HNHacker News
TopNewBestAskShowJobs

newscracker

8,153 karma · joined July 26, 2013

Techie.

Value privacy and freedom. Strong dislike for online tracking, privacy intrusions, DRM, etc.

Love (FLOSS) software like Mozilla Thunderbird, Mozilla Firefox (with several extensions), Ad blockers and tracking disablers, VLC, LibreOffice…donate money to them as a show of support.

For those who wonder why privacy matters, this is a concise article I always point to - "Privacy protects bothersome people" [1] by Martin Fowler. There's also "Nothing to Hide – a documentary about surveillance and you" [2]

Recommendations: Don't use WhatsApp [3]. Don't use Chrome browser. [4] Don't use Facebook (needs no explanations).

[1]: https://www.martinfowler.com/articles/bothersome-privacy.html

[2]: https://vimeo.com/189016018

[3]: https://www.eff.org/deeplinks/2016/08/what-facebook-and-whatsapps-data-sharing-plans-really-mean-user-privacy-0

[4]: https://blog.cryptographyengineering.com/2018/09/23/why-im-leaving-chrome/

hnchat:eemynUE5V50ZFdTyjq3S

submissionscomments
newscracker··on Bypassing airport security via SQL injection
I’m not sure any country’s bureaucracy really appreciates responsible disclosures that make the government’s systems look very poorly designed. There is always the risk of being classified as an enemy agent/criminal depending on who’s reading the report and their own biases.
newscracker··on Bypassing airport security via SQL injection
> You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail.

I think it could go any which way. The prosecution could argue that the defendant may have tampered with existing records or deleted some. In this particular case, it’s probable that the system does not have any or adequate audit trails to prove what exactly transpired. Or the claim could be that the defendant exfiltrated sensitive data (or that the defendant is trying to hide it) to share with hostile entities.

newscracker··on Claude 3.5 Sonnet
So when someone lets (or has) their phone service get disconnected and the company recycles that phone number shortly, the person who then gets this phone number is out of luck if they want to use Claude?
newscracker··on Mozilla roll out first AI features in Firefox Nightly
This post is very thin on details. A better source is in the Firefox Nightly News blog post titled “Experimenting with AI services in Nightly”. [1] This is currently opt-in.

Some excerpts from that post [1]:

> To start, this experiment will only be available to Nightly users, and the AI functionality will be entirely optional. It’s there in case it’s helpful, but it is not built into any core functionality.

> In the first experiment that you can try out this week, you will be able to:

> Add a chatbot of your choice to the sidebar, so you can quickly access it as you browse.

> Select and send text from webpages to.

> Summarize the excerpt and make it easier to scan and understand at a glance.

> Simplify language. We find this feature handy for answering the typical kids’ “why” questions.

> Ask the chatbot to test your knowledge and memory of the excerpt.

> To activate the experience:

> Go to Settings > Nightly Experiments and turn the AI Chatbot Integration experiment on.

> Choose your preferred chatbot from this list of providers: ChatGPT, Google Gemini, HuggingChat, Le Chat Mistral

> Then, as you browse, select any text, right-click it, and choose the Ask chatbot option to send the text, page title, and prompt to your provider.

[1]: https://blog.nightly.mozilla.org/2024/06/24/experimenting-wi...

newscracker··on Snowden: "They've gone full mask-off: do not ever trust OpenAI or its products"
In light of this, Apple’s choice to integrate with ChatGPT from OpenAI looks worse. Even with its privacy promises of not revealing much information and asking the user explicitly, these and other events in OpenAI should trigger serious concerns with Apple executives. The top Apple executives have said that they started with ChatGPT because it’s the best. Maybe this partnership won’t be around this time next year.
newscracker··on Apple's new AI leaves out more than 90% of current iPhone users
I think it’s a poor decision by Apple if Apple Intelligence running on Apple’s Private Cloud Compute is not available on even a one year old phone like iPhone 15/15 Plus or a two year old iPhone 14 Pro/Pro Max.

