Freak_NL

Shopping online beyond the national borders is a fraction of all shopping done online, and when it is done, people gravitate to big platforms like Amazon or Steam.

What Wero will do, is allow a German citizen to order stuff in a German shop, and an Italian citizen to order stuff in an Italian shop first and foremost. After that, it will allow them to pay for stuff on Vinted (people already buy second hand clothes across borders this way!) or Steam.

It will also make buying stuff in different European countries easier, but that is only a tiny percentage. The winners here are citizens being able to shop around further, and shops with dedicated national versions of their store to sell stuff easily to citizens in whichever country they decide to port their shop to (in addition to simply serving those who are fine with their shop in English or another language).

If you only know credit cards, you won't see the benefit, but Europe is predominantly a place of debit cards and local payment methods.

I'm sure that will work for a while, but that doesn't solve the problem of that banking app sitting on an unpatched OS.

The Dutch do nothing but use Ideal, Wero's predecessor, for online purchases. People very much want to simply transfer money from their bank to a shop, just as they can with a debit card. Most Wero transfers will be to shops in your own country, but don't underestimate its potential. Valve offers Ideal on Steam, and has done so for years now, and they can probably give some very appealing insights into how that unlocked a massive amount of gamers in the Netherlands.

If Wero becomes the pan-european solution for online payments it is slated to become, then no European bank will be exempt from this. Given that as a European your government covers up to €100,000 placed at any European bank in case that bank goes tits-up, you are likely to end with a European bank in any case.

Something which in the context of a thread about banking apps seems quite relevant too.

It's not hard to just move your savings. A lot of people do that actually; just keep the standard banking account for daily payments and all other services, and put savings in bank-managed ETFs, time deposits, or savings accounts with other banks (I do all three).

Not an option if all banks follow suit. If this trend continues you would only switch to a bank who hasn't yet locked down their app yet.

Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.

Just a heads-up from a fellow Pixel 6 owner: it has reached end-of-life last month, because the five years since the launch in October 2021 are up. Better start looking for a replacement soon.

Not quite true. All banks really want you to use their app, and the neobanks actually demand it (and get away with it because they are not as important as the so-called system banks).

But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.

ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.

Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.

The response from EPI/Wero in that thread is troubling:

https://github.com/PrivSec-dev/banking-apps-compat-report/is...

I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.

I recognise that. I've never been one to install many apps, so mine feels the same. Snappy and modern.

Pixel 10 pro and 10a seem to be available for decent prices. Those are the newest GrapheneOS supports (Pixel 11 is not supported due to Google not supplying them with the MTE security feature), so one of those is a likely successor. At least these will be supported until August 2032 (10 pro) and February 2023 (10a).

Motorola's new phone is interesting too, but probably won't offer me much over the Pixel 10 pro.

Reading this makes me realise my Pixel 6 has reached end-of-life in terms of support. I guess that means shopping around for a new smartphone…

(I hate this. This Pixel 6 works fine. But the end is in sight nonetheless.)

I'm glad GrapheneOS exists, so my next device will be this or another Pixel. At least the next one should last two years longer.

Do you have kids? I can assure you that children are quite good at automatically blocking out everything related to intercourse and other sexual acts until they reach puberty. Like an advertisement for mortgages, they will just treat it as something that is probably relevant to adults, but not at all interesting to them.

Seeing some girl getting ploughed by a slab of a guy might raise questions (which is excellent, questions are always good, because then you as a parent can guide their understanding), but it won't harm them in the slightest.

Repeated exposure to porn is a problem, but that comes from teenagers having an intrinsic interest in sex and private exploration of unsavoury websites on the internet, not accidental viewing of a naughty billboard.

Are a few clips or screenshots shown on billboards going to influence people to that extent?

If the goal is to get companies to get their security in order, than showing porn is certainly one of the most effective ways. It'll put political pressure on the company that owns the billboards, for one.

Show a cute picture of Big Bird telling people to eat more pizza, and the company will just reset some passwords. Show a couple of choice scenes from Brazzers and the CEO just got a call from a government minister and suddenly the leaky hardware is getting replaced at breakneck speeds.

Works well too if the goal is just to get people to object to digital billboards.

Which is a valid fallback, but only with lower speeds. If someone made the call to go manual and continue at speeds over 30 km/h…

You don't even have to do it before you have children. You can wait until they are six or so and have the autonomy to pick what they want to watch (under your guidance). For children younger than that, you pick what they watch and when they watch it. Every time.

