HNHacker News
TopNewBestAskShowJobs

Springtime

2,552 karma · joined November 8, 2013

submissionscomments
Springtime··on Discord/Twitch/Snapchat age verification bypass
Sounds like it may already have been[1].

Edit: might only be a minor API call issue[2]

[1] https://github.com/xyzeva/k-id-age-verifier/issues/7

[2] https://github.com/xyzeva/k-id-age-verifier/pull/6

Springtime··on GOG: Linux "the next major frontier" for gaming as it works on a native client
I think too it can be misleading since on Windows the default LNK shortcut that is created after the game installation launches Galaxy with arguments instead of being a path to the direct game EXE (which works entirely without Galaxy and how I run games).

They do this to push Galaxy for convenience I suppose as most are used to clients that handle updates but it can be confusing if some wonder why for instance their offline installer shortcut opened Galaxy instead.

Springtime··on Prism
> The Post-LLM World: Fighting Digital Garbage https://archive.org/details/paper_20260127/mode/2up

This appears to just be the output of LLMs itself? It credits GPT-5.2 and Gemini 3 exclusively as authors, has a public domain license (appropriate for AI output) and is only several paragraphs in length.

Springtime··on cURL removes bug bounties
Outside of direct monetary gain like bounties are efforts to just stand out, in terms of being able to show contributions to a large project or getting say a CVE.

Stenberg has actually written about invalid/wildly overrated vulnerabilities that get assigned CVEs on their blog a few times and those were made by humans. I often get the sense some of these aren't just misguided reporters but deliberate attempts to make mountains out of molehills for reputation reasons. Things like this seem harder to account for as an incentive.

Springtime··on The Vietnam government has banned rooted phones from using any banking app
In the given scenario though it's less likely such a user would be using a rooted or replacement OS. It's an involved process to do this in the first place.

Ie: the much larger percent of users affected by this news would already be more technically savvy and one would assume be less susceptible to known scams.

To your parent point though, sideloading apps per se OTOH is something most Android installs can do without rooting or a replacement OS. Google is already rolling out developer verification requirements for sideloaded apps on GMS Android installs (most devices) to mitigate impact of malicious apps, so there is already action being taken for regular users.

One could imagine other reasons Vietnam may want to dissuade more tech savvy users from running AOSP-based installs (such as GrapheneOS, which is known to be robust against Cellebrite) and using banking is a decent place to start.

Springtime··on Netflix to Acquire Warner Bros
Pirating doesn't help sustain the very thing being pirated, if you want a tangible rather than moralistic reason.

4K (Ultra HD) Blu-Ray is likely the last physical home video media generation to be produced. Disney has pulled physical out of the Asian market, Best Buy stopped releasing any physical media beside games, Target stopped selling them beside certain DVDs.

If you want any chance of actually having high quality releases continue it needs to be supported. An issue though is certain less mainstream releases in Ultra HD Blu-Ray can be rather pricey (if they get a release at all). However I still buy those I'm interested in since I don't want lower quality streaming-tier video to be the only option available in the future, apart from concerns about the volatile nature of online-only libraries (various of which have been wholly removed in the past when licensing/ownership changes).

Springtime··on AI generated font using Nano Banana
> I also found out that my friend's company got charged $2,000 per character. WTF.

Is there more context to this? I can't see anything preceding it that explains what it's referencing.

Springtime··on Unpowered SSDs slowly lose data
In the longer JEDEC overview document[1] it explains that in the ideal 'direct' testing method retention testing is only performed after the endurance testing. Which is only after the drive has had its max spec'd TBW written to it.

While if the endurance testing would exceed 1000 hours an extrapolated approach can be used to stress below the TBW but using accelerated techniques (including capping the max writable blocks to increase wear on the same areas).

Which is less dramatic than the retention values seem at first and than what gets communicated in articles I've seen. Even in the OP's linked article it takes a comment to also highlight this, while the article itself only cites its own articles that contain no outside links or citations.

[1] https://www.jedec.org/sites/default/files/Alvin_Cox%20%5BCom...

Springtime··on The patent office is about to make bad patents untouchable
Just on the pervasive passive monitoring aspect, I think an under-discussed aspect of the time frame covered in the material of Snowden's leaks is that sites/services by and large wasn't using encrypted protocols (HTTPS).

So much could be intercepted back then because of this. It wasn't until 2010 that various large services—including Yahoo Mail and Facebook—got a kick in their ass by a whitehat browser plugin that allowed anyone on the same network to trivially hijack session cookies of others, stimulating an adoption of HTTPS[1] during 2011-2012.

