encountered a fault, and which request should just be rerouted to another server, etc.

Why is it best for the proxy to "know as much user intent as possible"? You can ge that with WireGuard either way, but it's not at all clear to me that's true. We ran a rather huge deployment of WebSockets-encapsulated WireGuard, and I believe Tailscale has as well, and the fact that WireGuard was oblivious to it caused no problems I'm aware of.

IIUC the parent's point is that if you first have to unwrap incoming, say, HTTPS traffic to obtain the Wireguard UDP packets, that unwrapping code might contain vulnerabilities, so an attack compromising the machine Wireguard is running on might occur before the packets ever reach the Wireguard implementation. From where I stand that's a somewhat academic scenario, though. (Unwrapping correctly & safely is usually not that difficult. Just don't use a memory-unsafe language for parsing & unpacking maybe.)

I address that at length 2 comments back.

That's also the cost of providing convenience AND something that can open port 443

Convenient for the author, sure. Most operating systems have a way of installing packages as the administrative user without piping random scripts from the internet into sudo bash, I suspect most users already know and may even like their operating system's method for installing software.

Apple has new Mac app coming to make running local AI models easy (9to5mac.com)

After I think about it, this makes sense that Claris would tackle such a project under the auspices of Apple. They're a subsidiary so they can monkey around with this stuff without having to adhere to the draconian everyday operating restrictions of "Apple proper". Good on them if they can pivot into something that hews to AI.

Four year old hardware has almost zero value.

Tell that to the 3090s still selling at $1500 how many years after manufacture, used?

It was pretty fast to get it set up. It could be better for sure, as it's not a first class concept the same way that it is in linux, but an hour of google search ai mode will get you where you need to go.

I know you can set it up to make it seem to work, but from what I’ve seen people say over and over, it will eventually end up asking you some question through a dialog box. And you will have no idea that’s going on other than all work stops. And the machine seems locked up or something until you connect a display and find out it wants you to click OK. It SHOULD be totally possible. But it fights you.

How so?

MacOS is a desktop OS. You really REALLY need to treat it like one. Lots of things pop up and can’t be dismissed any other way than though mouse/keyboard on the display. OS updated and wants to tell you it worked? No command line way to get rid of that. Program wants to do something and one of those system security prompts pops up (“BBEdit wants to access your Documents folder”)? Same problem. You can set it to auto login and auto update and grant permissions and everything. And then, one day, it will stop responding and you’ll have to hook it up and log in to see some pointless dialog that just wanted someone to click “OK”. And until you do no work gets done.

I think the question to me is whether Apple can ship affordable consumer devices with enough memory to run sufficiently useful models sufficiently fast. Right now 128GB MacBook is the top of the line and you could do Qwen 3.8 Flash or similar. There is a rumor that the M7 chip can use 1.5TB of memory which would imply Apple is aiming for more memory on devices.[1] Would that imply the entry-level MacBook will have 128GB and top of the line models could run larger reasoning models? Then the question is price and if any of this will translate to iPhone for on-phone models. With how expensive memory is, IDK if they can pull this off but I hope they do [1] https://www.tomshardware.com/tech-industry/semiconductors/apples-rumored-m7-ultra-targets-1-5tb-of-memory-and-blackwell-class-ai

I'm on 128gb Mac and Laguna2.1 is able to do 800tps coding as good at Sonnet 4.5 or Opus 4. It's awesome.

No but they can pay for new manufacturing to be built. 2-3 lead time should be enough to bankroll the effort. Apple has to much money too sit around hoping that memory situation resolves itself. They were caught flat footed by the RAM market.

In-house the market has changed, the conditions have changed, the price has changed the only way around this problem is to design and engineer around it in-house. The design and engineering capability isn’t the problem, money isn’t the problem. It’s whether or not the new CEO/Apple have the will to do what’s necessary. That’s pretty much the bottom line… they have done it before (Intel/Qualcomm), and they now have to do it again.