Do start hoarding the better shows and series you know.

Yeah, the Dutch banks really fucked us over by putting the bank code in the IBAN, so IBANs can't be moved to another bank.

I started reading on the assumption it was posted here because it was interesting, but this paragraph cinched it:

> 1. You finished your last three rewarded ads. Every time a rewarded ad starts, the rule pushes false onto a list and keeps the latest three (lines 174–183). If the ad SDK reports that the reward was earned, it flips that entry to true (191–199). The check needs all three to be exactly true:

Pointlessly spun out prose. Pointless headers everywhere. Pointless lists. Yes, we understand what a list of booleans is, and that the game looks for a state where the last three are true. No need to spell it out like that.

Why do people post crap like this? Why do people post it to Hacker News? There is some merit to dissecting an attention sink ad-driven game, but this article just makes me feel like my attempt to grasp the meaning and writer's views fails every time — like I'm trying to grasp stalks of grain in a field, but my hand keeps passing through them as if they were holograms.

I would very much like to read people's thoughts with a forbearance for awkward prose, bad spelling, or suboptimal outlining, instead of that I get rewarded by text where the human who prompted it is suddenly absent.

Fuck this new AI world.

Anyone looking to get into single player Quake should grab an engine like IronWail and just go through all three Brutalist Jams. These are essentially map packs with contributions from various mappers, linked by a museum like base map (as many jams do). Each successive Brutalist Jam pushes the boundaries of what a thirty year old base game can still do.

Log4Shell required that the attacker be able to generate a log message containing specific parameters. It was a severe exploit, but not one that worked in every Java application with the affected Log4j versions. Attackers had to find calls that logged user submitted text or query paths first. So the list of prerequisites was larger: had to be using Log4j and had to have logging of user generated text.

Still a very large attack surface, but not nearly as ubiquitous as this one.

Nope. The basic rule is that you don't do things with wolves you shouldn't do (like feeding them and thus gradually letting them get comfortable around humans), and that you don't do boneheaded shit like leaving a small child alone in nature (which is common sense in most of the world). For a wolf a three year old child is just about the same as a boar or small deer.

Anyone over the age of 12 though? Wolves won't bother you unless you've managed to fuck up nature to such an extent that they can't find their usual diet (deer, boar, etc.), and even then attacking an adult is really desperate.

There was an interesting interview with an Italian expert about wolves and people in the news this week:

https://www.nrc.nl/nieuws/2026/10/15/we-zullen-moeten-wennen...

Scroll down to where they do that under Spatial Efficient.

Iosevka is more of a parfois-serif I guess.

I have no idea why they chose 'ligation' instead of just ligature, but it was jarring every time I encountered it.

I was wondering why it did that. This is really the kind of site where this is not a feature you should use.

NEVER run out of improvements to be made. Rule number one of getting audited.

Always leave an obvious-once-you-see-it, but minor, defect somewhere for the auditor to latch on to. One they can earmark for you to come up with a plan to address the issue before they grant you the certificate (and which you'll be able to write up in no time because you planned for it).

A good auditor and a company actually taking this stuff seriously can benefit from 27001. That probably accounts for 5% of all 27001 certifications out there.

If you're lucky you get an auditor who's just there along for the ride towards early retirement in a few years, and who'll joke with you and eat your lunch. Had one of those once. Doesn't help your security one bit of course, but it makes audit time more relaxed.

ISO 27001 means they have processes in place that proof that risks are monitored and continuous improvements are being made. ISO 27001 means they have policies, and can show those policies to the auditor.

Never assume that having that certification means that shit is actually secure. It just means the company can do the audit dance.

* Fridges are welcome to send a panic message.

* Fridges are read-only through their remote interface.

Both of these can be true if you must connect them to the internet.

Tongue-in-cheek, but my Moccamaster which I bought second-hand is still doing great after 15 years. Two deep cleaning sessions in all that time and just running it with vinegar a couple of times a year seems to be all it needs.

The device is dead simple. No advanced electronics. Nothing complex that can break. Just a coffee maker fine-tuned to near perfection.

The only flaw it has is the handle for the pot. I've resorted to replacing the plastic handle with a fancy walnut one I made myself. I needed that because we tilt the pot sideways to fill the reservoir with water (because of the placement on the kitchen counter and the cabinets above), and that plastic handle is not designed for sideways stresses.