kqp

Three things one must never ask: a woman her weight, a man his salary, and an HN commenter what “use case” the GPL ruined for them.

Also, speech is probably bottlenecked by speed of thought, not making the sounds. I recall some study showing that data rate is pretty consistent between languages, despite wpm varying significantly due to language verbosity. You can try it yourself: try to quickly repeat “one two three four five” then try to read a paragraph out loud as quickly as you can, I bet you can feel the first strain your muscles and the second your brain, and I bet the first blows your typing wpm out of the water.

I don’t think you understand what consent means.

Can we get a title edit? OP’s title implies this is a Git bug, but the bug applies to half of macOS, including curl, openssl, python, perl, and ruby, and to only the macOS version of Git. The original title is less misleading, but personally I’d have titled it something like “macOS still trusts the compromised eMudhra certificates in git, curl, openssl, python3, perl, ruby, more”.

Man, this comment section is not good.

I was surprised recently when I tried to really dial in the colors on my personal website, and found that I perceive and get a different feeling from a hex code change of only 1. I didn’t test whether it’s just me or whether this particular color makes it more visible, but I did test a few monitors, including a bad one. So, I get feeling some way about a specific hex code, if you spent longer picking it than we usually do.

I do, though, wonder what the idea behind assembling a centralized registry is. Is it about making a few favorite very specific colors easier to refer to? Browsing colors? Browsing ideas people have about what colors mean? What would the ideal ultimate form of this list include, every color? What’s the difference between a good name and a bad one?

So, reading between the lines, somebody pressured them hard but they’re providing instructions to DIY instead?

Try turning off autocorrect. It seems like a non-option, but I found it made my mobile typing skill greatly improve over the following months, to the point I’m now just as fast while also fully removing that frustration from my life, and also not reliant on a particular phone. Retrospectively, it makes sense: autocorrect numbs feedback, removing the mechanism by which we learn to subconsciously and quickly do what works and avoid what doesn’t.

People absolutely know what they experienced, they’re just guessing about what went wrong and how to fix it. “I hate AI” doesn’t necessarily mean “I can only please this person by not using AI”, but it sure does mean there’s something about your AI this person hates. “The economy’s doing poorly” doesn’t tell you about Nvidia’s stock price, but it does tell you about this person’s experiences and information exposure.

I think the core problem is they’re called passkeys and evangelized as a replacement for passwords, which makes people think they’re like passwords or like keys—secrets we’re responsible for not losing—whereas actually they’re like session cookies. They’re a fast path in that you’re meant to be able to create, delete, and even clear all of at will, with no penalty but that you’ll have a fussier login next time. They sure do suck as an only way in, they’re not even meant to be able to do that.

I think the dogmatism stems from Google, which delivers this advice as unconditional instruction and often gets parroted, makes the main website grading tool that calls it an error, and says they’ll drive less traffic to you if their grading tool rates you poorly.

Also, I think also led by Google, `font-display: block;` actually behaves the same as swap now, just with a longer wait for the font to load [1]. Iosevka’s webpage does use swap, though.

[1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/A...

I was thinking of push notification data and skipping several other significant partial leaks. After a little research, I think I overstated the push data leak, though it’s still significant. Anyway, framing it as copies was a rough approximation, the issue is many high probability partial copies resulting in virtual certainty of unencrypted access to any desired data.

iMessage leaks I know about:

- iCloud backups. While I appreciate Advanced Data Protection, I still count this because it’s not available everywhere, most people have it off, and most people with it off are unaware of it backdooring the E2EE marketing they still saw.

- Recipients’ copies, and all the ways their copies get copied. Yes, tricky to address, that’s the comment. While no app can guarantee no unencrypted recipient copies, privacy focused apps do make it not happen unintentionally and by default.

- APN leaks the timestamp, sender, and recipient of every message. Especially powerful in combination with recipient copies.

- Apple controls the key directory and can MITM at will. As usual, see Signal for a high profile attempt at a centralized key directory that’s resistant to controller abuse.

- Contacts, Siri, and Apple Intelligence all ingest then upload iMessage data.

- No source code or reproducible builds. Obvious reasons, still a real hole.

Others have already pointed out that your assumption of Apple TV not spying on you is wrong, I’d like to make a meta-comment on that.

Apple regards privacy as a feature, and I mean that precisely: some places they implement it, other places they decide it’s not worth it, and they only ever tell you about the former. A good example is iMessage: everybody in tech knows it’s E2EE, many fewer realize that the other three copies of your iMessage data on Apple’s servers are just, uh, not encrypted.

