HNHacker News
TopNewBestAskShowJobs

Shank

13,626 karma · joined January 21, 2012

[ my public key: https://keybase.io/xn; my proof: https://keybase.io/xn/sigs/_19m8p1WLiV4VtmOeX3cnoDL1Itgf1PMn9WNs9hx6bA ]

argo@fluctlight.net

security person :)

submissionscomments
Shank··on Cuba is skipping its November 1, 2026 clock change and staying on DST until 2027
I guess you found me! I like it. No change is better than changing any arbitrary time.
Shank··on iPhone Duo Teardown
> For the foldable market to triple in size, Apple would need to sell 40m this year

For the record, it seems like the production will not get close to 40m phones this year. According to most outlets, it is backordered to January and Apple had to ramp production higher than anticipated. I highly doubt that it will literally 3x the market this year. But the pattern has been, excepting the Vision Pro, that when Apple enters a market, it suddenly proves the viability to other market entrants, and to the general public who view it as a mature market.

> but the original caveats are pretty much all still there

I don't think this is true at all. A significant portion of people complain about the crease, light reflections, and poor software. It seems like initial reviews don't find problems due to the "nano-texture" display (probably achievable in third-parties with a matte screen protector). As for software, once apps have been optimized for Duo, I expect that designs will carry over to similar form-factor folding devices on Android.

Shank··on iPhone Duo Teardown
I feel like the average tech enthusiast just assumes that most people have computers, but they do not. Most people have a phone as a primary computing device. Tablets have gone up in popularity, but for a significant portion of people, their only device is a phone. Those people are buying phones on carrier financing or other deals, so they don't even see the full cost of their device at all. So for people doing this type of upgrade cycle, a folding phone is quite compelling: an expanded screen size for watching video, consuming content, or heck, even maybe productivity, while being effectively a marginal upgrade in cost on a monthly payment.

Also, just for the record, some carriers in Japan are offering financing that gives you the option of paying over 48 months and Apple offers 36 months. Is that quite absurd to most people? Absolutely, but for the average person who wants a bigger screen sometimes, the cost is not even going up much on a monthly basis.

For the record, especially in Japan, folio cases where you open your phone like a book are already the default. Effectively most people on the train have their phone open in some "Duo-ish" form-factor already. So the jump from a folio case to a folding phone is already substantially lower.

Obviously the gimmick nature of folding is not the compelling reason why people want folding phones. The question is more about tradeoffs, and I think that especially in asia, the demand for folding phones is quite obvious: upgrade your primary PC to have a huge display when you want it that way, otherwise it stays compact enough to be with you all the time.

Shank··on iPhone Duo Teardown
> I think the main thing is that for this kind of money you have a lot of options. You could even buy a GPD device that is an actual full blown pouch sized laptop and buy a regular iPhone for the same price.

I have done this! I currently carry a GPD Win Max 2 around, but let me be clear about some elements of this: the keyboard on a sub-device is just as important as any other, and the keyboard on GPD devices is not great. A sub-device has to be maintained and charged and given love and care just the same as any other device. The amount of times I have found my cute linux laptop dead when I wanted it, outdated, or randomly signed out of services is quite high (and this is with an onboard LTE modem). Carrying around a folding (or even non-folding, like a Magic Keyboard) is lighter than a sub-device, will last significantly longer in terms of charge/battery, and does not require any of the secondary device maintenance that is needed with one normally.

To me a folding phone is an absolute no-brainer in terms of why it is useful. You can get a very, very good keyboard for cheap, or try many, and completely eliminate the need to carry a second device.

Another huge use case I have is transit/travel video playback. I do not normally want to bring an iPad or even a secondary laptop during travel, so this effectively deletes one more device that I have to charge, update, bring adapters for, etc. It is effectively all of the benefit of having a tablet at all times, a sub-laptop at all times, and requires absolutely no additional charging or maintenance.

Shank··on Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown
> That should be enough. If users don't read that's on them.

The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.

Shank··on Today's PHP security release, and how we're strengthening security
This one is just a virtual address that forwards directly to you: https://lp.da.pf.japanpost.jp/
Shank··on PHP 8.2.35
You should follow the NSA's advice or the Prime Minister of Japan's advice and take the service offline: https://x.com/NSACyber/status/2112903220209098897
Shank··on PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out
I really do not think anyone should trust a vibe coded repo that launched 1 minute ago as a viable defense for any service.
Shank··on Security advisory: Critical remote code execution vulnerabilities, update now
This is notable enough that the prime minister of Japan has tweeted about it: https://x.com/takaichi_sanae/status/2112890642590564386
Shank··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Major Japanese services like pixiv and e-commerce platforms have elected to turn off services until patches are available. If you're smaller than pixiv, you can afford to go down for a few hours.
Shank··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
I would hazard a guess that Wordpress VIP and Wikipedia were given advance access to patches? These are the biggest users of PHP after all.
Shank··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Honestly, kindarails2shell resulted in a responsible disclosure coordination followed by the decision to release early since it was reversed too quickly. Even just a hint of a 0-day is enough to cause people to look for it and exploit it with LLMs.
Shank··on Show HN: Death Plan Switch, a self-hosted dead man's switch for solo devs
This is an area of planning known as "business continuity planning" and as part of this process, you should have a document and written procedures that are executed by humans, not computers, and tested as part of this. For example, your BCP should include people who are already trusted and know how your infrastructure works, and you should do a dress rehearsal on a yearly basis at least. A notification tool is one thing, but realistically this should be just one of your tools.
Shank··on Plex vulnerabilities being exploited in the wild to drop a cryptominer
I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.
Shank··on NY announces game ownership bill requiring ownership rather than licensing
> I had the opinion that it'd be too expensive for developers to support offline mode, peer to peer, or community servers after shutdown

It’s never like the server becomes lost media when they shut down services. Most development studios have an easy way to run the server stack locally for development anyway. The problem is forcing someone to actually spend several hours doing packaging to get it deployable and the general reluctance of companies to “lose control” of what they have. There are many alternate servers that have existed that developers have intentionally axed like AlterIWNet because of control reasons, not because the complete solution already existed.