Since this service is launching as beta later in the year and is limited to US English, it seems like just a beginning. Anybody buying an iPhone 16 or iPhone 15 Pro just for this may be in for a rude awakening when they’re left out next year with iPhone 17 getting better features on AI.

I agree with Mark Gurman when he says — in this piece [1] titled “ Apple’s Push to Infuse Devices With AI Will Take Years to Pay Off” — that the current plan of release isn’t going to fuel an iPhone sales supercycle for the iPhone 16 series.

[1]: https://archive.ph/srPHa

newscracker··on Thinking out loud about 2nd-gen email
> Same for spam filtering. Reject at the SMTP level for invalid sender identification.

This is what Posteo (posteo.de) does by default* instead of accepting emails and putting them in a Spam folder. [1] It checks for a few different things and rejects the mail if the spam criteria are met. In my limited experience, many mail server admins of large organizations don’t even look at these email rejections to take any action. The result is that the mails keep getting rejected and the receiver doesn’t even know the context or content (by design).

* Posteo now has the option of accepting mail and putting it in the Spam folder too, if one desires this mode of operation.

[1]: https://posteo.de/en/help/how-does-the-posteo-spam-filter-wo...

newscracker··on Give Me Back My Sunsets! The time Instagram wrongly banned me
Good for the author to have connections within Meta to get this resolved. For anyone else, this would’ve been the end (and probably worse, if Meta did inform the authorities with whatever information it genuinely believed it had). In my experience, Instagram has more rogue bots and algorithms that ban accounts for nothing than Facebooking does.

I don’t get the author’s glee towards the end of the post. If the author’s livelihood depended on Instagram, sure, go back to the platform and be thankful the account was restored and that the connections in Meta helped. If not, time to move on. It’s not like Meta has been a benevolent corporation that deserves more chances.

BTW, other platforms aren’t safe against such actions either. The main competitor of this platform on the Fediverse has an official instance where your account could just go poof without any notices over emails, without any appeals process, without any response from the single admin, etc. I presume many Mastodon instances would operate similarly.

If your social media account is extremely important to you, your best account-and-content-preserving choice is to host it on an environment you control and hope that other instances don’t block you for their own random reasons.

newscracker··on Ask HN: Would you send a photo holding your drivers license to rent a VPS?
Of course, you’re not crazy. The more the number of people who just give in, the larger and more widespread this problem becomes.

IMO, this is one of the ways governments get more ideas — to encourage companies or have them collect a lot of data so that they (the government agencies) can legally (or even illegally) demand them for mass surveillance and their expeditions. It’s like a fire hose that won’t stop.

newscracker··on Proton Mail discloses user data leading to arrest in Spain
That blog post was last updated in November 2022, and does not mention recovery email address as something Proton would disclose.
newscracker··on Proton Mail discloses user data leading to arrest in Spain
You seem to be confusing privacy with practicality. In practice, nothing is ever secure, nothing is ever private and nothing is ever safe.

What matters here is what Proton promises and advertises to users/potential users vs. what it can actually deliver. I don’t know if Proton is more open about this, but hopefully this isn’t just buried in some long Terms of Service that almost nobody reads.

newscracker··on Open-Shell: A collection of utilities bringing back classic features to Windows
Keypirinha (a launcher) works well with Everything. Both are free. The former hasn’t been updated for a few years, but it still works for launching applications, performing quick calculations, currency conversion, etc.

[1]: https://keypirinha.com/

newscracker··on Android 15 may make it harder for sideloaded apps to get sensitive permissions
> Apps like Truecaller refuse to work without so many permissions.

Android apps have had bad habits for a very long time because Android didn’t have the granular runtime permissions system like iOS did (Android had only install time permissions that was either grant all or no install allowed). Even though Android brought granular runtime permissions from version 6 (?), apps have continued to badger users for every permission that allows them to collect more data. Android users have also been conditioned from the beginning to provide all permissions. So apps expect them to provide what they ask or refuse to work.

