HNHacker News
TopNewBestAskShowJobs

Zak

16,698 karma · joined February 20, 2007

zak.wilson@gmail.com

https://social.goodanser.com/@zak (Mastodon)

submissionscomments
Zak··on US citizen charged after GrapheneOS phone wipes during airport search
A US citizen has an almost unlimited right to enter the USA. The border search rule permits officials to search for things that are illegal to import. A blank phone is not illegal to import.

A non-citizen who arrives with a blank phone might be denied entry because it seems suspicious.

Zak··on US citizen charged after GrapheneOS phone wipes during airport search
Possible, yes. Easy, not so much. Phone operating systems don't really place nice with local backup and restore, which I consider a serious flaw.
Zak··on A 77-year-old Republican man is staging a solo protest against Flock cameras
The article already links to a website that shows their locations: https://deflock.org/

It does not gamify or otherwise encourage damaging them, which would be legally risky.

Zak··on Android may soon restrict on-device ADB
A long time ago, I fixed Windows machines for pocket change. I can confirm some users will make bad decisions no matter what warnings they're given.

I think the impulse for an OS vendor to try to make such mistakes impossible is about as wrong as selling knives dull so people can't hurt themselves. A knife that can't cut its user is useless as a knife.

Zak··on Passkeys were invented by engineers with zero understanding of consumer brain
Then I wouldn't use it, and I would probably stop using services that tried to push me in to it.

I use multiple devices and I want to log in to things using only my master password. I also want to be able to back up my credentials to local encrypted storage so I can restore them if my password manager service provider stops operating or becomes untenable.

Zak··on Apple defeats liability for not scanning iCloud for CSAM
I have a hard time imagining any significant number of people objecting based on the sender's privacy. An adult sending explicit images to a child is a crime in most jurisdictions. A child doing it with a recipient under 13 is a concerning behavior the parents need to address.

Notifying the parents even requires that the child acknowledge that's what's going to happen.

Zak··on Apple defeats liability for not scanning iCloud for CSAM
> Pedophiles aren't stupid

I'm not entirely convinced that's true. Facebook is a leading reporter of CSAM, much of it sent through Messenger, which only recently got E2EE, and Instagram DM, which briefly had E2EE but no longer does. If I was going to transmit something that could get me in trouble, it certainly wouldn't be via Instagram DM.

Facebook's EU CSAM report is here: https://transparency.meta.com/reports/regulatory-transparenc...

Zak··on Apple defeats liability for not scanning iCloud for CSAM
There were two different technologies. One was client-side scanning for known CSAM, which created a huge backlash and is described here: https://educatedguesswork.org/posts/apple-csam-intro/

The other is detection of images that may contain nudity, whether sent or received, when the owner/admin/parent enables the feature. It is relatively uncontroversial and is described here: https://support.apple.com/en-us/105069

Zak··on Texas wins court order to suspend domain name for violating age-verification law
You wrote this in the passive voice; it doesn't say who is doing the blocking.

Pornhub itself is doing the blocking; it uses geolocation and denies services to IP addresses from jurisdictions with age verification laws. The laws are usually not structured so as to require a third party such as an ISP to block noncompliant sites; instead, the governments of the states with those laws can sue the porn sites and their service providers (Verisign in the case of .com domains).

Zak··on Your 'app' could have been a webpage (so I fixed it for you)
That's so opposite to my preferences that I'd be really interested in the results of someone studying that group of users.

I do like local native software, preferably using the native UI toolkit, filesystem and features of the device hardware not necessarily available to the browser. That doesn't describe most commercial mobile apps in 2026.

Zak··on Your 'app' could have been a webpage (so I fixed it for you)
I have no interest in installing a web app in almost all cases. I'm happy to visit one though, and I trust the browser sandbox to keep it from doing anything worse than making my device warm until I notice and close the tab.
Zak··on Your 'app' could have been a webpage (so I fixed it for you)
I once read that app users are seven times more profitable than web users. That easily answers the author's question about why a company would bother make an app when a web page is the natural fit for the use case.

I don't remember the source or methodology for that number, but I have no trouble believing it. An app gives the developer a foothold on the user's device. It can more easily send notifications, track the user's location, resist customization like ad blocking, and remain present on the user's device even when closed. It's easier to funnel users into profitable behavior with an app.

Companies wouldn't do this if a large fraction of users refused the app, but most users don't.

Zak··on Remote Attestation
The auditor app itself does not result in any loss of freedom, but the widespread availability of remote attestation mechanisms on end-user devices incentivizes others to use it in a manner that does.

A purely local mechanism that lets the user check the integrity of their system is great. Making it easy for third parties to inspect it is a severe violation of user freedom and privacy.

Zak··on AI content is everywhere on social media, especially LinkedIn
What? Why would you feel bad about a negative review of something you didn't create?

Either the product is something I was curious about and hadn't decided to spend time and money on yet, in which case a negative review might save me the trouble, or it's something I've already done and formed my own opinion about, in which case I'm probably not reading reviews.

Zak··on Remote Attestation
There's some value in that, but Signal's main security proposition is that you don't have to trust the infrastructure. E2EE means even compromised server software can't read message contents.
Zak··on Learning to code is still worthwhile
At the time the LLM generated the compiler, just syntax. The semantics it generated were the subset of C that the C version of the compiler already used.