Shank··on Wanted to download an ISO, ended up writing a kernel exploit
> The connection was a bit janky, a video would occasionally start buffering, but it didn't bother me much.

This is truly bonkers! Please, if you buy hardware that does not work correctly from day 1, return it. If you do not vote with your wallet these companies will never learn and will never adjust their practices. Rewarding TP-Link by keeping their terrible hardware does nothing.

> I contacted support in June because the website only had firmware for v2. They couldn't find v1 in their database and asked for photos of the device and box

!!

Shank··on Making big downloads resumable in Firefox
You can use aria2c --load-cookies and specify the path to your browser's cookies.
Shank··on Hackers activate automatic defrosting accross European supermarket fridges
> It's not immediately obvious to me why fridges in supermarkets need remote control

I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.

Again, though, I don’t know about making changes though.

Shank··on Ledger confirms spy chip implant behind wallet crypto thefts
PCBWay will make anything you send them for reasonable pricing. Custom boards etc are not at all hard to manufacture, and for the amount of money you can get, of course you can team up with someone. I think the most people overestimate the cost of bespoke PCB creation.
Shank··on Tell HN: GitHub refuses to remove cracked copies of my software after a month
Most state bar associations have a free consultation line that will refer you to a reputable lawyer to start with and do basic consultation on where your issue should go and how much it will be. If I had to guess, getting advice is probably $100 and having a lawyer send a letter is $250-500.
Shank··on Decisions API is in public beta
Well, Jev doesn't meet any real compliance requirements but OpenAI's models do. So even if Jev is faster, any customers with compliance needs will obviously pick OpenAI because they can't pick Jev out of necessity.
Shank··on Turn off Apple Intelligence on macOS 27 and get its disk space back
This is simply not true. Things like "writing tools" were moved out of the global siri checkbox and enabled by default, and now require you to use screen time content restrictions or modify settings in individual apps to turn off these features.
Shank··on macOS Golden Gate Is a Buggy Mess
That's very interesting, because I don't have Zoom installed. I wonder if it is an OS prompt or something that isn't being rendered?
Shank··on America.gov
I like the voice button that isn't actually a button, but just an icon.
Shank··on macOS Golden Gate Is a Buggy Mess
I've had a random annoying bug where a mysterious window with no controls and no menu bar presence appears on top of all of my apps with seemingly no origin, rhyme, or reason, and I can't do anything to get rid of it except restart. It looks suspiciously like one of the "do you want to allow this accessory to connect" dialog boxes but it doesn't have any text. It's really mystifying.

I hoped this update would've made my Mac more stable from the last release, and while maybe the performance is better, I feel like issues like this do randomly occur.

Shank··on The problem is not AI code, but not knowing about system architecture or intent
I mean, the content doesn't look AI generated. I couldn't care less if someone AI generates their blog template, the rest of the content seems meaningful.
Shank··on Coding is not solved
I'm absolutely saying that AI has sped up the porting and rewrite process! It is amazing! But the reality is that rewriting has been part of programming culture since time immemorial. People want to rewrite for performance or for other reasons all the time, and the cost is now relatively low (i.e., now it's an opex line item in cash instead of time investment). But that doesn't mean that all of coding has been solved.

For example, any amount of software development involves fixing bugs, getting feedback from users on ideal workflows, an iteration loop of performance and bug tuning, etc. AI cannot simply create, from scratch, perfect software. Even using the SOTA models on max effort does not produce bug free software of any meaningful complexity or innovation out of the box. All that has changed is that the act of physically writing code and implementing existing patterns is now effectively a marginal cost.

Most line of business software is not e.g., delivering a company's income. Most software is in back-of-the-house internal products that do various internal tasks. I have no doubt that these processes are now far easier to build.

If the new Copilot is so great, why is it completely out of the current zeitgeist when compared to Codex and Claude Code?

Shank··on Coding is not solved
Porting a system to rust without changing the observable behavior is not that difficult with AI, and porting to a more strict language is not that remarkable. I have a tough time understanding why people equate straight shot porting where a test suite already functionally documents the behavior or where the prior application can be used as an oracle with success in all coding tasks. I would be far more impressed if someone did a clean room implementation of all of GitHub Copilot, from scratch, and got to a better point than the TypeScript or port codebase.

I have no doubt that if you provide any AI system with an oracle with expected behavior that it can match that oracle with some amount of $ and tokens. I haven't seen any demonstration of anything else. Rewriting a codebase was always a challenge for humans not because of complexity, but because of the time and effort involved in matching the old version's prior behavior. It doesn't have anything to do with the serious level of work required to build something truly new from scratch in a performant way.

Shank··on SpaceX's Starship launching to orbit for first time ever today
I think there are so many more mission objectives for success, e.g., still in payload deploy. I think we've already reached a lot of milestones with this launch, but there's still a lot of satellites to go at the time of writing. I'm so used to these failing that I'm holding my breath until everything is done.
Shank··on What even is an OS now?
The cognitive dissonance is astounding in AI circles. The vast majority of people have a personal computer in their pocket and they use it the vast majority of the time to scroll Instagram, play games, and occasionally interact with their bank and other social services. People who have laptops and desktop computers have them for specialized tasks they already do. None of the vast majority of users who buy their phone when the screen cracks and the battery stops working care about the agentic AI world because their phone already does everything they want to do.
Page 1 of 34Next →