You can’t have the same intuition for Apple and privacy that you would for a group like Signal. You need to instead ask yourself whether you fully understand what you need, then whether Apple has guaranteed precisely and fully that, without weasel words.

I must confess, I don’t actually think I can. That’d be pretty sweet, though, if we could.

TVs died. Not fully, but they went from the ubiquity of smartphones to the “oh yeah I’ve got one lying around” of VR. The shit they’ve been up to since is a response to trying to recover a much bigger industry’s profits by juicing a remainder that they’ve realized is so inert they’ll let you do anything to them. I really hope the resemblance to mainstream tech is minimal.

Hey buddy, you’d better be careful what you post on a public forum. Sooner or later somebody’s gonna ask their own personal LLM to write a comprehensive test suite for how you respond to comments and situations, move the mouse cursor upwards and to the left to click a button there, and recreate you as legally their property now. If I were you I’d gimme money gimme moneyyyyyy before my big LLM here teaches you a lesson the hard way.

You don’t have enough tokens for time pressure?

I’m honestly having a hard time understanding you through all the tribalism.

Asking who to blame is simplistic and unproductive, the right question is what to do. As a user, obviously that involves things like updating your understanding of the network stack and the many different places config is stored. I was commenting from a UI designer’s perspective, because I am one and I find that more interesting.

I think Linux for consumers has been historically quite bad at this, and Apple has at least recently also been bad at it. “You’re holding it wrong” is the same mistake.

Requiring users to independently remember small decisions from months ago is bad UI. The error message should’ve been correct, and maybe the OS should be surfacing a log or something.

FYI, a few months ago Firefox finally put local network access behind a per-site permission, so websites can’t port scan you even if Firefox itself has this perm. Chrome has had this forever. There’s also a uBlock Origin filter list to block LAN access, which I think would not prevent top level navigation to it.

I just don’t have enough time for that.

I think it was looser on release for those juicy benchmarks, tighter now. On release I wasn’t getting refusals, then a few days ago I asked it whether a generic quote (think “he walked to the store”) broke standard punctuation rules, and it blocked me for breaking rules. I wish I were joking. Rephrasing to not use the keyword “rules” worked.

Relatedly, Apple finally kicked me off the quick update bandwagon with macOS/iOS 26, and I was surprised to learn that no, Apple does not let you just say no to updates. You get a permanent red badge that you can only dismiss by fully turning off system notifications, you get nagged literally thousands of times, and if any of those times you don’t repeat your rejection quickly enough, it overrides your non-consent and updates. That’s all with updates turned off. HN comment sections had led me to believe that consensual updates are a pro of Apple over Windows and an example of Apple’s class, but they don’t exist, the actual software is everything people lambast Windows for.

“Pick all the numbers in the range with exactly the same probability” is a very important property of RNGs. Yes, skipping 16542 would be equally bad.

You can frame it around being “non predictable”, but then you need to define those words. It’s not, for example, a poker game where it’s trying to bluff you, right? It’s also not about just making predictions < 100% reliable and declaring victory. It must specifically make all predictions no better than random guessing, and that entails picking any number in range with equal probability, otherwise predictions like “it will be {hot spot}” or “it won’t be {cold spot}” do better than random chance. In this case, specifically, I can predict with 100% accuracy that the result won’t be 0, and that’s a flaw in its unpredictability. I can also predict a bunch of other things with slightly higher accuracy than random guessing, like that it will be odd or greater than max ÷ 2.

Calling something cutting edge one year ago “ancient” is absolutely wild. To me that word means, like, pre Apple Silicon.

Thanks! I have indeed used Claude only for text, not websites, so wasn’t familiar with the visual clues.

Why do you think it’s vibe coded? Just asking to see if I can learn something. I can see it’s very standard corpo-aesthetic, uses callouts for the sake of callouts, and is horribly laggy, but corpo websites were doing all that long before AI. It also seems to be using a bunch of Cloudflare-specific terminology that I’d think would take longer to review and correct an AI on than to type yourself.

Copy known good serial number + signature.

How else could it possibly be done?

Like a red headed stepchild.

Goodwill liquidation is what I’ve been calling it.

I think we might be coloring it as we’d like it to be, though. Only rarely does it end in brand death, more often they just get a bad reputation then keep going, sometimes not even less profitably. I think the intent might be more along the lines of recalibrating to a lower expectation of consumer discernment or rationality.