buildfocus

Seems intentionally misleading. While I agree exposure to US surveillance in non-US providers likely isn't zero, it's significantly harder for the US to do this internationally for legal, practical & political reasons. AWS is not a neutral voice on their competitor's limitations.

I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!

The election is a re-election vote triggered by the MP already in the very safe seat, as a distraction from "where did all this money come from" investigations around him (which are also conveniently paused by this byelection).

He's arguing that if he gets reelected then the investigation doesn't matter. The other parties are arguing it's a stunt, and so are fielding no candidates.

Binface's candidacy accurately represents the absurdity of the whole thing.

Europe is the obvious answer. As others have posted, your numbers here are way off. And on the flip side, there's now some major programs actively encouraging this with special grants, support, relocation bonuses: e.g. ATRAE in Spain, EURAXESS, "Choose Europe For Science", Max Planck Transatlantic Programme.

How could it possibly hurt?

For trusted publishing, it's not a band-aid, it's a significant improvement that kills an entire class of CI takeover publish attacks. I'm sure attackers will find another way but it's a big gap this is closing up.

Are they disabling local mode? There's no mention of that here - the post by Bambú actually specifically promotes it.

> But it's still not at the point where it's cleaner per capita than the US and it's still quite far from that.

China has significantly lower co2 emitted per capita than the US already. Per kWh no, but that's a different thing. AFAICT China's renewable growth is now outpacing demand growth significantly though, so that per-capita gap will widen, and the per kWh is steadily improving as well, and faster than the US.

For some concrete numbers: China added 400GW of renewables in 2025 vs 78 GW of coal generation. Reduced CO2 intensity of power grid by 5% vs US 3% drop. In 2025 US total power emissions went up 5% (for many reasons, but arguably high gas prices and lots of data centres) while China total power emissions dropped 1.5%

All the details make China's path look much cleaner than the US's.

That referendum result is quite debatable, since the legal situation meant most people against it simply didn't vote. While in the past it was close, nowadays polls strongly suggest a comfortable majority against independence: https://www.democrata.es/politica/39-catalanes-apoya-indepen...

I agree the Rajoy government's handling of this was very problematic, but the rest of this isn't really accurate. And the morals of the economy argument is terrible - the rest of the country needs us, so we should cut them off? The same argument would apply for Barcelona cutting off the rest of Catalunya. It's not a good direction.

> Now this dumb announcement comes out that a 3rd party has (apparently legally) established interop with a Meta property with (I am guessing) a completely proprietary, undocumented, secret protocol underneath.

Resd the article - this isn't a proprietary secret API, it's the official intended interop API the EU now obliges them to provide. Not exactly 100% what you're asking for (I too would prefer common standards) but forcing interop access is a very good start.

Wireguard is _really_ simple in that sense though. If you're not doing anything complicated it's very easy to set up & maintain, and basically just works.

You can also buy quite a few routers now that have it built in, so you literally just tick a checkbox, then scan a QR code/copy a file to each client device, done.

Interesting discussion of the details of the rules and breaches here, from a "this isn't actually about content or censorship at all" perspective: https://bsky.app/profile/daphnek.bsky.social/post/3m7aqqnarm...

This makes no sense. A lifetime license is convenient conceptually, but it completely detaches your goals (working software) from a company's incentives (provide absolutely zero after initial delivery - everything afterwards is cost without upside). Lifetime licenses are bad for users (cf this post, as just one example).

Subscriptions are incentives for companies to keep doing what you want, along with direct consequences (everybody will cancel) to penalise them for ignoring their core user base.

Don't let the awkwardness of the system (fully agree modern banking is shit at letting you manage recurring bills) distract from the underlying user-beneficial dynamics.

I've done something similar, it's worth noting Scaleway in the same space, for people looking for an AWS replacement more like managed services (equivalents to fargate/lambda/sqs/s3/etc) instead of just bare instance hosting.

My impression is that Grok is very rarely used in practice outside of a niche of die-hard users, partly because of very different tuning to other models, and partly the related public reputation around it.

https://firstpagesage.com/reports/top-generative-ai-chatbots... suggests 0.6% of chat use cases, well below the other big names, and I suspect those stats for chat are higher than other scenarios like business usage. Given all that, I can see how Gemini might not be focused on competing with them.

The contrast between the steadily shrinking freedoms in Apple-land and the open computing approach underlying all today's the Valve announcements is fascinating.

That's an impossible model though - you're asking somebody to do unlimited work for you forever, for a fixed one-off price.

In that world nobody should ever ever sell a lifetime license, it's a huge responsibility with strictly limited upside. Imo "Use the current-ish version forever" is the only reasonable expectation, and that's a fair trade.

