Hacker News Reader

flotzamon Debian apt security update: man-in-the-middle arbitrary code execution

Still places trust in the download servers, which makes them a juicy target

But yes, they could have mentioned HTTPS to make the announcement at least half-assed. Even just saying "good luck not getting exploited" would be an improvement over literally nothing

flotzamon Debian apt security update: man-in-the-middle arbitrary code execution

Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?

If necessary, with instructions for downloading and verifying it out of band

Or maybe by passing a parameter to the old apt that disables the vulnerable HTTP download resumption when downloading the new apt

flotzamon Around a dozen banking apps began specifically permitting GrapheneOS

An app is able to check if it's running in the main profile: https://stackoverflow.com/a/54765470

I can't think of a legitimate reason to check this and refuse to run in a secondary profile. But banking apps sure love to cargo-cult invasive nonsense.

flotzamon Glymphatic clearance to alleviate brain edema and Alzheimer's pathology in mice

There's an animated visual pattern that induces this cerebrospinal fluid flow: https://news.ycombinator.com/item?id=41942775

I've found it helpful for getting rid of the frazzled feeling after a sleepless night.

flotzamon Who Is Planting Backdoors in Ledger Crypto Wallets?

It's easy to buy eSIMs anonymously. Either directly with cryptocurrency, or with a prepaid virtual credit card bought with cryptocurrency.

flotzamon Show HN: Carrier-Explode: iPhone, Pixel and Galaxy carrier settings decoded

Depends on the OS. GrapheneOS can override a bunch of them: https://grapheneos.org/usage#carrier-settings-overrides

flotzamon Pirating the Pirates

Oh you're going to love the Penultimate Cut fanedit/restoration of Blade Runner:

https://fanedit.org/what-the-final-cut-shouldve-been/ (check out the Changes tab)

https://www.youtube.com/watch?v=nsdmYjF_064 (trailer comparison)

https://archive.org/download/blade-runner-the-penultimate-cu...

flotzamon TwitterWebViewer also no longer in operation, following a request from X Corp

Or just a .onion for the frontend and code forge + another server at some clearnet domain proxying it (until taken down and replaced with the new one) would probably work fine. The hidden service can even terminate TLS with a valid cert for the clearnet domain.

flotzamon TwitterWebViewer also no longer in operation, following a request from X Corp

Hoping we'll see more resilient development/hosting emerge

flotzamon TwitterWebViewer also no longer in operation, following a request from X Corp

Seemed worth a new post, now that they actually killed it today :(

Is there any frontend still standing?

flotzamon The turbulent AI era is here

https://redlib.catsarch.com/r/IAmA/comments/5whpqs/im_bill_g...

flotzamon Google has stopped pushing Git tags for some Android source code

I've been wondering about the Red Hat model! Seems like so much of modern development involves git blame or whatever to make sense of how the code came to be, and sometimes rule out an "obvious" modification that actually turns out to be a bad idea now that you know the historical context.

GrapheneOS might have a better case though if it's not just about understanding the code but about how the Android build system expects that everything is in Git.

flotzamon Google has stopped pushing Git tags for some Android source code

> If you had included the previous word, it would be blindly obvious that “on a medium“ is only talking about the transport layer, not the format of the data.

I can see your point. But OTOH if providing the "preferred form of the work for making modifications" requires not squashing commits into a big mess to frustrate someone trying to make sense of the code (I'm sure the Google engineers making modifications prefer to look at individual commits!), and Google is using Git anyway to create those commits, then it seems to me like there's an argument to be made that the customary medium used to interchange a range of Git commits is Git.

But the stronger argument is that the Android build system expects everything to be in Git: https://news.ycombinator.com/item?id=49368983

flotzamon Google has stopped pushing Git tags for some Android source code

> We didn't have git tags when GPL was written in 1989

The GPLv2 requires "a medium customarily used for software interchange", not "a medium customarily used in 1989 for software interchange". Customs are the customs of the time someone is releasing the work.

flotzamon Google has stopped pushing Git tags for some Android source code

GrapheneOS is arguing that throwing away the metadata of however many commits and squashing them into a messy tarball is not the "preferred form of the work for making modifications", and that a manual process where you have to fill out a form in order to get a Google Drive link a week later is not "a medium customarily used for software interchange" in current times. Those are quotes from the GPLv2.

flotzamon Dates That Don't Exist (2015)

And indeed that's Python's calendar:

'A date object represents a date (year, month and day) in an idealized calendar, the current Gregorian calendar indefinitely extended in both directions.'

