creatonez

Ah. So Google cancelled April fools to make every day a big joke?

I absolutely hate this so much. I type "define" because I'm looking for a dictionary definition. Dictionary authors provide a careful consideration to the fluidity of language, and they write dictionaries in the format they do for a reason. The AI overview comes from web retrieval, which sources definitions from random idiots on the internet. These random idiots will just repeat what I already thought the word meant, offer up a common misconception or etymological fallacy, or give the 'annoying grammar nazi' take.

Exit node are an entirely optional part of the Tor network. If you run a relay or a hidden service you are not forced to participate in the exit node side of things. It's also not recommended to combine these roles because it could have security implications for your hidden service.

Just a heads up, this includes support for Return YouTube Dislike, which tells a third party service what videos you click on and has no measures to ensure anonymity like SponsorBlock does. The option for disabling it doesn't seem to do anything.

Are we sure that's true for Crysis

> [1]: https://en.wikipedia.org/wiki/Spinner_(computing)

Hah, I did not expect that. I can't imagine any end users will be able to name that one.

They're not necessarily wrong about it being scam resistant, based on some of the research into the psychology of scams. Adding time defuses the urgency of phone scams, leaving plenty of time to seek a second opinion from family members or the internet, and forcing the scammer to re-explain what the original goal was. It's too much time to breathe and defuses the fight or flight reaction needed for a high success rate. You mention URLs, but a web browser based scam page doesn't accomplish much, because the scammer's goal with fake apps is to acquire persistent remote access (akin to how the AnyDesk Android app uses accessibility permissions for Teamviewer-like remote access to an entire phone).

But yeah, it's hilarious that they're pushing this so hard when the Google Play Store still has so much malware.

IIRC, it's the button to permanently activate it that is only available for one hour. Once you do manage to press it, you've permanently enabled it. If you miss the window, you have to start the 24 hours again.

ZIP encryption is quite flawed.

That being said, I can see this being useful for a similar use case where encrypted ZIPs are useful. When malware testing, you sometimes want to avoid accidentally running the malware or exposing it to antivirus software until briefly before testing begins. Encrypted zips (as well as simple transformations like ROT13 or reversing the bytes in the file) can help control the moment the malware is unleashed. This HTML based tool could be useful for doing this in network sandboxed systems, with the specific property that it's testing the antivirus behavior when the file is marked as browser downloaded.

This FAQ is hilarious. I guess the default assumption is that if kids say something they don't actually mean it or know what it means. But no, they do. Often they are just using language in a more advanced generalized way than you, rather than being confined to distinct boxes. Children's brains are language factories.

Selfish gene theory is discredited as reductionist and mostly wrong. You can't ignore the whole organism.

It seems google is going to allow an "advanced flow" that is scam resistant by requiring the user to wait 24 hours before they can start installing their own apps. It sucks, but assuming they don't change the plan again, F-Droid should be able to continue working.

> “I need this vehicle to be out of here NOW, or it will be crushed,”

Sounds like the proper response is "my car has been disobeying me for the past 30 minutes, so crushed is fine" and then get out

> CryptoJS / Ill Bloom (2026)

This is the one I'm referring to, it used some very dumb `Math.random()`-with-unverified-incantations code that should have been obvious if anyone had just looked at it. This one is responsible for the majority of hackable bitcoin addresses. It's really embarrassing that this kept going until 2020.

(At one point this would have been a tricky situation, though, because around 2009-2013 when bitcoin wallets were first being generated in web browsers, Internet Explorer didn't provide a CSPRNG API. Because of the prevalence of IE, an in-javascript CSPRNG would have been justified as a fallback if it had proper cryptographic mixing of mouse input entropy and perhaps timing execution jitter entropy as well, along with good entropy estimation to decide when enough seeding has been performed to start generating keys. Some wallet websites actually did mouse entropy collection at the time (e.g. https://www.bitaddress.org), but often with dubious mixing. Might have been best to just ban Internet Explorer.)

> Libbitcoin / Milk Sad (2023)

Mersenne twister... likewise should have been identified as not even remotely correct. Not a serious CSPRNG at all. Similar to the CryptoJS case.

> Trust Wallet Browser Extension (2023)

Also Mersenne twister, similar to the CryptoJS case.

> Trust Wallet iOS / Trezor Library

Time-based seeding, with an exceptionally weak PRNG with only 32 bits of state. Similar to the CryptoJS case.

> Android SecureRandom (2013)

This is a buffer bug that caused existing seed data to be overwritten by newer data rather than correctly appending it. The serious cryptographic primitives weren't broken, just the input. But it is genuinely scary. Unlike the other examples, it wasn't immediately identifiable because it gave the appearance that a CSPRNG was being implemented, and being a platform API it is just as scary as the Debian bug in 2008.

> Because, in the applied world, upstream bugs in "secure" system RNGs have been the cause of stolen crypto [...]

You mean javascript libraries that do a bit of Math.random() and a miniscule amount of mixing, that had been widely considered poor practice for years while old bitcoin wallet generator websites were burning users with it?

Has any actual serious CSPRNG exposed bitcoin wallets?

