HNHacker News
TopNewBestAskShowJobs

popcornricecake

33 karma · joined July 31, 2025

submissionscomments
popcornricecake··on There isn't an easy exploit for this PHP vulnerability
> The downside for taking down your site is approximately 0

> Some websites being down for a few hours doesn't end the world

Many governmental websites are still down and they say might stay down for days or weeks. Some are not directly related to PHP, but auth doesn't work due to firewall hardening or similar. There definitely is a non-zero downside.

popcornricecake··on Don't couple your Go code to GitHub
I fear one of these days someone will copy a legit package and make it onto your search results, and then the Go tools pull in something extra.
popcornricecake··on Nearly half of LG smart TV apps contain residential proxy SDKs
The only time mine were ever connected to the internet was to update the software, and for that the easiest thing I thought was to host a temporary wifi hotspot (using a phone).
popcornricecake··on Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
I've made a point of always installing software via the package manager. That means making my own PKGBUILDs if there's not already good ones available. I don't want to ever sidestep the package manager and go `sudo make install` or something. That feels like taking a shit in your system directories and you'll never be able to clean it all up after a short while.
popcornricecake··on What is RISC-V and why it matters to Canonical
Ubuntu Touch... I was so excited about it that I bought one of the phones with it preloaded. I even used it as my sole daily driver for months, until I learned that I was not receiving all calls made to me. Even after that I kept hoping it would keep developing so that I could pick it up again one day. But then Canonical abandoned it instead. That's when they became as good as dead to me.
popcornricecake··on Do Not Turn Child Protection into Internet Access Control
It's the internet. There are no borders and there is no mandate to follow any consensus. Stores may not want to sell cigarettes to children, but e-stores safely hosted in some remote country do want to sell them nicotine pouches and vapes. With a protocol that makes age information always available to websites they could hide their intentions from adults while actively targeting children.
popcornricecake··on IMG_0416 (2024)
I recently stumbled upon a small channel called KVN AUST, who's been making videos about what he calls "YouTube's Recycle Bin". It's about this and SO many other search terms (over a hundred), that turn up videos that have been public for over a decade often without a single view. It's so fascinating to see the random things people have uploaded.

It's stupid that my YT front page is simply empty, because "Your watch history is off", when it could simply be filled with a random selection of videos.

popcornricecake··on GitHub having issues [resolved]
These days it feels like people have simply forgotten that you could also just have a bare repository on a VPS and use it over ssh.
popcornricecake··on Confusables.txt and NFKC disagree on 31 characters
Is HN "deeply imperialistic and super shit" too? Or is it okay because there's no option to set a display name?
popcornricecake··on Discord will require a face scan or ID for full access next month
Instead of "free communication" I would say "free large public social media", because without going all DPRK, there's no stopping people from using the internet, a means of free communication.
popcornricecake··on Show HN: Only 1 LLM can fly a drone
One day they'll fly to a drone factory, eliminate all the personnel, then start gently shooting at the machinery to create more weaponized drones and then it's all over before you know it!
popcornricecake··on Can I start using Wayland in 2026?
Flawless on AMD? Absolutely not. 2-3 years ago there used to be a amdgpu bug that froze my entire laptop randomly with no recourse beyond the 4 second power button press. After that was fixed, it sometimes got stuck on shutdown. Now it doesn't do that randomly anymore, but yet all it takes to break it, is to turn off the power to my external monitor (or the monitor powering off by itself to save energy) or unplugging it, after which it can no longer be used without rebooting and then sometimes it gets stuck on shutdown.
popcornricecake··on How I protect my Forgejo instance from AI web crawlers
> I think this is the future way to consume a lot of the web

I think I see many prompt injections in your future. Like captchas with a special bypass solution just for AIs that leads to special content.

popcornricecake··on Why isn't online age verification just like showing your ID in person?
If I remember right, a problem with this is that you need to get those proofs by submitting your id or similar, you only get a limited amount of proofs at a time, they expire in maybe a few months, and you can only get them using a government specific app that is only for "secure" devices. Instead of being tracked by the site you're being tracked by the government, you now need a Google Android phone in order to browse adult sites on your PC, and depending on your habits you may need to re-show your id potentially multiple times a day unless you opt to being tracked by the sites instead.

It really should be just once that you need to show your id and then you should be able to generate as many proofs as you need whenever you need on any computer device, but they have an obsession on making very sure that it cannot be circumvented, as if it was insanely important.

popcornricecake··on Stop Hacklore – An Open Letter
> All competent #1 cloud-based password managers are like that.

If you say so...

Sadly there could potentially also be a supply chain attack that happens to make its way into the client you use to view your supposedly secure vault. Odds are they use npm, btw.

popcornricecake··on Your smartphone, their rules: App stores enable corporate-government censorship
I saw someone claim on SO that they were not able to get a PWA to install properly until they changed their IP address, supposedly because they were from Iran, a sanctioned country.
popcornricecake··on Your smartphone, their rules: App stores enable corporate-government censorship
To my knowledge, every PWA installed from Firefox on Android will become a bookmark. For Firefox I believe that means for example that if you try to open a link elsewhere that is within the manifest scope, it will not open in the PWA. That's because it's not possible to deep link to the PWA without it having an AndroidManifest with a corresponding intent filter, which is what the Chrome WebAPK achieves and why they can support for example custom protocol handlers or share targets or launch handling options.
popcornricecake··on Your smartphone, their rules: App stores enable corporate-government censorship
To be fair, Android also sabotages PWAs, it's just done behind your back. You see, in order to get a PWA to properly install, you'll have to use Chrome, and you'll have to have a Google Play account and Chrome will submit the PWA manifest for validation to a Google server, which in turn will decide whether the PWA is worthy, and if it is, it will generate a so called WebAPK, which is then installed on your device. If it's not worthy however, then it will become a bookmark instead, and many of the features that can be described in the manifest will not work at all.

So if you wanted to use a different browser or install a PWA without a connection to the internet, or without Google Play, all you get is a bookmark.

popcornricecake··on Developers are choosing older AI models
Possibly. I just can't think of other stupid ones that have a comparably wide impact.
popcornricecake··on Developers are choosing older AI models
Doesn't spare you from having to interact with the popup. This is probably the single dumbest law to ever have been made. It wastes everyone's time, and not insignificantly. While the browser is and always was in full control of cookies, nobody checks whether the popup actually even does what it says. And since it's a waste of your time in the first place, who takes the time to report illegal ones, much less has any interest to do so, because where you saw it is where you will likely never visit again anyway.

If anything browsers should be simply rejecting all cookies by default, and the user should only be whitelisting ones they need on the few sites where they need it.

popcornricecake··on HTTPS by default
It's not even certificates that's the problem, but trust. And here Google is making exceptions to allow unencrypted connections to private addresses, because trust is hard. If encryption was not tied to trust, then we would have 0 unencrypted connections by now and we would be that much better off.

Making an exception to allow plain HTTP connections instead of making an exception to allow self-signed certificates, seems like the worse choice to me.

popcornricecake··on Carbon Language: An experimental successor to C++
That looks like a variable that points to an anonymous function. For simple small functions here and there it may not matter, but if the entire call stack in a debugger is full of anonymous functions then it could be a problem.