HNHacker News
TopNewBestAskShowJobs

Shank

13,491 karma · joined January 21, 2012

[ my public key: https://keybase.io/xn; my proof: https://keybase.io/xn/sigs/_19m8p1WLiV4VtmOeX3cnoDL1Itgf1PMn9WNs9hx6bA ]

argo@fluctlight.net

security person :)

submissionscomments
Shank··on Creepy Crawlies
Apple dynamically disables JIT based on website trust?
Shank··on Suica, Japan's First IC Transit Card
That’s the red “Welcome Suica”. Green or any other IC card at any other location like ICOCA don’t expire functionally ever. The stated time on some cards is 10 years since last use, but they’re practically infinite in that they can be used even after this point.
Shank··on Suica, Japan's First IC Transit Card
The penguin isn't owned by JR East, which is the problem. It's owned by a specific artist and licensed by Dentsu, who has to approve all usage. The other transit networks actually fully own their mascots, but Suica's Penguin isn't theirs to control.
Shank··on Suica, Japan's First IC Transit Card
It doesn't make it less fast! The same model is implemented on the mobile side, which uses the same technology.
Shank··on hdiutil is deprecated in macOS 27 Golden Gate
Is it also not greedy to demand virtually unlimited support from companies? Why should Apple spend money on this random utility that virtually nobody uses?
Shank··on Felony Bench
Well, if we apply this to every mortal, the optimal amount of felonies...is non-zero? That doesn't seem quite right.
Shank··on Kagi added a setting for removing paywalled links from search results
> Don’t Bloomberg & FT have a number of well-written, informative articles every month?

They do! And I did test a subscription to Bloomberg, and subscriptions to various other sites, but I have never found it compelling enough to visit for the price on a regular basis. I get my news from a large variety of sources. I have never found it valuable to only subscribe to one source, and I simply do not have the capital to justify subscribing to all of the places that sometimes publish good articles.

Shank··on Kagi added a setting for removing paywalled links from search results
> Do people want actual journalism to go out of business?

Former Google Contributor user reporting in! I absolutely do not want normal journalism going out of business, but I’m not going to subscribe to Bloomberg or FT or any of those sites on a recurring basis for one article. I love the idea of paying a non-subscription for one thing, occasionally, though!

Shank··on Stop Making TUIs
Apple believes SwiftUI is the future, not AppKit and UIKit/Cocoa.
Shank··on Nearly 1,400 live streams from Japan
The Japanese government (more specifically the Tokyo Metropolitan Government) actually runs a lot of these for flood monitoring and prevention. You can find a feed for essentially all rivers so that during rain storms, each can be monitored. This supplements automated flood monitoring systems that don’t use video.

https://www.youtube.com/@TokyoSuibou/streams

Shank··on Why travellers are obsessed with foreign supermarkets
While Japanese convenience stores are certainly fun, they aren’t grocery stories. Try Maruetsu, Olympic, LIFE, AEON, My Basket, etc. There are also the fancy grocery stores on the basement of malls. Convenience stores do sell groceries and they’re worth visiting, but they aren’t grocery stores.
Shank··on India has paved the way for charging merchants a fee on UPI transactions
Incredibly, WeChat Pay in China is now easy for foreigners: submit a copy of passport, link a debit account, and you can use WeChat Pay with no problems. No physical presence in China required, and the only restriction is that you can't use it abroad (i.e., at WeChat Pay stores outside of China). I've had a fully working WeChat Pay account for a couple years now, and I've never once had to do anything in-person or anything except upload my passport and Tencent made it happen.
Shank··on Firefox for iOS now has a native adblocker
> Ads shown on search engine results pages, including Google, Bing, DuckDuckGo and other search providers

There are many subpar adblockers available both built into browsers on iOS and as extensions. uBlock Origin Lite for Safari remains the best mobile adblocker on iOS, I suppose.

Shank··on Brazilian election filter in X For You timeline
> But if I were Brazillian, I'd be immediately following all ~700 accounts (and probably unfollowing all 700 after the election).

I wonder how many normal people actually follow political accounts like this. I follow my local government because they sometimes tweet emergency info but I don’t follow candidates at all. I don’t follow political influencers either. It’s far too noisy.

Shank··on Firefox is now the last major browser that still supports uBlock Origin
My experience using uBlock Origin Lite on iOS is that some particularly intrusive ads will figure out a way to load, like local news sites from the US, and many sites will be fully broken (missing entire content portions, content doesn’t scroll, entire page can’t be interacted with). These issues simply don’t occur on uBlock Origin but only exist as an artifact of aggressively blocking elements without applying fixes to unbreak sites.
Shank··on Firefox is now the last major browser that still supports uBlock Origin
Back when I first moved off of Firefox the answer was performance. A lot of users mass-migrated to Chrome because it supported a very similar set of extensions and was significantly more stable and performant. People like me evangelized switching to Chrome for everyone. Many copies of Chrome were installed by me.