Refusing the platform's CSPRNG for such nonsense reasons is perhaps the dumbest form of POSIX worship. This is obviously an area where platform feature detection makes sense, there's no reason to follow a religion of standards adherence when it directly leads you into harm's way

> (Or better yet: upload it directly to Libgen/Sci-Hub and let everyone else redistribute it.)

Can this actually be done without an ISBN or DOI number?

The AI didn't plug in an ethernet cable into itself

It does, and much more. It's basically a "what if we actually cared about fully text mode computing" project. It even has stuff like optional GPU acceleration (which a lot of people scoff at, but is very much necessary for very high screen resolutions combined with TUIs), mouse support, and multiseat configurations.

You shouldn't be allowed to have an internet connection if you're going to use it for unsandboxed agent slop with no access controls or human confirmation. This has nothing to do with hypothetical future AGI. It's the same type of idiocy as pressing a bunch of random buttons on a chemical factory control panel and then thinking you won't be criminally charged for it because the equipment caused the problem.

If you actually have a serious use case that needs 24/7 unmonitored agents, you can assemble all of the data the agents need locally and avoid these insanely obvious and well documented risks associated of running a random word generator with the ability to HTTP POST.

(And just in general, please stop subjecting the rest of the world to any automated actions that cannot be reversed by a human override. Same goes for cloud services subjecting users to quick non-appealable bans based on faulty automated detections. Or the current rollout of predictive policing technologies across the world. Or the automated bomb targeting in the ongoing Gaza genocide. )

In my view, proliferation of highly automated technology is not the concern, but rather its diffusion into human systems without thought put into whether it even meets our requirements for basic ethics, domain-specific correctness, and ways to mitigate a fuckup when it does happen. In this case, the detrimental diffusion into human systems was only allowed because someone made a decision (no access controls on the bot) that we can already easily characterize as a mistake that will need to be both mitigated (via a massive upgrade in cyber defense, especially with the help of AI fuzz testing but also more stringent compilers/linters/formal verifiers) and prevented from happening in legitimate regulations-abiding organizations in the first place. This kind of stuff will be slowed down at some point as we learn from hard mistakes, but the current craze is getting quite stupid.

> Focusrite Scarlett

If it's the one I'm thinking of, this device includes a read-only ~100KiB USB mass storage device filled with .lnk files to remind you to register the device to get your bundled digital goods (a bunch of DAW plugins).

You might want to try connecting the interface with Windows and install the focusrite driver. This will set the device to a "pro audio" mode, unlock the higher sample rates, and permanently make it stop behaving as a mass storage device. Not sure if this fixes Haiku OS USB audio compatibility, but it's a good bet and helps avoid the annoying mass storage device volume.

If you don't have a Windows machine to do this on, you can do it in a libvirt or qemu virtual machine on Linux using USB host device passthrough. Once you do it, it doesn't have to be done again, I'm guessing they implemented this with an eFuse.

> EGLStream support is removed

Wait, does this mean Nvidia won't have GPU acceleration for apps under XWayland anymore? Or is EGLStream not what I think it is?

> [...] instead of accidentally linking ordinary C into it

Out of curiosity. If you really needed to, could a language speak both the C ABI and the Fil-C ABI? As I understand Fil-C itself can't do this without having Python-like FFI overhead, but maybe a different compiler implementation could?

> is not going to click on their ads and buy the advertised products anyway

Even cringy ads that digust or anger users in the moment have a subtle effect of making them more likely to buy or recommend that brand in the future. The name recognition is what advertisers are buying, it doesn't have to immediately persuade the user to click for them to get what they want.

"Ozempic moment" seems like a manufactured buzzword in this context. A new modafinil variant is nothing like Ozempic. The thing that was actually interesting about Ozempic wasn't its windfall profits, it was the fact that it is a new class of drugs, and the fact that it's able to rather directly target a habit without wreaking havoc on the body. Part of the article mentions there is hope it may be useful for depression, ADHD, and addiction, but whether any of this is actually actually effective is up in the air. Lots of things are in "pharmaceutical companies hope it can treat mental illness" status... but trying to cast an image of being on the verge of a breakthrough is big pharma's whole marketing.

I had just watched a fantastic video about this very topic as it applies to the US https://www.youtube.com/watch?v=b5JbDuf--ng

Nice to see someone is keeping track of all of this in a logical way for all countries.

> Note: It has been decided not to add administrative boundaries of [super-national administrations] in OpenStreetMap. So please don't use admin_level=1.

Damn, I was hoping to see groups of countries (admin_level=1), and then groups of planets (admin_level=0), and then groups of stars (admin_level=-1), and then groups of galaxies (admin_level=-2). L. Ron Hubbard has surely established governments at all of these levels!

This can happen, after all HDD firmware and the link is not flawless. But have you actually ruled out RAM/CPU as the primary cause? I'm skeptical.

Maybe don't demand a google account login before even indicating what platforms it supports?

...No? Faulty storage will almost always show up as I/O errors, modern storage generally doesn't want to send a block of data to the CPU if there is an error in it. If your bits are flipping, chances are it's RAM and not storage. Your storage already has ECC.

Some crappy flash drives might not do this, though. Seems to behave like a floppy disk at times.

Huh, I guess I assumed that based on the behavior of most of the experimental flags offered on world creation. Has that always been the case?

I think mojang is taking a turn away from experimental feature flags these days, so I guess this situation will get better over time.