Hacker News Reader

microtonalon Asahi Linux Progress Linux 7.3

I don't.

- MacBooks are still among the nicest if not the nicest laptops hardware-wise, so some people like to run Linux on it.

- People have older Macs that they like to repurpose. E.g., we still have an M1 Mini that was used by our daughter before she got handed down a MacBook from my wife. It's now collecting dust, but I might install Linux to use it as a headless server.

Also, this is Hacker News.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

But the phones were also under some form of MDM, maybe they could have used that?

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

iDEAL | Wero was just a rebrand of iDEAL to make people get used to the new name Wero. The actual Wero roll-out has only just started. ASN and Bunq seem to be the first Dutch banks to actually roll out Wero (and not just renaming iDEAL to iDEAL | Wero).

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Nah. Unified Attestation is an initiative by some some companies that really have terrible security (years old kernels, drivers, firmware, often way behind on Android updates). They are also known for campaigns against GrapheneOS, including astroturfing. They also do a fair amount of eurowashing (in particular Volla, who sell UAE/Chinese phones as a European phone with a markup of hundreds of Euros).

If Unified Attestation would become a standard, they would use it to entrench themselves over GrapheneOS et al.

AOSP has an API for remote attestation attestation. Banks should just come up with a list of signing keys to be trusted. Heck, they can start here:

https://grapheneos.org/attestation.json

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Because there will be no more security updates of firmware, drivers, kernels, etc., all while there are monthly high/critical CVEs.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

I already addressed this in my comment:

If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank

It is also just very hard in practice. A lot of people have their mortgages, savings that are locked for years, etc. at a bank. Also, switching a bank also impacts other family members if you have shared accounts, etc.

In this particular case it's also not fully clear yet whether Wero is starting to enforce this. If that happens to be the case, it's only a matter of time before other banks also start requiring Play Integrity for Wero transactions.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Indeed. It also fights symptoms rather than the underlying issue - that Google Play Integrity is an anti-competitive method that Google uses to shut out competition. The fact that Google-certified phones that are months behind on critical security updates (or even have malware in there updates as a recent case) do get a pass, shows that it is not really about security, but about destroying competition in the smartphone ecosystem as early as possible.

The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.

Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can understand the argument that it serves some legitimate uses.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

You fell for really shoddy reporting by AD/HLN:

According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.

His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

There might not be any alternative because it would cost too much money to develop and more importantly to distribute it.

https://grapheneos.org/articles/attestation-compatibility-gu...

If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Also, Wero is going to be used for tap-to-pay in stores (initial roll-out planned for 2027). Carrying a second phone is going to be old pretty soon. Also, I think we should fight this on principle.

microtonalon Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).

microtonalon Motorola Signature 27 with GrapheneOS support

Not this narrative again. There are many people who don't fit in those groups who use GrapheneOS. For instance, because they like vanilla Android (which barely exists anymore outside GrapheneOS and perhaps Lineage), their phone not to be preloaded with all kinds of adware (including forced AI assistants), like a phone that is not controlled by big tech, etc.

Some of those people will also buy a premium phone because they want to have a great camera system.

microtonalon Motorola Signature 27 with GrapheneOS support

I'll wait a few months for prices to go down a little, but I'm excited to get one.

microtonalon It wasn't AI that flipped Proton's charge

As a paying customer, I wish they would first the products they already have. E.g. shortcuts rarely work in the Proton Mail web interface last time I tried it. Or if I share folders with a family member, they don't get actually synced by the Proton Drive client (they can only be accessed through the web interface).

microtonalon Smear Campaign Towards GrapheneOS

Likely intended to promote the less secure devices and get them in the hands of those the state would like to target.

I think the whole thread misses the mark a bit, because the source that the GrapheneOS account used (Algemeen Dagblad) did not properly research this. For Dutch readers, this is not really surprising, since the AD is not known as a quality newspaper and tends to go for sensationalism (though slightly less bad than De Telegraaf). Other sources are much more detailed:

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

AD could have written something similar if they did their homework in understanding the case.

tl;dr mostly shoddy journalism from AD.

microtonalon Smear Campaign Towards GrapheneOS

/e/OS rarely updates Linux kernels or firmware, even though they have a continuous stream of CVEs. For instance on Fairphone 6 (which is one of the better /e/OS devices when it comes to updates) is still on Linux 6.1.138 from May 2025. The firmware blobs, including Qualcomm firmware blobs are from April 2026, so missing six months of fixes for high/critical vulnerabilities:

https://docs.qualcomm.com/securitybulletin/october-2026-bull...

Then, they only roll out ASBs, which fixes vulnerabilities that have been known for up for six months, because they don't roll out embargoed patches like e.g. GrapheneOS does (and these vulnerabilities have been known for months through reverse engineering).

If that wasn't bad enough, ASBs only fix vulnerabilities high/critical, for all other fixes you need QPRs and major releases, but /e/OS is behind major releases. If you are still running Android 16, your phone has vulnerabilities that are known for up to two years. Yes, they are low/medium, but they are used in exploit chains. This recently got worse, because Google recently started only rolling out some high/critical fixes to Android 17 and not older Android versions.

