HNHacker News
TopNewBestAskShowJobs

buzer

1,367 karma · joined October 8, 2016

Staff Software Engineer at 8x8

Especially interested in systems scaling & IAM and also general interest in most of thing on backend side.

You can reach me via <username>@<username>.net

submissionscomments
buzer··on Green card seekers must leave U.S. to apply, Trump administration says
IANAL. My understanding is that you can do consular processing even if you are in the US, it's just that you need to leave to do the interview (and things like biometrics) and get the actual visa.

Now I'm not sure if you are allowed to re-enter after your interview before your case is decided/you get the visa but I would imagine so (if have valid visa), you would just need to exit again to get the visa later.

buzer··on Green card seekers must leave U.S. to apply, Trump administration says
Intent (are you planning to switch immigrant visa later) and status (immigrant/non-immigrant) are two different things. Visas like B1 are non-immigrant and require that you are not intending to abandon your foreign residence. In practice that means that when you enter US you cannot be planning to apply for immigrant visa. H1B is also non-immigrant visa, but it is dual intent visa meaning it doesn't have that requirement and thus it's fine to enter even if you intent to apply for GC. You can even exit and re-enter after submitting your application.
buzer··on Kioxia and Dell cram 10 PB into slim 2RU server
I know, I'm just not sure how high discount you are going to get in this kind of system. My understanding is that the discounts normally tend to be something like 30-40% so it would still be within same magnitude (10M+).
buzer··on Kioxia and Dell cram 10 PB into slim 2RU server
The list price seems to be ~40M. https://www.dell.com/en-hk/shop/servers-storage-and-networki... Select the 40 slot chassis and put 40 of those 245TB disks in. Comes out at ~HK$317M. Of course HK prices might also be higher than what Dell USA offers.

Now how heavy the discounts you can get I don't know.

buzer··on Bill to block publishers from killing online games advances in California
One good option could be to make the distributor (like Steam or Play Store) liable as well. They would then have an interest on making sure that publisher/developer holds up on their side of the deal.

For example they could require that they provided with those EOL patches/sources when game is released, require liability insurance in case of bankruptcy etc.

buzer··on Bill to block publishers from killing online games advances in California
If this only applies to new sales then there is nothing that must be broken. The developers would need to choose technologies where license allows this. Those that don't wouldn't get new sales from game developers.

It's the same as GPL and similar licenses. If you don't want to publish your source that contains trade secrets then don't incorporate GPL licensed code.

There are also already various laws which compel certain types of speech. Consider things like nutrient labels or ingredient lists.

buzer··on Bill to block publishers from killing online games advances in California
> The game developer might not have the legal rights to release the source.

Then the game developer/publisher should choose to use another technology or be ready to replace that piece when game reaches EOL. If no game developer can use that technology, the vendor will end up loosing a lot of sales. They can then decide if more permissive license would make sense.

buzer··on OpenAI is connecting ChatGPT to bank accounts via Plaid
Whenever I have seen the Plaid integration it will also ask permission to your transactions. HR software won't get those when I provide it my account & routing numbers.
buzer··on New Nginx Exploit
There can be situations where you set some variables on top level and then override those in the location block with rewrite. These variables could be then used e.g. in log lines or in other "global" contexts.

Not extremely common, but it does happen.

buzer··on A.I. note takers are making lawyers nervous
I wonder what kind of GDPR implications that has given the requirements around the accuracy of personal data.
buzer··on EU Parliamentary Research Service calls VPNs "a loophole that needs closing"
No one is doing it that way though. Also to be truly privacy-preserving you cannot rely on anything that requires any specific OS (especially Android or iOS) as every single OS requires some compromises to privacy.

The only privacy-preserving (effective) age verification is asking user if they are over 18 and requiring that they answer truthfully under penalty of perjury. Then prosecute the kids who claim they are over 18. For reason or another no one seems to be pushing for that option.

buzer··on Authorities say Flock cameras' data allegedly used for immigration enforcement
> Illegal immigration is a misdemeanor not a felony.

My understanding is that entering without getting inspected is misdemeanor (or felony in some cases), but that's often not the case. Usually people just overstay and that's civil case. And because it's treated as a civil matter a lot constitutional protections do not apply (to clarify: some still do).

buzer··on LinkedIn profile visitor lists belong to the people, says Noyb
It's both your data and that person's data.