By the time the Snowden leaks occurred in 2013 the trend was heading toward encrypted-by-default and governments were having to adapt.

[1] https://threatpost.com/facebook-kills-firesheep-new-secure-b...

Springtime··on Windows 11 adds AI agent that runs in background with access to personal folders
And this W11 version of Notepad takes longer to open than Sublime Text and about equal to Firefox. On NVMe.

It used to be instant, which is something you really notice the difference with when it changes.

Springtime··on Astrophotographer snaps skydiver falling in front of the sun
I recall one of their earlier composites of the sun which was comprised of 90k (!) images and feel that's an acceptable approach to represent the detail and scope desired, yet with this skydiver shot I feel differently in that there is an original shot of the event that is an actual through-the-lens capture but it's not being used and instead the foreground element (the silhouette) is being masked and composited onto a much more detailed composite sun. It's effectively artwork now.

Like if a photo of Philippe Petit's WTC wire walking were instead masked and replaced with separately shot towers—it'd represent the event but technically not the actual snapshot in time it occurred, which kind of reduces the connection with the interesting concept at least for me.

Springtime··on Blocking LLM crawlers without JavaScript
I wonder what the venn diagram of end users who disable Javascript and also block cookies by default looks like. As the former is already something users have to do very deliberately so I feel the likelihood of the latter among such users is higher.

There's no cookies disabled error handling on the site, so the page just infinitely reloads in such cases (Cloudflare's check for comparison informs the user cookies are required—even if JS is also disabled).

Springtime··on AI World Clocks
On the second minute I had the AI World Clocks site open the GPT-5 generated version displayed a perfect clock. Its clock before and every clock from it since has had very apparent issues though.

If you could get a perfect clock several times for the identical prompt in fresh contexts with the same model then it'd be a better comparison. Potentially the ChatGPT site you're using though is doing some adjustments that the API fed version isn't.

Springtime··on IP blocking the UK is not enough to comply with the Online Safety Act
And also:

> If I had to guess, it’s that some NGO found some UK-based IP addresses which weren’t captured by the block because they weren’t properly geolocated.

Ofcom's clarified contention is that the geoblock is unreliable, while the lawyer seems to be rebutting the original statements that they interpreted Ofcom as claiming no geoblocking was active ('remains accessible to UK users', 'was directly available to people with UK IP addresses (with and without a VPN)').

Springtime··on VLC's Jean-Baptiste Kempf Receives the European SFS Award 2025
I believe it was IINA, a front-end for mpv.
Springtime··on VLC's Jean-Baptiste Kempf Receives the European SFS Award 2025
On Windows at least VLC has had better alternatives for the past 20 years, both feature and UI wise. I had frame-stepping hotkeys back in the mid-00s with Korean video players. These days I use the currently maintained fork of MPC-HC which similarly has this.

On Mac it wasn't until the mid-10s that I found a decent player.

Springtime··on Two billion email addresses were exposed
That would be hundreds to check. While for the quoted users in the article all but one seems to have reused their password(s), suggesting fewer used overall so easier to check.
Springtime··on Two billion email addresses were exposed
This is a massive PITA for any users who exclusively use unique passwords and various unique addresses, as it sounds like the source of the breach(es) is unknown (so hard to judge which accounts would be affected without using Troy's sites to test everything or find some searchable dump online somewhere dubious).
Springtime··on Why our website looks like an operating system
If one wants full control cookies could just be disabled by default at the browser level (which also blocks local storage). I do this and just whitelist sites that actually need it (very few).

The issue is some sites won't display any content without cookies, even if it's unnecessary. The amount of React-using sites that will load the entire page only to a second later to fully blank out since the JS couldn't set local storage does get annoying (and can regularly be worked around by disabling Javascript if not used for anything substantial). A handful like this have appeared just this past week on the HN front page.

Springtime··on OpenAI eats jobs, then offers to help you find a new one at Walmart
I mean, I keep web pages about cases that previously used a human and have now been replaced with neural network models. Some of which include:

- Translation. See: Gizmodo firing its Spanish translation team and switching exclusively to LLMs.

- Editors. See Microsoft replacing their news editors at MSN with LLMs.

- Customer service. Various examples around the world.

- Article graphics for publications. See: The San Francisco Standard (which used it for various articles for a period), Bleepingcomputer.com, Hackaday (selectively, before some pushback).

- Voice acting. The Finals game used synthetic voices for the announcer voices.

Springtime··on What's New with Firefox 142
> I have other questions as well -- does the link preview ignore your plugins? So if you loaded the web page, would uBlock Origin prevent tracking which is _not_ prevented when loading the preview?

