Hacker News Reader

collinmandersonon WTF Ubuntu?

> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.

To be clear, Ubuntu Pro doesn't have the fix yet either.

https://news.ycombinator.com/item?id=50337869

collinmandersonon WTF Ubuntu?

> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`

To be clear, Ubuntu Pro doesn't have the fix yet either, in case anyone's confused.

collinmandersonon Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown

Scammers often create a sense of urgency/emergency, especially over the phone, and putting a 24hr limit on it gives the person more time to possibly realize they're getting scammed.

It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.

If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.

Edit: Google explains this more:

In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.

According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.

https://android-developers.googleblog.com/2026/03/android-de...

collinmandersonon Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown

That's what they said it's going to be. A one time 24 hr cooldown to turn on the "Allow Unverified Packages" setting, not 24hr per app.

And then you have the option:

- unverified packages either temporarily (7 days)

- or indefinitely

Official docs here:

https://android-developers.googleblog.com/2026/03/android-de...

collinmandersonon Tesla Roadster

> This seems like smoke and mirrors

Technically it’s water vapor, not smoke.

collinmandersonon AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware

The main thing ads allows is "zero-click" - so they don't need to click a link or anything to get exploited.

collinmandersonon Israeli firm's digital ads enabling installation of 'zero-click' spyware

So there's some sort of Android/iOS vulnerability in Chrome/Safari that they're exploiting?

No info on if a recent version patches this?

It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?

collinmandersonon A Modern Web App in C

Yes, I was going to say that too. Modern "serverless" is basically this - spawning a script to handle a request on-demand.

And because of serverless, there are frameworks optimized for low startup time, and those frameworks would probably work pretty well for CGI too.

collinmandersonon Pi 1.0

> also i wonder if it works nicely if it is possible to convert Pi transcripts to Hax - i have a few "in progress" and i'd like to continue where i left from, though while both seem to use JSONL for the transcripts i'm not sure if they're compatible

I’ll sometimes ask the new agent to look at the previous transcript file.

collinmandersonon Pion, an agent designed to run any company autonomously

I have the agent (Opus 5) spawn code reviews for their own work, and the code reviews generally catch n+1 queries.

collinmandersonon Fujitsu launches made-in-Japan next-generation CPU FUJITSU-MONAKA

For US federal government, "Office of Management and Budget" says to store 72 hours of packet capture, since 2021 (partially in response to SolarWinds attack). (M-21-31)

https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR...

collinmandersonon google.com/goto: Google's anti-scraping update

They used to give preferential treatment to AMP search results, but November 2020 they announced switching to "Core Web Vitals" signal instead.

https://developers.google.com/search/blog/2020/11/timing-for...

collinmandersonon Claude Fable 5.1 and Claude Mythos 5.1

I think it says "honestly" when breaking bad news.

collinmandersonon Apple introduces M6 and M5 Ultra

"buddy" -> "mate" -> M8. Nice.

collinmandersonon The August 17 outage

That seems to be what's happening. Like 2-4 bots talking to each other, then Jarred Sumner just does the final merge with little comment.

https://github.com/oven-sh/bun/pull/39743 https://github.com/oven-sh/bun/pull/39735

collinmandersonon 98% isn't much

No, they would just ignore Firefox and not test against it, and might start to use chrome/safari-only features.

collinmandersonon Tell HN: Fable 5 promotion extended through July 12, 2026 at 11:59:59 PM PT

This makes sense. Originally Fable was going to be available via subscription June 9th through June 22nd (~14 days).

It ended up being available 2.5 days before pulled, then was made available July 1 through July 7. (~7.5 days), so only ~10 days total.

Now they're giving us 5 more days, so ~15 days total, more similar to what they originally announced.

collinmandersonon 98% isn't much

Part of the problem is The US Government (and UK Government) use the "2% rule" on their websites and only officially support 98%.

I mentioned 3 years ago that Firefox at 2.2% is dangerously close the being unsupported on government websites, and at this point it's now at 1.9%.

https://news.ycombinator.com/item?id=36776603

https://analytics.usa.gov/ says "There were 1.66 billion sessions in the last 30 days." - so 2% is 33 million sessions if I did my math right.

collinmandersonon Want your images back? That'll be $5

https://xkcd.com/1150/

collinmandersonon Malicious npm packages detected across Red Hat Cloud Services

> no cooldown (or a much smaller countdown) for security fixes.

A supply chain attack would likely able to publish a "security" release just as easily as a normal release, so I don't think that would help much.

collinmandersonon Django 6.1 alpha 1 released

Release notes here: https://docs.djangoproject.com/en/dev/releases/6.1/

Looks like there's some features to try to reduce the “N+1 queries problem”.

collinmandersonon AI is making me dumb

> I just caught myself about to copy and paste it into Claude to see what it thinks because I'm worried that it doesn't make sense or it reads funny or there's something missing. That's the self-doubt that it's feeding on and what I need to fight back.

This is where I'm at. I feel like I need AI to review everything.

collinmandersonon Incident Report: CVE-2024-YIKES

> As the victim of the one from last year

Background here:

https://news.ycombinator.com/item?id=45169657

https://news.ycombinator.com/item?id=45187528

collinmandersonon Dirtyfrag: Universal Linux LPE

> Or are folks seriously proposing that the patch/mitigations should have been circulated to distro maintainers privately before going to mainline?

I always assumed that distro maintainers got early access to patches before going mainline but maybe that’s not true?

collinmandersonon Red Squares – GitHub outages as contributions

Github Copilot also lets you use other models when one has an outage.

collinmandersonon Red Squares – GitHub outages as contributions