(copied from my earlier comment) I think it's very close to C-579/21 which was about audit logs. In that one CJEU ruled that audit logs are personal data of you and the person who performed the action. They did allow censoring the person's name in that case (and exact timestamp), but given that in this case LI is selling this information to same person then "protecting others" rings pretty hollow.

buzer··on LinkedIn profile visitor lists belong to the people, says Noyb
Personal data is data that relates to to you. What relates to you is the list of users who viewed your profile.

I think it's very close to C-579/21 which was about audit logs. In that one CJEU ruled that audit logs are personal data of you and the person who performed the action. They did allow censoring the person's name in that case (and exact timestamp), but given that in this case LI is selling this information to same person then "protecting others" rings pretty hollow.

buzer··on Do_not_track
GPC must be honored in California. https://oag.ca.gov/privacy/ccpa/gpc

According to https://www.didomi.io/blog/global-privacy-control-gpc-2026 it must also be honored in 11 other states but I'm not familiar enough with the specifics regarding those.

buzer··on Who owns the code Claude Code wrote?
How do you exactly read that article in that way?

50(1) states that AI systems which interact directly with public must inform that they are interacting with AI system.

50(2) states that AI generated synthetic audio, image, video or text content must be marked as such. However this requirement applies to "providers" of AI systems. And according Article 1(3) that is:

> ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

So it sounds like it would apply to e.g. Anthropic via Claude Code, not to users of Claude Code.

It's also unclear if this would apply to the compiled output or not.

buzer··on US Supreme Court reviews police use of cell location data
> It would be excellent to see some progress, in expanding & respecting our human rights to privacy.

There are many laws in place in EU which forbids many kind of practices which infringe on privacy, but the issue is that governments don't really enforce them proactively. And in some cases where they are the ones breaking them (e.g. by enacting law that is not compatible with EU Charter or ECHR) it will take long time to get judgement which forbids the practice.

Often the path is that you complain to DPA, you appeal to court, you appeal to higher court, (repeat last step X times), during court appeals you may need to wait for CJEU ruling and finally you might be able to file appeal to ECtHR.

In one "recent" case from Finland the original DPA decision was issued in 8/2020. I'm not sure how long this exact case took, but there are some recent decisions which took 5 years to issue. It was appealed to administrative court and court made request to CJEU on 11/2021. CJEU gave ruling on 6/2023. Administrative court gave ruling on 12/2023. It was appealed and higher administrative court gave ruling on 6/2025.

So it could take 10 years to annul an illegal law or practice.

buzer··on Anthropic says OpenClaw-style Claude CLI usage is allowed again
But there was a period of time when using Openclaw via Claude Code (via -p) was not allowed and it even gave an error message in that case. That's why people find the constantly changing messaging confusing.

https://x.com/steipete/status/2040811558427648357

buzer··on Ban the sale of precise geolocation
What new requirements can be set by the board? As far as I understand EDPB can only issue guidelines, recommendations and best practices. All of these are just guidelines on how to interpret GDPR. Courts are the ones who ultimately decide if are complying with GDPR. Local DPA likely won't harshly punish you if you follow EDPB's recommendations if they end up getting overturned by court.

DPA won't punish you for not following EDPB's recommendations, they will punish you for breaking GDPR. You are free to ignore EDPB if you think your legal position is strong, but you carry the risk if you are wrong.

buzer··on €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs
Google has specifically said that certain API keys like Firebase are not secrets (since people will find them)... though Gemini then ended up changing stuff. https://news.ycombinator.com/item?id=47156925
buzer··on Stop Flock
Article 14(5)(b) does, but that only applies for Article 14 notice (personal data not directly obtained from data subject). Article 13 (personal data obtained directly from data subject) does not have such exception in GDPR itself.

This becomes extremely relevant when you read it in the light of the C-422/24 decision. In that personal data collected via body worn cameras was determined to be "directly obtained". Paragraph 41 from the judgement:

> If it were accepted that Article 14 of the GDPR applies where personal data are collected by means of a body camera, the data subject would not receive any information at the time of collection, even though he or she is the source of those data, which would allow the controller not to provide information to that data subject immediately. Therefore, such an interpretation would carry the risk of the collection of personal data escaping the knowledge of the data subject and giving rise to hidden surveillance practices. Such a consequence would be incompatible with the objective, referred to in the preceding paragraph, of ensuring a high level of protection of the fundamental rights and freedoms of natural persons.

Given this it's very unlikely that PI observing (especially if they record) could be considered to be Article 14 instead of Article 13 type of collection as it's exactly "hidden surveillance practice" that the Court warned about.