In-house, Apple has no fab. They have labs , but manufacturing memory would make them critically reliant on an expensive fab partner, probably driving them back to be an Intel customer again.

Are you suggesting that they knew there would be an extreme increase in RAM prices and did nothing because paying more would help their margin?

not exactly. I mean they saw increasing ram prices + they knew their demand. They did almost nothing for what months and year or more now? Lack of actions cost us a lot more than apple probably. They are happy to sell at few times more expensive ram, but here I'm thinking they could have great edge, they wasted it with all cash in hand.

Man, if all that makes Apple a "winner" then I'm dying to hear your assessment of Nvidia. Factoring in the increased cost of memory, Apple's threatened service revenue and the stagnation of ecosystem products like the Mac and iPad, I think they have a really challenging future to navigate. The whole "sell people a B2C ecosystem" business model is more threatened than ever.

The design and engineering of memory is not more difficult than replacing Intel and Qualcomm, Apple certainly has the money, and they certainly have the engineering talent within the Apple Silicon design group. It took 13 years to replace Intel and six years to replace Qualcomm who has already warned their investors that they anticipate losing revenue in the near future. The question is whether or not they have the will to do so, money and engineering ability isn’t the problem, it is simply a matter of will. With CMXT coming online bigger and stronger. I don’t think there will be a choice long-term for Apple the conditions of the market have changed, and you have to change with it or get left by the wayside. They have shown that they will adapt and they certainly haven’t wasted money like their tech competition over the years.

Yeah, what apple have frequently got right is the actual product/UX. Capability is one thing but a focus on the actual product, as an teleological destination that is built rather than something cobbled together as a solution to a problem about how to sell what you have generally has taken them the right way.

For all of those accolades, the Mac is still a minority player in every computer market. They're especially a non-entity in on-prem enterprise buildouts and datacenter construction, which is where the money is going right now. It's nice to have these types of niches when they make you money. But the Mac isn't profitable like the iPhone is, and probably makes less money than the iPad does if you count aftermarket service sales. The further Apple drifts from their roots as a computer manufacturer, the more the Mac starts to look like a liability to them. Apple's Last Stand is their prosumer segment, and once that's gone I don't think their vertical integration playbook gets them anywhere further. Their bottom line is dependent on finding new ways to make B2C profitable, which has resulted in subscription services like AppleTV/Apple Music/iCloud so far.

Scion is back and is going to sell a kei truck in America (theautopian.com)

Needs a manual transmission and 4wd like the old Honda Acty

hi

This is super cool. But for better or worse I have an instant aversion to short punchy sentences because they read like AI whether they are or not, e.g. "The T4X by the numbers, from the lineup brief. Stock is the base build; Ransom is the off-road package, available at launch."

> $25, refundable. A place in line, not an order. Yeah, it’s a safe bet.

My family (consisting of truck buyers in middle america) is generally going to balk at anything shorter than an 8 foot bed. That's the standard length for most building materials. Lumber, drywall, sheetrock, you name it. Conduit and pipe tend to come in 10 ft lengths, which only hang out the back of an 8 ft bed a little, but are a real touch-and-go experience with shorter beds. If a manufacturer doesn't offer an 8 ft bed, what they're selling probably isn't a work truck.

I wouldn't get it if I were, say, a drywall installer, but my Maverick worked perfectly well for supplies for refinishing part of my basement. 4x8 sheets fit flat on top of the wheel arches with the tailgate half down. 10 ft pipes I can put through the rear window... would be nice if some short-bed trucks came with bed access like the Chevy Avalanche.

Honestly an 8ft bed is a luxury. Most building material moves fine in a short bed. Pipe rack or a trailer if you are really needing that stuff on the daily. A lot easier to unload the trailer for any significant load.

Haven't done the math, but the era of Ranger that comment spoke of would be much smaller than the Ranger sold today. Think more like the old Chevy S10, or the upcoming Slate truck. Not quite kei, but getting there.

> Not quite kei, but getting there. From a US perspective I guess. Here in NZ, the 2011 Ford Ranger was already amongst the largest and tallest vehicles on the road (excluding actual trucks and buses of course).