Now the performance still hasn’t caught up to Chrome but it has improved, and uBlock Origin Lite does a decent job at a baseline level of blocking for most people.

Shank··on AI agent hacks gym to get its user a spot in pilates class
Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause.

> (a) Whoever

> (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

> (C) information from any protected computer;

> (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

A "protected computer" is:

> (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information".

So, yes.

Shank··on Manus will return to operating as an independent company
> Likely a bad translation from the original Chinese version?

No, most likely they're referring to users who created accounts etc on the meta infrastructure which is being spun down and erased and accounts created prior were never in their purview.

Shank··on What Happened to HackerOne?
> To the companies: You don’t need HackerOne anymore. The tokens to build your own in-house platform cost less than single year of HackerOne.

You know, the biggest thing that HackerOne delivers is a universal payments system that requires absolutely no efforts from companies. Have you tried to manually pay hackers from around the world? It is a laborious process involving trying to find what providers are compatible and what forms of money go where. It is extremely taxing to handle this. HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency. No amount of tokens solve the accounting problem, and it is foolish to imply otherwise.

Shank··on Residential Proxies Are a National Security Threat
Citation needed? I'm not a fan of residential proxies but these are pretty wild claims that aren't substantiated. Calling them a "national security threat" implies it is a threat to e.g., the continued existence of the United States. Is it really that? All of the activities described are already violations of the Computer Fraud and Abuse Act.

> At the very least, major American ISPs (Comcast, AT&T) should detect clearly suspicious activity coming from customer IPs and warn them to scan their computers, check their TV apps, and find whatever is turning their internet into a proxy.

What are we saying? Really, what are we saying? We should turn domestic ISPs into domestic surveillance apparatuses to "detect clearly suspicious activity"? What is "clearly suspicious activity"? Section 230 is still law.

Shank··on Five US tech giants' hidden debts soar to $1.65T on opaque AI funding
Hmm, does DoH work?
Shank··on Kimi Work
No, it's Apache 2. https://github.com/openai/codex/blob/main/LICENSE
Shank··on Reynard: A real Firefox web browser for iOS 13 or later
So close to something you could install in Japan via AltStore:

> One or more apps in source "Reynard Browser" are missing a marketplaceID. This most likely means they are not notarized, which is not supported by this version of AltStore.

I'm really looking to a successful version of a Gecko browser that can be installed with just AltStore via the Japanese law.

Shank··on Show HN: Yamanote.fun – A complete soundscape for Tokyo's Yamanote line
The news articles are real, but the Nambu line brought their departure melodies back played from the cars themselves late in 2025.
Shank··on Physical disc production ending in Jan 2028 for new games on PlayStation
They're Blu-Ray discs.
Shank··on DeepSeek Introduces Vision
Well, it is a Chinese model, maybe it thinks better in Chinese?
Shank··on Hacker News but for independent blogs
You can set a user preference to open in a new tab. The reverse is not true.
Shank··on Hetzner Price Adjustment
For the record, those providers already charged a significant premium for the equivalent compute you could get at Hetzner and OVH. The margins have decreased but they've had a profit margin on compute for a long time.
Shank··on Hetzner Price Adjustment
> Have no clue what's going on in the back

Hetzner and OVH and other bare metal but low cost providers use commodity hardware. When that commodity hardware increases there is simply no other option. The secret to the success of these providers is using common off-the-shelf hardware instead of specialized server hardware, which is now being cannibalized.

Shank··on Foreign business owners are scrambling to raise capital to stay in Japan
> In one case, investigators in Kanagawa Prefecture found that a Sri Lankan national had set up roughly 600 shell companies. He also allegedly submitted business manager visa applications for at least six Sri Lankan nationals by listing them as company presidents on paper, even though they actually worked manual labor jobs.

It shouldn’t surprise anyone that the government has a problem with this practice. The problem is trying to create a system of requirements that is both feasible to put on paper and also testable. When the issue was raised, the income requirements were changed as an immediate reaction, but the ISA has broad authority to grant or deny based on many circumstances.

Put differently, acts like this were already illegal, but difficult for the ISA to catch. So they changed the base requirements which are theoretically much easier to catch than the actual illegal behavior.

← PreviousPage 2 of 34Next →