mook

Also, as mentioned elsewhere in the thread, more scrapers. They're trying to keep things accessible without JavaScript, which mostly rules out the typical proof of work solutions like Anubis (which they're definitely aware of, as they had an article on it).

https://news.ycombinator.com/item?id=48864252

Up to Win2k, I don't recall new releases of Windows leading to people lamenting the UI changes; I do remember people not liking the initial look of XP, though. Maybe it's just because complaints got more visible after the Internet became popular, though. But even now few people seem to have strong preferences for, say, Windows 1.0 (… which was pretty much a TUI, IIRC)

Yeah, I've been working around that for now by uninstalling notepad. Which actually uninstalls the store app, which in turn exposes the actual notepad executable that ships with Windows. Really confusing, and will probably break in some future version of Windows.

I don't understand why they didn't just stuff all the AI things and new features in Write, where it belongs…

Interesting, I don't really have downtime with my OpenWRT setup. Probably because I don't really touch the setup once it's there, other than occasionally doing the firmware updates.

Well, I looked it up and the game shipped in the early 2000s, and listed Pentium 266 as minimum requirements (Pentium 500 recommended).

I don't recall the 386 era and the DVD era overlapping that much…

I think a better take is:

> Do you use personal / behavioral data / usage to shape the user experience and recommendations? You do not get covered by Section 230.

If they get to exercise editorial powers, then it doesn't make sense for them to be protected from liability for choosing what to publish. If they just give you a giant firehose, then they're not doing anything editorially and they should not have any liability as clearly that's not _their_ speech.

Well, they seem to have started shipping parts of that; recently I noticed https://play.google.com/store/apps/details?id=com.google.and... was installed for me.

Presumably MCTR was MicroCenter as well.

Meh, in the early days of DVDs I recall a game that came with uncompressed 48kHz audio. Compress it to mp3 (which the game naively accepted if you had the correct Windows filters) and it fits in a CD.

I remember somebody trying to hook into the Apple Find My network (that is, do things with AirTags). They did that by… being a Mail.app plug-in or something to get the correct entitlements? That certainly sounds like the wrong permissions.

Ah, it was OpenHaystack: https://github.com/seemoo-lab/openhaystack#installation

Hmm, shouldn't the diff start at the tag? That is, it seems like it should be https://github.com/sqlite/sqlite/compare/version-3.51.2...an...

Which says they made two commits to make instrumentation work. Also, no fixes (which seems reasonable to me; need to figure out what's wrong first)

Presumably any bugs found are being sent upstream to fix.

I agree; in practice, probably only the public error types, though. If it can return fmt.Errorf("…%w…") I probably only need the type of the wrapped error, not whatever type the implementation uses.

I was under the impression that SHAKEN / STIR was supposed to do that by authenticating the phone numbers displayed against the telco that made the call. But as the other comment says, your telco earns money from scam calls and they don't want that to stop.

Isn't prompt injection basically social engineering for LLMs already anyway?

Hmm, I don't know the area well; why would 2FA have been relevant here? From the (unverified) story, the account was administratively handed over via support; there was no indication from any party that the account was hacked. So 2FA prompts would never be part of the picture.

Interesting. At a smaller company I worked at, the CEO was a sales role, as far as I could tell.

At scale, testing software is appreciably more expensive than using hardware. That's why at most people test a tiny slice of it, and ships out broken software in the hopes of fixing it later. Testing hardware is expensive because nobody thinks it can be fixed cheaply afterwards.

See also: the article linked to this thread.

That's why we have Android Auto: move the updates to a thing that already has frequent Internet connection, and if the update goes wrong it's clearly the fault of this other company, plus the car itself still works fine.

Jeep already had an OTA the broke the ability for the car to be driven.

Nice, [3] reminded me of OpenGrok † the old Sun project that was basically LXR on steroids.

† https://oracle.github.io/opengrok/

I keep getting things like "denial of service when the SCSS or whatever parse is given malicious input”. Great, that's part of the build chain, all of its inputs are stuff we control. Why do we care.

But updates to broken packages are still allowed: if a new version is pushed within the three days, it does not reset the cool-down. You just get a pull request to update to a known-bad version instead.

I don't see how you can tell it's AI, instead of just your co-workers having no respect for language. See: management-speak using "double-click".

I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.

That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…

For some reason, that holds an appxbundle per the article. I'd suspect they needed to run some pre- or post-install code (maybe to check for their hardware?).

I use KeepassXC, but I have no need to share passwords with other people. In a corporate situation that would probably not work as well.

Don't forget the insurance, plus the hospital has costs that must be paid for too. A surgery with _just_ the surgeon and no support staff isn't one I'd want to be in.

(Not in the medical field at all)

This is the sort of trademark violation where I can get behind proper enforcement. It's using the name of an unrelated project for advertisement (attention).

That page eventually leads to the CVE page: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

While that's still pretty vague, it sounds like the issue was that something running as SYSTEM (the page seems to indicate some part of Windows Update) was not correctly checking if inetpub was a symlink or something along those lines. It also links to a script to set ACLs on that directory; presumably that's not possible to do if the directory doesn't exist.

It would probably be better to fix whatever component to not have the link traversal bug, but maybe there's some reason that makes the proper fix infeasible…

It sounds like it's the editorial decision (of what to promote) is the accountable thing; that seems reasonable to me. Looking at the comments on that thread, it sounds like non-editorial sorting ("simple categorization and indexation") would still be fine.

That's because the client certificate interface in browsers is supremely dumb. It always just lists all certificates you have, with very little context in the UI, and hopes that's good enough. I believe that's part of the reason client certificates are not poplar; having actual users deal with that is terrible, and the browsers (in practice, Chrome because of its overwhelming market share) isn't incentivized to fix it.