Member states do have a right to restrict the Article 13 disclosure obligations via Article 23 restriction, but that requires specific law in the member state & the law itself must fulfill the obligations that Article 23 requires. Article 23(2) essentially forbids leaving everything up to the controller.

And as far as PI in the US goes, actions between stalking and PI "for self" tend to be so similar that I wouldn't necessarily recommend anyone to try it.

buzer··on Stop Flock
If PIs can "legally" do it then it sounds like there is a law which allows them to do it. That law can be revoked (unless the power comes from Constitution which would make it effectively impossible to revoke).

Note that PIs are effectively illegal under GDPR by default. They would generally need to provide Article 13 notice, i.e. you would become aware of them unless they were just asking around without actually following you. Member states can make them legal though (via Article 23) and likely in many cases they have done so.

buzer··on Backblaze has stopped backing up OneDrive and Dropbox folders and maybe others
I have never personally used it, but aren't Windows' Shadow Copies supposed to be the answer to file locking/modification issues?
buzer··on Spain to expand internet blocks to tennis, golf, movies broadcasting times
Surely EU members should care if Spain blocks the access to government services offered by EU members. In Finland various government services (like Police's website) do use Cloudflare.

And Spain is not blocking access to Spain's citizens, it's blocking access people in Spain. These could be citizens of other EU members who need to access their government's website for reason or another (e.g. renewing passport) while they visit Spain or reside in Spain.

buzer··on Spain to expand internet blocks to tennis, golf, movies broadcasting times
> Seems obvious at this point there needs to be EU-level regulations against individual countries, such as Spain and Italy, implementing these absurd restrictions.

I don't think there is EU-level "regulation" in this specific thing. However there is something somewhat better: European Convention on Human Rights. It's just that challenging these kind of bans via that route is very slow (similar how slow it is to challenge the laws which go against the Constitution in the US via Supreme Court).

buzer··on Seven countries now generate nearly all their electricity from renewables (2024)
Sure, that is the current situation but if the Nordic countries started relying on solar from central Europe (especially Finland since it doesn't have the hydro capacity Norway & Sweden have) things could get ugly during crisis.

The GP essentially framed overprovisioned solar as solution to anyone who might rely on nuclear without taking in account realities in many countries.

buzer··on Seven countries now generate nearly all their electricity from renewables (2024)
You don't need to colocate the solar, but you need to make sure you can get that power when you actually need it.

During crisis nations are going to restrict exporting electricity and prioritizing their own residents. Electricity that is generated in Germany is not going to warm up Nordic countries if Germany doesn't let it.

Wires are also susceptible to sabotage, especially undersea ones (which are the current major connection points to Europe).

buzer··on Seven countries now generate nearly all their electricity from renewables (2024)
I selected random date in July 2025. During that time Finland produced about 10GWh of solar. I selected random one from February 2025. During that Finland produced about 0.5GWh. February also actually doesn't have shortest daylight hours, mid-December situation is even worse. Christmas Eve 2024 produced about 0.05GWh.

You sure overprovision factor of 200x is still cheaper? This is when looking at the peak generation. From what I understand solar has about 30-40% capacity factor in summer. Just to panels (I'm not sure about total cost of grid-scale solar) seem to be about $300k per rated 1MW or $750k per 1MW during peak. $150M per 1MW during December. OL3 cost about 11B € for 1.44GW (assuming 90% capacity factor) or 7M € per MW.

Unless there has been some huge overnight exchange rate change 7M € seems much cheaper than $150M. Latter of course would actually be much higher when you factor in rest of the equipment, labor etc. Some numbers I found say that it's probably 5x higher.

buzer··on Tell HN: Docker pull fails in Spain due to football Cloudflare block
They could potentially file the suit against Spain in European Court of Human Rights if they have exhausted national remedies. ECtHR has previously ruled some blocks to be illegal, but generally in the context where country sought the ban. Of course in both cases Court is the one that actually orders the ban.

One relevant would be Yildirim v. Turkey where court ordered blocking access to all Google sites because there was one that where someone insulted the memory of Atatürk. This was due to request from Telecommunications Directorate. This then caused the appellant's website to get blocked as well.

Another one would be Vladimir Kharitonov v. Russia.

buzer··on HBO Obtains DMCA Subpoena to Unmask 'Euphoria' Spoiler Account on X
The funnier version was people doing it during the next book's release.
← PreviousPage 5 of 17Next →