On iOS, Apple has stated in its policies for a long time that apps should continue to work even when permissions are denied (with obvious caveats, like for example camera not working if camera permission is not granted).

It’s a stark and disturbing contrast when comparing how Android apps refuse to work whereas the same app by the same developer on iOS would be a lot better behaved even when various permissions are denied.

BTW, Truecaller on iOS will work without getting permissions to access contacts. It will also work if it’s not given access to SMS.

newscracker··on Happy 20th Anniversary, Gmail. I'm Sorry I'm Leaving You
> I do not blame anyone but myself for this. This is not something the corporations did to me. This is something I did to myself.

I agree with most of the article, but not with these statements. The corporations are certainly to be blamed for all the problems stated in this article.

While the author may have the luxury to pay for email at $99 a year (even more expensive than Fastmail, which is an expensive service for more than one person), billions of people can’t afford (or don’t want) to pay so much for email. I don’t think we should blame all those people for choosing Gmail (or Yahoo or Outlook or some other “free” service).

newscracker··on Keep your phone number private with Signal usernames
I like the concept of Signal usernames not being public either, and that they’re only a means to tell others how to find and contact them. I can’t wait for this to be rolled out.

It’s not clear to me if it’d be possible to prevent the “contact joined Signal” messages if someone else has the phone number in one’s contacts. That would be a huge thing.

For a little more historical context, with this change Signal has now solved the problems that became widespread during the protests in Hong Kong in 2019 — someone else (authorities) adding random phone numbers to their contacts list, opening a chat app (such as Signal or Telegram) and finding if that person uses that app. Telegram solved this swiftly by adding more privacy controls, [1] while Signal had other priorities.

[1]: https://www.reuters.com/article/idUSKCN1VK2NC/

newscracker··on Google podcasts is shutting down
Before you look at Fastmail or ProtonMail or Tutanota, take a look at (in no particular order), runbox.com, Mailbox.org, mailfence.com and posteo.de (posteo is the only one in this list that doesn’t support custom domains). They’re all cheaper, support IMAP and are hosted in Europe.
newscracker··on AI and Mass Spying
Reminds me of this quote attributed to a past Peruvian president and general, Benavides:

“For my friends, everything; for my enemies, the law.”

newscracker··on State of Mozilla
> First and foremost, allow me to donate to Firefox. Not to the foundation, to Firefox.

I’d like to see this too. They already have a donation option for Thunderbird, which is officially under MZLA Technologies Corporation. There could be something similar for Firefox.

Not complete sure on this, but right now the only way to give money to Mozilla Corporation (the one owning and developing Firefox) is by subscribing to Mozilla VPN (offered by Mullvad). I don’t think any subscriptions to Pocket or MDN Plus go towards Firefox development and support. All these paid subscriptions are available only in certain countries though.

newscracker··on Google is deleting inactive accounts. Here's what that means
With increasing backlash and criticism, I’m guessing that Google will be forced to backtrack on this and provide more leniency, just like it had on the legacy (free) Google Workspace accounts.

> You'll have to take an extra step if you want to hold on to content from a specific product that you haven't used in some time. If you want to keep photos from your Google Drive, for example, it's best to sign in to that particular service.

> That's because the tech company says it "reserves the right to delete data in a product if you are inactive in that product for at least two years. This is determined based on each product's inactivity policies."

I fail to understand why one needs to access every service on the platform to avoid losing data. All of them are tied to one Google account. Logging in to one (like Gmail) should ensure that Google Drive data shouldn’t be deleted. This is just stupid policy!

Large companies offering ad-supported “free” products cannot and must not be trusted. If you have some money and time, you can choose a different provider for email. Pick from (in no particular order) runbox.com, posteo.de, mailbox.org or mailfence.com. They’re quite cheap compared to other popular paid email providers and also support IMAP so that you can own your data and migrate if needed. If you need a lot of mailboxes for a fixed price, you can try migadu.com or mxroute.com (the latter hosts data in the U.S.).