> How much soil can a Kei truck handle with a 600lb payload. Probably about 600 lbs of soil. Nobody in the city is going to “farm supply stores”, whatever those are. If you live on a gigantic lot out in the boonies then by all means take your gigantic lifted dodge ram

> Probably about 600 lbs of soil. Nobody in the city is going to “farm supply stores”, whatever those are. Eh I live in the city and last time I had 1200lb of mulch delivered it came from a depot like 10 minutes away, also in the city. Could have saved $100 by picking it up myself.

( cries in NA mx5 )

NA Miata here in pickup truck heartland. Any other vehicle can kill you, even a Camry seems gargantuan. Just gotta drive smart and defensively. That said I’m more worried about no airbag and no roof protection way more than the type of cars around me. Gotta treat it like a 4 wheeled motorcycle.

You aren't getting honked at because you are going too slow, you are getting honked at because you are blocking the lane with your bike.

how are they blocking when they are going 28 in a 25. Speed limits exist for a reason.

Unless it’s a blind curve then it takes no time to adjust to the conditions on your own And it comes naturally. I say this as someone that just drives as fast as I want and don’t usually attempt to adhere to any posted sign. In cases there is a sharp/blind curve that’s when I see they usually just use the curve arrow sign to warn me and so I know to pay a bit more attention and make sure I am ready and able to adjust my speed if actually needed. I almost never adjust just because I see a sign.

It tends to be more economical to adjust in advance so that you don't have to use non-regen brakes. (Or any brakes, in a pure ICE.)

Speed limit cameras are highly effective at slowing cars down. They were recently removed in Ontario, and the average road speed increased substantially. The pedestrian death counts spiked in both Toronto and Ottawa this year. This is likely not a coincidence.

What also works without needing a huge bureaucracy and fining people regularly is electronic speed detectors that display your speed and flash at you when you're going above the speed limit.

Starlink Mini 2 (starlink.com)

They should totally sell a foldable solar panel for the ultimate offgrid set-it-and-forget-it internet solution.

Insufficiently spacex. It should have an RTG.

Would be a great product.. if only Elon would not be involved..

Must we do the tribal political affiliation signalling on every HN post that vaguely involves Elon Musk? We're left wing. Elon's right wing. We've got our knickers in a twist because an influential person dares to have a worldview different from our own. But must we broadcast this? Every time?

> I fucking hate Musk, I didn't use to Yeah no shit. You started hating him when you learned that he voted differently than you lol

Voted differently? No idea who he votes for. Perhaps it had more to do with, erm, you know, his history of attacking people, mistreating workers, spreading misinformation, promoting far-right conspiracy theories, misleading investors, and using his power to interfere in politics and even international conflicts ... And that's just clearing my throat ... horse trading? disowned by his own children? comments by his ex-wives, the list is endless, actually ... The guy's evidentially a twat. Fool you once, shame on him, fool you 25,429 times ... shame on you.

The level of intervention you're proposing is unironically fascistic as well. You're explicitly suggesting something the very thing you're implicitly accusing Musk of.

Accusing? Confirmed.

This has completely changed my industry (hard rock mining). A lot of the time drillers would be in the middle of nowhere looking for resources and would be sometimes days away from providing results (which also lead to lots of dodgy situations where drillers would know some results before market…) now it’s instant live feed. It’s made revising drilling plans trivial. Very cool

did your industry not have access to satellite radio/internet prior to this for some reason? I was working on "cloud connectivity for remote mining sites" at least twelve years ago, and we were late to enter the market.

A decade ago, you’d be looking at 2mbps under good conditions, significant outages and reliability issues, and paying $50 to $100 per gigabyte.