You could set the goalposts such that it wasn't novel enough to count, but for a short time I had code running in a language that nobody had ever known. Getting it from that point to a language that's ergonomic to use, teaches something about computing, or both is a longer journey, and certainly not one an LLM could take on its own.

An LLM won't come up with an interesting CRUD app on its own either. Parts of that process are pretty mechanical, but we had skeletons and templates before we had LLMs.

Zak··on Learning to code is still worthwhile
> it’s hard to imagine they’ll ever independently develop a compiler for a truly novel programming language

I did exactly that using an LLM. It may not count as independent depending on how strict you are about that, but then LLMs don't do anything independently.

I wrote a small sample program and expected output, then told the LLM to write a compiler for it in C using LLVM. I subsequently told it to extend the language until it could be used for its own compiler, and rewrite the compiler in the new language. It did.

I don't think that contradicts your point about creativity. A compiler is probably a more mechanical task than a CRUD app is. There's a non-negotiable definition of done and correct.

Designing a language is a creative task of course, and I wouldn't expect an LLM to come up with a novel or ergonomic design on its own. In fact subsequent experiments have shown me that LLMs will consistently ignore terrible ergonomics in a language, never seeking opportunities to add abstraction or beauty.

Zak··on The great blogging collapse: What happened to 100 successful blogs?
The phones part is a red herring here. Phones work fine for reading text.

Video outcompeting text as a mainstream medium for both information and entertainment is as old as television. Youtube would be a more reliable way to make money than a blog in 2026 even if it was primarily consumed on TVs or PCs.

Zak··on CarPlay Is Additive
> She delivered a shocking stat: 79% of U.S. buyers would only buy a car if it supported CarPlay.

I would be shocked by the number being that high because while iOS has a slim majority of the market share, it's nowhere near 79%.

Zak··on Android Developer Verification: Threat masquerading as protection
There's already a restriction that requires going into the settings and flipping a toggle, with a warning. I think that's enough.

To be clear, enough does not mean that will stop every trojan/scam. People send Starbucks gift cards to callers claiming to be from the IRS calling to collect overdue taxes despite the obvious absurdity. Enough means that someone who doesn't know anything about computers but who reads and believes the warning label has sufficient information to know that it's a potentially dangerous decision. Some people will make the dangerous decision anyway, but it's on them at that point.

Zak··on European digital ID wallets rely on safety services of Google and Apple
People keep talking about it that way inside our circles, and if we do that here, we will surely fail to do better with a broader audience.

Last year's example of ICEBlock makes the freedom/tinkering distinction clear to most people. ICEBlock was an iOS-only app for tracking immigration raids in the USA and alerting users when they're nearby. Apple caved to government pressure and banned it. Because iOS users don't have the freedom to install apps from other sources, that's the last word; the app is effectively dead.

I've found most people understand pretty well why that sort of thing is a problem even if it did not affect them.

Zak··on Android Developer Verification: Threat masquerading as protection
The only time I've actually seen Android malware in the wild, it was because my mother installed a homescreen flashlight toggle widget from the Play Store that also displayed ads on the lockscreen. That was forbidden under Play Store rules, but there it was. I replaced it with something from F-Droid.

The Play Store still has a problem with shady apps years later. If Google wants to be more like Apple, they should start with better curation in their own store.

Zak··on Knoppix
When I would fix Windows machines for pocket change, Knoppix was one of the first tools I'd reach for. It made separating janky hardware and janky software much easier.
Zak··on European digital ID wallets rely on safety services of Google and Apple
People keep framing these sorts of debates in terms of tinkering.

It's about ownership, not tinkering. It's about preventing megacorporations from having the last word about how government services can function and how people can interact with them.

Zak··on Dark Sky Lighting
The site links a couple studies coming to a different conclusion about crime. Feeling safer doesn't necessarily mean you are safer.

As for pedestrian safety, button-activated lights over crosswalks are one potential alternative to always-on outdoor lighting. It might lead to a considerable safety improvement once people got used to the light being an indication that pedestrians are likely present.

Zak··on Dark Sky Lighting
It does link a couple studies to back up that claim. Critiques of those studies or evidence for the opposite would contribute to the conversation; this does not.
Zak··on Turn your site into a place people can bump into each other
I think there might be some merit to a basic filter, perhaps some sort of timeout for obvious slurs. I see a few right now.
Zak··on Gossamer: a Rust-flavoured language with real goroutines and pause-free memory
I'm seeing a big red flag here for what purports to be a systems programming language: it isn't used for its own compiler. The compiler is written in Rust.

A systems programming language should be able to self-host its compiler. Writing compilers is one of the canonical systems programming tasks. Making that happen may not even be hard in the LLM and LLVM era as it's a fairly mechanical task for an LLM to execute, and you can output textual LLVM IR to bootstrap on any architecture LLVM supports.

Zak··on Gossamer: a Rust-flavoured language with real goroutines and pause-free memory
A card grid with rounded corners as the second section and a dark blue or purple theme just scream "designed by Claude".

It's decent design, but not a useful quality signal.

Zak··on The unbearable cheapness of open weight models
Could be a little of each, plus a third option: subscription users don't always consume their entire quota.
← PreviousPage 3 of 34Next →