For other services, the migration path is either complex and/or costly or impossible. Still, moving out should be explored.

newscracker··on Microsoft was not a winner of the events of the last few days around OpenAI
I think, where feasible (to fit in HN’s length limit), tweet submissions should include the name of the person and/or title. This tweet is by Matthew Prince, CEO of Cloudflare.

While being terribly annoyed with the events since Friday (not because they affect me directly but because of the sheer amount of useless noise created by them), I was thinking that these folks joining Microsoft are short sighted and won’t last or stay very long there. I’m glad to see an echo of that here.

> and execution risk (see DeepMind within Google for how all the smartest people in AI can still get stymied by the bureaucracy of a giant company).

> I think the chances of the senior OpenAI folks still being at Microsoft in 3 years is asymptotically approaching zero. Where the independence and clear mission of OpenAI was exactly what could have kept that group of incredible talent motivated and aligned over the long term, making Office365 spreadsheets a bit more clever isn’t something that rallies a team like their’s. Sure they’ll try and have some level of independence, but the machinery of a trillion dollar+ business software behemoth is hard to not get caught up in and ground out by.

I’d give them one year, maximum, before they all split up and either go back to OpenAI or form new companies in alliance with other money-minded devils with deep pockets.

Now might be a good opportunity for others in this space to take advantage of the chaos, and in making things worse for OpenAI and Microsoft. And I can’t wait for this to get out of the news cycle.

newscracker··on What if money expired?
Inflation, negative interest rates and the impending introduction of CBDCs (which will bring along more purpose limited and expiring vouchers too) all cause or will cause money to expire. In other words, these are tools to prod people to spend now or invest somewhere now to keep the consumption economy going.

Depending on the country and other events, entire fiat currencies or specific denominations of fiat currencies can expire and become color paper worth almost nothing. We’ve seen this many times over the last several decades that fiat currency (not backed by gold or other physical asset) has existed.

It’s all about trust from every angle and every motive.

newscracker··on Privacy is priceless, but Signal is expensive
FB is getting and using some metadata from WhatsApp. FB also said it would be introducing ads in WhatsApp. While WhatsApp may not be raking in a lot of money, it’s not a complete loss for Meta either.
newscracker··on Privacy is priceless, but Signal is expensive
Which app would they all use and from where would they get it? Signal does not (intentionally) support the official app using other servers or the platform itself supporting federation. [1]

[1]: https://signal.org/blog/the-ecosystem-is-moving/

newscracker··on Privacy is priceless, but Signal is expensive
This was a nice, detailed read. At some point, Signal would have to move out of cloud providers at least for a few things to manage costs better.

I was happy to note this about employee compensation since paying them well is a good thing apart from their personal motivation to work on this (even at a comparatively lower pay than in other companies/projects):

> When benefits, HR services, taxes, recruiting, and salaries are included, this translates to around $19 million dollars per year.

> We are proud to pay people well. Our goal is to compensate our staff at as close to industry wages as possible within the boundaries of a nonprofit organization.

That said, I really dislike Signal for a few reasons. The first is what many people have already talked about very often — forcing to use a phone number to register. Since the SMS or call costs are quite high, Signal could adopt the iMessage approach to verification, which is having the user send an SMS to the service (this will cost the user some money depending on which country the SMS is sent to). This could be decided based on the country code so that the current SMS OTP model can coexist.

Signal is obstinately user unfriendly on a few aspects on user experience, more so on iOS/iPadOS. Firstly, it refuses to provide a data backup mechanism for iOS/iPadOS. If someone loses their devices, there is no way to restore older messages. Even setting up a new device requires the old device to be in physical proximity to transfer the data. Signal does integrate with CallKit (to act like a phone app) and with Apple’s notification services, but refuses to allow the user to backup the data with a password to encrypt it.