Then there is all the shady stuff that Murena doesn't tell you about, like running Google's proprietary DroidGuard blobs in a privileged process on Play Integrity requests. Giving certain Google apps higher privileges than the normal Android app sandbox. Installing F-Droid packages through a proxy (CleanAPK), that they do not want to reveal the owner or purpose of, etc.

Why don't the GrapheneOS developers like Murena? Because Murena often instigates in interviews that GrapheneOS is for criminals, etc.

If you care about security (or privacy) at all, don't use /e/OS.

Disclaimer: I am not affiliated with the GrapheneOS project in any way. If you don't like GrapheneOS but care about having some basic security, then get an iPhone.

microtonalon Norway makes shithouses great again

Similarly cool reprisal from Trump 1 (made by a Dutch comedian, which was then many countries copied): https://www.youtube.com/watch?v=ELD2AwFN9Nc

microtonalon TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

If you wants something with a nice web interface, probably OpenWrt [1] or OPNsense?

[1] Yes, it seems that they are still on 6.12.112, but they'll probably roll out an update quickly. Also see: https://forum.openwrt.org/t/cve-2026-98432-kernel-update-or-...

microtonalon TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.

Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?

[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...

microtonalon Molly (Signal fork) has not been updated since 3 months and is vulnerable

That doesn't address the criticism that this thread started with:

Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client.

microtonalon Tomáš Mikolov awarded the Medal of Merit by the President of the Czech Republic

Thanks. I misused the idiom as a non-native speaker, well try to remember next time!

microtonalon Tomáš Mikolov awarded the Medal of Merit by the President of the Czech Republic

Not to downplay his accomplishments (I have sung my praises in another comment), but even vector models were already around and somewhat popular before. Much of it started in Information Retrieval with things like TF-IDF vectors and later PPMI matrices that were converted to small, dense matrices with SVD. Of course, later Yoshua Bengio et al. introduced neural language models for training embeddings.

There is even a paper by Levy & Goldberg from 2014 that shows that skip-gram with negative sampling implicitly factorizes a PPMI word-context matrix.

But Mikolov's formulation is very nice in that it is a simple linear model that allows for a very simple Hogwild optimization that worked very well/fast on multi-core CPUs of the time.

microtonalon Tomáš Mikolov awarded the Medal of Merit by the President of the Czech Republic

Well-deserved. Even though more complex language models won in the end, his stripping down of word embedding training from RNNs/convolution models to a simple linear model was the thing that was needed for compute at the time and completely dominated the field for five years or so. I do miss the times a little where you could train a cutting-edge model with a reasonable CPU (for training embeddings with word2vec) and a single GPU (some BiLSTM or transformers before BERT).

If I remember correctly, I read somewhere he initially had a hard time getting the word2vec paper accepted at a conference.

microtonalon MacBook Pro with PROLED XDR Display and Touch

And the first iteration did not have a physical Esc key (which they brought back later).

microtonalon Apple's git still trusts the compromised eMudhra certificates

Maybe you have another curl in your path?

    $ uname -a
    Darwin MacBook 27.2.0 Darwin Kernel Version 27.2.0: Wed Oct 14 23:47:21 PDT 2026; root:xnu-13432.41.4~25/RELEASE_ARM64_T6030 arm64 arm Darwin
    $ which curl
    /usr/bin/curl
    $ curl https://dv-g3b-emudhra.we-have-a-problem.com/
    Your client successfully connected to the site. That's bad!

microtonalon Root shell on Samsung TV

I think it’s not worth it to them as long as 99.9% of the users hook up the TV to their home WiFi. Connecting to other networks without user confirmation probably opens a can of worms in many countries.

microtonalon Amazon's "digital pacifier" for toddlers

Our kid has certainly not had access to tablets/phones the first years of her life and only rarely until she was 9 or 10 or so. We have also banned phones from the dinner table, etc. from the beginning.

Parenting takes time and focus. Putting 0-6 years olds behind a tablet screen is just absolving yourself from your responsibility as a parent. Some TV time can be ok after 3 years or so, but you have to time it strictly (so that it does not become a convenience) and exclude some types of cartoons [1].

[1] https://thesciencesurvey.com/editorial/2024/07/07/the-proble...

microtonalon Root shell on Samsung TV

Disconnect it from the network and hook up a streaming device that is relatively trustable (e.g. Apple TV or an open source alternative).

microtonalon The Lego group reveals collaboration with Daft Punk

I wonder if LEGO is going to follow the same fate, to no longer be of interest to Roblox and Minecraft obsessed kids, to develop an increasingly elderly customer base, ending up with just retirees.

I don't think this is true at all. Our daughter played a lot with Duplo and then Lego from ~2-12. Overall, she must have collected thousands of Euros of Lego from birthday, Christmas, and Sinterklaas presents. When friends were over, they usually wanted to play with Lego.

Us older people who remember the days of Lego without franchises and a focus on your own creativity/imagination might be grumpy about modern Lego (though they have been good at making adult Lego sets as well). But Lego is still wildly successful because they found ways to connect with younger generations and the franchise-based Minecraft/DC Comics/Star Wars/Harry Potter/etc. Lego is exactly one of the ways they have managed to do this, along with Lego for specific focus groups (e.g. Lego Friends).