This was the primary reason I'd never used Vivaldi browser's long-standing feature of being able to set sites within a side panel, since it ignored addons. Was only last year that was changed to allow addons.

Springtime··on Petition to stop Google from restricting sideloading and FOSS apps
I think there are a few main contentions:

- The requirement, unless I'm mistaken, would tie a real-world identity of the developer to an app, who may wish to keep that separate from a pseudonym they may normally release things with.

- Unwillingness to give Google PII or just not tie a particular pseudonymous identity to that PII on Google.

- It puts absolute control in Google's hands for whether any app is allowed to run on most devices. There may be concerns about the types of decisions that may arise from this, not merely from recognized malware. Certain governments may ask Google to regulate apps allowed on such devices via this approach.

- Once this globally rolls out in 2027 it will mean the audience for apps from devs who don't agree to this will shrink dramatically. Only those presumably with AOSP based custom ROMs will be able to use those apps which may have a knock-on effect for dev motivation.

Springtime··on Researchers find evidence of ChatGPT buzzwords turning up in everyday speech
I've had an Autohotkey replacement for the proper em dash character for over 10 years, using shorthand characters which triggers the replacement. Whether spaces are around the dash is a difference in style (see: various publications' style guides), though I use the no spaces style.

Being able to insert self-interjections and such with the correct character would undoubtedly be more widespread if it were more accessible to insert for most.

Springtime··on Windows 7 x64 Extended Support Page
I'm kind of surprised that Chromium blocks audio on autoplaying videos except when clicked but allows audio on mouseover interactions (encountered here). Takes me back to early 00s era sites with random surprises (in a good way here since its quirkiness is communicated with the design).
Springtime··on A bug saved the company
For the past like 30 years I feel there's never been a time some commercial Mac program hasn't filled a simple niche. I remember someone last year posting a Show HN for an ffmpeg wrapper for Mac with a limited feature that focused on transcoding and made $9k in the first 4 months.

Or in the late 90s when there was a commercial program that allowed OS 9 to show real-time window previews while dragging rather than merely showing the window border outline.

Springtime··on Google will allow only apps from verified developers to be installed on Android
The requirement per Google's post is rolling out globally though in a couple years. There was nothing stopping per country governments that this may disproportionately affect from requiring this for Play Protect/GMS certified Android devices sold in their region but enforcing it worldwide for such non-AOSP devices I don't find surprising to be controversial.
Springtime··on YouTube made AI enhancements to videos without warning or permission
Given the denoising is said to be aggressive enough to be noticeable on already compressed video I think criticism of it is fair. Just that it should be distinguished from something like Tiktok's 'beautifier' modifications, which from titles like the BBC's come to mind.
Springtime··on YouTube made AI enhancements to videos without warning or permission
Youtube says this was done for select Youtube Shorts as a denoising process. However most popular channels on Youtube, which seem to be the pool selected for this experiment, typically already have well lit and graded videos shouldn't benefit much from extra denoising from a visual point of view.

It's true though that aggressive denoising gives things an artificially generated look since both processes use denoising heavily.

Perhaps this was done to optimize video encoding, since the less noise/surface detail there is the easier it is to compress.

Springtime··on Google did not unilaterally decide to kill XSLT
Some of the things that stood out to me about the news:

- The thread by the Chromium dev proposed what was originally a 1MB minified polyfill for the Javascript only XSLT calls that in just the last few days has grown to 3MB minified. XSLT was beneficial in the browser because it was native, while a 3MB polyfill is a rather big ask to suggest as a per-site replacement for anything meant to be snappy on slower connections.

- It seems from various mentions the catalysts for this to surface now were the sole maintainer for the XSLT library used in Chromium expressed having trouble maintaining it some months back and left it to a different sole maintainer, along with a recently disclosed vulnerability in that particular library. Firefox OTOH is said to use a different XSLT library.

- Chromium team routinely awards vulnerability discovery bounties in the tens to hundreds of thousands of dollars. Just the other week they awarded $250k to an author who discovered a tricky Chromium exploit. I'd be curious if they've funded development of the XSLT library they use in the past as it seems like they'd rather just be rid of it.

- Within days of posting the open question to the working group and a week prior to the PR of the spec removal a Chromium ticket by the author set milestones for XSLT removal in Chromium. It seems it's less a tentative proposal and more leading by example.

Springtime··on An interactive guide to SVG paths
Just something that would be worthwhile looking into is preventing blanking out the entire page if cookies (and by extension local storage) are disabled. The page loads fully briefly then blanks out to a full viewport React error. I see this on various sites where it's avoidable.
← PreviousPage 3 of 20Next →