> how do you guarantee that Starlink doesn't turn to crap after it is nationalized How do you guarantee that Starlink doesn't turn to crap if you don't nationalize it? Its a silly question. Governments have successfully operated various telecommunication systems for a long time. Lots of modern telecommunications and sat tech comes out of the government. But this will depend on each countries experience. I think one can make a solid argument that the denationalization of telco systems in the 90s was a mistake. Same goes for the breakup of AT&T. The better option would have been to just nationalize the baby bells. And make AT&T focus on long distance competition and the technology. Maybe also nationalize Bell Labs and keep it operating financed from a the income of the Baby Bells. Because what actually happened is that these Baby Bells simply got massive monopolies, made gigantic profits and were then able to do lots of other infrastructure plays and then mostly glob back together. > take it "because its so vital to national security". I think for that you don't need to take it. If you take (forced sale) it, it would be because you want to provide universal access subsidized without lining Musk pockets even more. But you would need a real long term vision for this to be worth it. > Furthermore why can't someone just copy them? Drop a ton of money on poaching their engineers and just copy whatever the government needs? Because the system is already built and working, why spend the capital on building the same thing again. For me some kind of open access law would make more then nationalization. But the suggestion to nationalize isn't crazy.

> …without lining Musk pockets even more. I just can’t fathom the logic here. You say that you don’t want to line Musk’s pockets, but seizing SpaceX/Starlink would cost a trillion dollars or more and all of that money would go to Elon Musk! The government would have to issue a trillion dollars of bonds, agreeing to pay interest on them for decades, and then hand all of the money over to Elon Musk who then doesn’t have to pay that interest. You’re deluding yourself to think that it’s even feasible. And it’s also a bad idea just on general principles. I agree that the breakup of AT&T was a mistake though.

You’re conflating “buying” with “seizing.”

Man, I literally just set up my Starlink Mini about 2 hours ago.

That tells me it’s still within the return window

The specs say Mini 2 works with a 60W power brick. Mini 1 requires a 100W source. So at the very least, the peak draw is better.

Mini 1 absolutely does not require 100W. I used mine off a 60W battery just fine and as others mentioned, it's ~45W during startup and more like 25 average during normal use. I think the reason it states 100 is that it also has a heater built in. It is supposed to turn on when the top surface gets covered by snow or ice to melt it.

That's awesome, imagine taking it with you on a Cruise

It's against TOS. Cunard (Carnival) confiscated mine until the end of the voyage, made me buy their package.

Synaptics patent claims stop work on DisplayLink drivers (lwn.net)

No more messing with weird broken drivers but now there's often messing around with weird (and sometimes broken) cables. Some of us have boxes full of USB-C cables that we have no idea what they do.

Threw all mine out, replaced them with USB4 + 240W PD. Standard for USB4 requires minimum 20Gbps speed, protocol tunneling, backwards compatibility. The 240W PD is not standard, but you can find USB4 cables with it, and that guarantees all the previous PD standards. So it's a universal cable. Bought a couple chargers too, from 60W-140W, and a desktop multi-port charger that does combined 400W+. My USB4 dock gets power from that and plugs into whatever laptop.

What do you mean? Pretty much everyone at the two places I work at connect 2 monitors to their laptops. Who works using their laptop screen when at their desk?!

...(it's me, i work on my laptop screen at my desk)

"You've imposed costs on us, because of all the effort we had to go to to show that you've imposed costs on us" ??

The bureaucracy is expanding to meet the needs of the expanding bureaucracy

There is no "fair-use", non-commercial, or even personal-use exception to patent law. Code is speech, but the 1st amendment has recognized exceptions for IP.

That's not quite true. While there's no exemption for personal use, patented inventions can still be used for academic and research purposes. Even if you derive income from that. E.g. it's a fair game to write and release a book: "How to Replicate DisplayLink" that would walk the reader through the steps in implementing it.

Because a patent is a description of an invention. A computer program (like a driver) is also a description of some algorithm. This is not a metaphor. It is definitionally exactly true. Saying it's protected by a patent is like saying an engineering book is protected by a patent (in fact, you can print a program in... a book, and there are many programs contained in books). It's not only false, but would go against the entire purpose of a patent, which is to publish a description of the invention.

A computer program being "a description" or being published does not preclude it from violating a patent. Perhaps you disagree with this, but this is the current state.