Secondly, I found this paragraph in this post to be disingenuous:

> Such practices are often accompanied by “growth hacking” and engagement maximization techniques that leverage dark patterns to keep people glued to feeds and notifications. While Signal is also free to use, we reject this kind of manipulation, focusing instead on creating a straightforward interpersonal communications app. We also reject business models that incentivize such practices.

Signal on iOS/iPadOS wants the user to enable notifications and to share contacts. If notifications are disallowed and if contacts upload is disallowed, it will pester every few days about it. One might think this is a silly mistake that Signal isn’t aware of. But it was reported some years ago and Signal responded that it will not fix it because it believes this is the only way. [1] Not even an option where this is a toggle for those who want no notifications or don’t want to share contacts (Signal does have a toggle for contact joining notifications).

Signal is also not that reliable in delivering messages in a timely manner compared to other apps (the GitHub repo has many repetitive issues on this topic over all these years).

Finally, since Signal has poorer UX in general, which isn’t an easy or cheap thing to handle, I use it only with less than a handful of people who I know and who use it.

I’d donate occasionally so that Signal can continue to exist, but I don’t feel like supporting it every month with all these issues, some of which look like Signal ignoring the user and UX issues completely.

Edit: Removed some hard words.

[1]: https://github.com/signalapp/Signal-iOS/issues/4590#issue-72...

newscracker··on Signal Public Username Testing (Staging Environment)
Apps like Signal and Wire have shown that multi-device E2EE is possible with messages synced across. While I believe that Telegram is far ahead on a lot of features, the lack of multi-device sync for “secret chats” is mainly because Telegram hasn’t spent enough time or effort on it.
newscracker··on Signal Public Username Testing (Staging Environment)
> To be clear, Signal now allows secure backups to the cloud.

No, it doesn’t, at least on iOS. There is no backup option on iOS. The only way to retain information when using a new device is to have the old device close by and transfer it by running Signal on both of them. Anyone who loses their device or does not have it with them when getting and setting up a new device will lose all the messages from the older/previous device.

newscracker··on Tutanota is now Tuta
Your citation is cut off and doesn’t show why Posteo says it won’t support this..I’m pasting the entire answer from Posteo on this topic [1] here:

> Can I use Posteo with my own domains?

> “No. We are an email provider with a particular, privacy-oriented model – and this is not compatible with incorporating own domains. One of our emphases is data economy: we do not collect any user information (names, addresses, etc) of our customers. We always answer requests from authorities for user information in the negative. On the other hand, own domains need to be registered to the name and address of a person. If you were able to use own domains with us, this would affect the entire concept of Posteo: we would need to start saving user information for all customers who use their own domains with us – and to provide these to the Federal Network Agency to be provided on request to the authorities. Even if only the MX record pointed to us, we would still need to store the assignment of the domain in your Posteo account as user information. Thus we would possess your user information and be required to give it out. For this reason, we have decided not to offer this possibility and instead to use data economy.”

Whether this sounds fine or not and whether this is acceptable to someone or not is subjective.

[1]: https://posteo.de/en/site/faq

newscracker··on Tutanota is now Tuta
I usually suggest people to take a look at these: mailbox.org, runbox.com, mailfence.com, posteo.de (this last one doesn’t support custom domains). They’re all cheap enough, provide IMAP and POP, and are located in different countries in Europe.
newscracker··on Tutanota is now Tuta
An FYI: Fastmail’s mail servers are located in the U.S.
newscracker··on Adtech surveillance and government surveillance are often the same
> Unless your data is fully encrypted or stored locally by you, the government often can get it from a communications or computing company.

> Traditionally, that required a court order. But increasingly, the government just buys it from data brokers who bought it from the adtech industry.

I presume the adtech industry includes Meta and Google. But some people (even here) get indignant and say “no, Meta doesn’t really sell your data” or “no, Google doesn’t really sell your data”. If these companies are participating in this ecosystem and buying from data brokers, they’re just as evil as the data brokers. Let’s not pretend that Meta and Google are saints who should not be criticized for making most of their money from these relationships and enabling surveillance.

← PreviousPage 3 of 34Next →