'This matches the definition of the “proleptic Gregorian” calendar in Dershowitz and Reingold’s book Calendrical Calculations.'

https://docs.python.org/3/library/datetime.html#id2 https://docs.python.org/3/library/datetime.html#id5

Whereas Ruby has proleptic Gregorian Time, but civic DateTime:

https://ruby-doc.org/stdlib-2.6.1/libdoc/date/rdoc/DateTime....

flotzamon Kill The Cookie Banner

The malicious compliance aspect is that they're not offering a choice between "tracking" and "no tracking", but bundling "no tracking" + "painfully degraded functionality" (like repeating the question on every page) = "strictly necessary cookies only"

flotzamon Memory Safe Inline Assembly

They acknowledge that it's odd, and give this justification:

"Using runtime panics has the nice property that inline assembly in dead code doesn't get in the way of porting software to Fil-C. Also, it's consistent with how Fil-C usually reports errors."

flotzamon Why do commercial spaces sit vacant? (2025)

Ah. That makes sense. Maybe the polite fiction would clash too obviously with accounting standards once the (de facto) lowered rent payments roll in: https://news.ycombinator.com/item?id=48567769

Could the situation be improved then if financial regulators started treating both versions ("temporary" vacancy / "temporarily" lowered rent) equally? Tolerate both or crack down on both.

flotzamon Why do commercial spaces sit vacant? (2025)

How come this obvious workaround isn't used much more often:

>> If the system allows you to pretend that the vacancy is temporary, why doesn’t it allow you to lower rents on the pretense that lower rents are also temporary?

> This does happen sometimes: it’s packaged as “incentive offers,” like 50% off the first 12 or 24 months rent, or 6 months without rent, etc, that lower the average rent over the life of the lease without lowering the “list price.” That’s common in residential leases, and I know it happens sometimes in commercial leases, but I don’t know how prevalent it is.

flotzamon London's Free Roof Terraces

Ok that one looks legit :)

I was thinking more about his experience with e.g. the last one on the page, Roof Garden at The Post Building:

> I still don't understand why it's here nor why it's open daily, nor why they insist on Photo ID "and a full written name" before they'll let you up. However I didn't get the chance to test this out yesterday because when I arrived the roof terrace was "closed due to essential maintenance work", inconveniencing probably nobody but myself.

flotzamon London's Free Roof Terraces

> more likely to get planning permission if their new skyscraper included a free public roof terrace

If that's the deal, it's crazy that some of those places are getting away with then discouraging the public from actually going there. Book your visit in advance! Present ID! Photography forbidden! This grumpy security guard will be hovering nearby <3

It's like Nathan For You S03E01 where a store advertises a $1 TV, then tells the drawn in would-be customers to please respect the black tie dress code, crawl through a tiny door, and squeeze past the alligator.

flotzamon How Monero’s proof of work works

https://kycnot.me/?categories=aggregator

https://kycnot.me/?categories=exchange

flotzamon We found a stable Firefox identifier linking all your private Tor identities

Tor Browser is always quick to rebase on the latest Firefox ESR. They released an update the next day:

https://blog.torproject.org/new-release-tor-browser-15010/

flotzamon Keep Android Open

They are not affected (except through second order effects, e.g. some FOSS app developers might give up on development)

flotzamon Is Germany's gold safe in New York ?

He posted it at 8:03 AM though... (12:03 PM UTC, and he was in D.C.)

https://truthsocial.com/@realDonaldTrump/posts/1163519987825...

flotzamon Full network of clitoral nerves mapped out for first time

Isn't type 1a circumcision (removal of the clitoral hood, but not other parts) very rare? At least that's what the Wikipedia article claims, referencing a 2008 WHO report.

flotzamon New information extracted from Snowden PDFs through metadata version analysis

At the bottom of the page there's a link to the pdfresurrect package, whose description says

"The PDF format allows for previous changes to be retained in a revised version of the document, thereby keeping a running history of revisions to the document.

This tool extracts all previous revisions while also producing a summary of changes between revisions."

flotzamon Iran Goes Into IPv6 Blackout

Right, I should have written "IPv4 bridges" (which can be obfuscated and distributed out of band), not "IPv4 entry nodes": https://bridges.torproject.org/

But you can reach the IPv6 internet through those too.