It does because patents don't cover descriptions of inventions. They cover inventions. Words in a book aren't the right "type" to be able to infringe on a patent, but they can be a computer program. You yourself linked to a case limiting even the ability to claim that running a computer program on a computer can be patented. The program itself was never patentable.

Right, software itself not patentable, only inventions. That is completely unrelated to the question as to whether software can violate a patent. If you write software that implements an invention that is patented, you have violated the patent.

And they're right, most law is practiced outside of a courtroom. And essentially all civil disputes start outside of them. The vast majority of professional lawyers do not litigate at all.

Id already said civil disputes start outside the court room. What I’m saying is that not all UK law works on the basis of accusations without evidence, like the GP argued. Take this specific example, UK civil law does say the initial communication doesn’t have to include the patent numbers. However it does go on to say that if threats are then made then that information should be disclosed https://www.gov.uk/guidance/the-patent-act-1977/section-70b-permitted-communications If Synaptic require multiple weeks of work at $25,000 a week, to establish what patents are infringed, while also threatening to charge the developer for that time as well as further legal action, then it’s safe to assume that Synaptic didnt have enough confidence from the outset that their original claim was reasonably true. In short, they are opening themselves up to litigation in return. But since their legal budget is vastly greater than this solo dev’s legal budget would be, they can skirt the fridges of what would be reasonable permitted communications. BI doubt many UK judges would take favourable view with how Synaptics have handled their correspondence; if this ever were to reach the courts.

That is fair, I think what the above point was that formal technicalities matter only in so much as someone has the means and motivations to go to trial, which is rarely.

Which is why I likened the process to a protection racket. :) A comment that the GPs you’re defending was objecting to

Trade secrets aren't protected by law. That's why they aren't disclosed. If someone lawfully reverse engineers your trade secret, its secrecy disappears without legal recourse. Decompiling a binary for RE interop purposes is legal in the US.

That is a common misconception, but trade secrets are absolutely protected by law, in most countries around the world. https://www.wipo.int/en/web/trade-secrets#systems

I think this is a great idea. My only concern is, what if some well-meaning person puts in a poorly constructed claim, and then that creates a counterproductive precedent. I think ideally, someone like Software Freedom Conservancy or the Linux Foundation or the FSF or whoever would take charge of doing it, taking advice from patent attorneys in the process. Maybe there is some UK patent attorney reading this who is willing to take it on pro bono ?

A bit pedantic (since my wife is in IP), but you don't need a patent attorney for most patent things, you just need a patent agent. (Who may also be an attorney.) Non-attorney patent agents can handle basically everything related to patents other than litigation.

Show HN: Get your coding agent off ~2019 JavaScript, onto modern web primitives (github.com/GoogleChrome)

Is there a similar project for React? There are so much bad React code and wrong/old design patterns on the internet that surely ended in the training datasets

Yes, it's "Never use React". Simple https://infrequently.org/2024/11/if-not-react-then-what/

Why was 'fetchLater' chosen over a reliable way to trigger fetch from 'unload' or a similar event, or inversely, adding a 'sendLater' option to sendBeacon? Feels like a bolted-on API for a very specific use case, when the same thing could be built from better primitives? It's a bit sad that browsers now have two different, "standard" APIs created entirely for the purpose of user tracking, as if things weren't already bloated enough.

These exact questions came up (from Apple) during design review. If you're interested you can read the discussion here: https://github.com/WebKit/standards-positions/issues/85#issuecomment-1360046180

Spot-on amazing linking exactly to the relevant discussion. I’m really glad to see this not evolve into a flame war as well.

Amazing! I'm just writing an article about how Alex Russell's quote about 'React being a legacy technology' got, unfortunately, totally ignored. And now this just fell in my lap! Some of the arguments I wanted to make seem to be provide here. Didn't have a chance to take a proper look at it, but it looks very promising and nice! Thank you!

I'm not sure that's just a quote. He's written and said tens of thousands of words on the topic!