It's expectations like this that drive subscription models. People do (quite reasonably) want ongoing support and updates, but that takes continual work, so the only way to make that possible is to somehow provide ongoing funding.

This typically means they agree you don't get double charged (so you can claim taxes paid in one back in the other) but they both still want you to complete the paperwork regardless. Saves money, not time.

The way to make this work for real is with a smooth migration path, which means a way to keep running Android apps on your new system.

If you want to sponsor Waydroid to help make that happen, you can do so right now: https://opencollective.com/Waydroid (I'm not affiliated, just a fan, and it's the only realistic route to this I see).

We already have exactly this right now, without digital ids, it's not even theoretical. The government blocks plenty of residents from aspects of society (eg can't work based on visa rules, can't access public/health services at all without legal residency). Currently that's enforced by random members of e.g. medical staff looking at your skin colour to decide whether to ask to check your physical paperwork before they'll look at your weird looking mole. Governments enforce plenty of paperwork checks & blocks today. I think a digital id strictly improves this scenario.

For Spain, for online stuff signatures & verification it's mtls, with a client certificate issued by the government. You can sign documents with it or authenticate with it entirely offline (effectively nobody does the latter, but you could, and signing documents with it is very common). Government has no idea how it's used. 3rd party just verifies the government has signed the cert and it's got a valid date.

There's other issues (UX, privacy to the 3rd parties) and further improvements here coming with better wallets (EU-wide) soon, but even today it's absolutely possible to have digital id that doesn't tell the government every time you use it.

For Spain at least, most banks have foreigner accounts you can open with a passport, and convert into a normal account once you have local id later. It's a mildly unusual setup (and a bit confusing when you're new) but it's pretty widely available and it's not a significant blocker. There's plenty of other challenges and structural disadvantages as an immigrant, but this one at least isn't too bad.

If anything, there's really a big advantage to it for the banks - most locals already have banking, immigrants are the one market where you can get new customers without having to push them past the effort/laziness of switching from their existing setup.

They only needed to test with the latest Electron at the time of release (or indeed, any chance version - they're all affected - but latest is a reasonable baseline). If they had, they would've seen this.

There are patches out now, but only after Apple released the OS to the entire team world and people reported the issue to the Electron team.

Imo, Electron is sufficiently popular that somebody should test at least one Electron app on a major new OS version sometime before releasing it as done! Any app would've worked, and there's plenty of popular ones, as this post shows.

That's not true - you can enable developer mode and install apps via ADB without affecting Play Integrity for other apps on your device. You can test this today.

Play Integrity is focused on checking the OS is original and the runtime environment of the app (your banking app in this case) isn't being messed with. Installing other apps as a developer isn't related to that. If you're not flashing a custom OS or modifying your bank's APK you'll be fine.

(You _should_ be able to use custom OSs and Play Integrity is awful, to be clear - but not because of anything directly relate to normal app development & sideloading)

Attestation & Play Integrity is having a good go at blocking this: lots of critical software (e.g. the app required to use your bank account) requires certified attested devices, and Google are pushing hard to get as many apps as possible to activate that for "security", making non-Google Android un fixably 2nd tier in functionality.

https://httptoolkit.com also worth a look if you're interested in this space: has some neat automated setup for Android MITM that can be much simpler _and_ more effective than the manual config route (with automated Frida setup on rooted devices, so it handles unpinning too!). More UI & less CLI focused, so depends which way your preferences go there.

Node can also produce a single binary executable: https://nodejs.org/api/single-executable-applications.html

You can also do this natively with Node, since v18: https://nodejs.org/api/single-executable-applications.html#s...

This expectation is that this should not work - well behaved network devices shouldn't accept a blind GET like this for destructive operations. Plenty of other good reasons for that. No real alternative unless you're also going to block page redirects & links to these URLs as well, which also trigger a similar GET. That would make it impossible to access any local network page without typing it manually.

While it clearly isn't a hard guarantee, in practice it does seem to generally work as these have been known issues without apparent massive exploits for decades. That CORS restrictions block probing (no response provided) does help makes this all significantly more difficult.

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective.

The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website.

This proposal aims to tighten that, so that even if the website and the network device both actively want to communicate, the user's permission is also explicitly requested. Historically we assumed server & website agreement was sufficient, but Facebook's recent tricks where websites secretly talked to apps on your phone have broken that assumption - websites might be in cahoots with local network servers to work against your interests.

And lots of other features don't work, particularly external integrations. Gemini on Android refuses to do basic things like set a timer unless chat history is enabled. It is the one key feature I really want to pay extra to get, and that preference goes x2 when the AI provider is Google.