HNHacker News
TopNewBestAskShowJobs

diacritical

87 karma · joined February 25, 2026

submissionscomments
diacritical··on Possible US Government iPhone-Hacking Toolkit in foreign spy and criminal hands
You forgot the urge we all share to store all our login information on our phone, to exclusively use it for banking, to take and store all our sensitive photos and videos, to exclusively use it for any kind of communication, to keep the microphone and camera intact and to leave our phone on 24/7 next to us.

Seriously, what's the worst that could happen with an internet connected closed down device that holds all our information and has a microphone and camera? People must be just paranoid.

diacritical··on Possible US Government iPhone-Hacking Toolkit in foreign spy and criminal hands
So you think in this case the EFF was wrong? It seems that way, but I'm not sure I fully understand what you meant. Why wouldn't the training process be public?

Another thing is that while perhaps entire copies of customers' hard drives weren't sent to the FBI, the Best Buy repair staff dug through the contents of people's hard drives. If I have a software issue with my OS (or whatever the repairs were about), I wouldn't expect the repair staff to look at my photos. Obviously, is CP was set as the wallpaper or something, you can't miss it, but why is it OK to look into random folders looking for suspicious files?

diacritical··on LLMs can unmask pseudonymous users at scale with surprising accuracy
Why take away people's choice to use a forum with permanent comments? I know my comments will be here forever, but so will other people's comments. That's what makes HN valuable.

The alternative is what you see on reddit. A lot of threads from the past have posts deleted or overwritten with some script. You now have to dig through archive sites to find the comments, and you usually do find them.

I participate in Signal chats with self-destructing messages, too. But I post different things here and on Signal, under different usernames. Heck, after a few weeks I'll make another account here, anyway.

Even if you somehow deanonymize me, it's a risk I willingly took when I started posting.

Finally, if you go after HN for deleting comments, will you go after the many archive sites?

diacritical··on Motorola GrapheneOS devices will be bootloader unlockable/relockable
Unfortunately from what I read a couple of times, including a month or so ago, GrapheneOS discourages and doesn't support rooting the phone for security reasons that seem vague to me and don't appeal to my need to actually own my phone and OS. You could still root it with some third party tools from what I know, but not having root as the default makes it less of a secure FOSS OS and more of a closed down toy.

As for payment apps and other crap that refuses to run if I, the owner and administrator of my own device, don't have admin access, I would just refuse to run it. What's next - websites refusing to work if I have root on my Linux desktop?

diacritical··on Meta’s AI smart glasses and data privacy concerns
I'm against surveillance in general and I see many people being against these glasses, yet not caring at all about surveillance cameras. Flock in the USA is a bit of an outlier in that it got some people riled up, but where I live in Europe there are private cameras looking out of at least half of the buildings, maybe more. So if you're walking down the street for 15 minutes, you'd be caught by tens or hundreds of cameras from various manufacturers, installed by various business and homes. Who knows how many have microphones, which server they store their feed in, what security each cam has and so on.

I asked 2 cops in a patrol car if I could install cameras on my own and how I should go about it. They said they don't mind them. Officially it's illegal unless you have a permit, but it's so widespread and the law is so unenforced that it's practically 99.99% legal.

I can point a few cameras to the street and record everything 24/7. When I'm on a bus I'm being recorded by a few cameras. On most bus/tram/subway stops there are cameras. In stores and public buildings there are cameras. Most cars have cameras for insurance or general safety concerns. Self-driving cars would have to have cameras, as well as delivery robots.

If we accept this shitty reality, why shouldn't I wear a camera and a mic, too?

diacritical··on Motorola announces a partnership with GrapheneOS
What setup do you use for seeing image previews (or the images themselves?) on a terminal in Linux?
diacritical··on Motorola announces a partnership with GrapheneOS
I could add 3 off the top of my head. Probably a couple more. Privacy conscious people who aren't techies. Some have tried Linux, some don't know what a "browser" or "SD card" is.

If features like phone calls, SMS, the camera and most regular apps work (especially banking apps, sadly), they'll be happy and receive free indefinite support from me.

I wouldn't use banking apps myself unless they open source them, but I'm willing to make a concession and support my friends' issues with such apps.

diacritical··on Are the Mysteries of Quantum Mechanics Beginning to Dissolve?
I'm not a dualist or anything. I'm in the "it's weird and I have no idea what the answer is" camp. And yes, I've read Dennett. I'm trying to understand your views. Lots of questions follow, but don't feel like I'm barraging you unnecessarily. Just trying to figure out your view with what seem to me like interesting questions that I myself can't really answer.

I'm using "consciousness", "subjective experiences", "senses" and "qualia" as synonyms here, but if you see a difference, please mention it. Obviously "consciousness" has many definitions that have nothing to do with the "hard problem of consciousness", so I'm using it in this sense here. I'll use "qualia" as it's the word that relates most to the hard problem of consciousness. You can substitute it with "sense"/"senses" if you like.

1. Do you view qualia as an emergent property? Of what exactly? What is a self-modeling system? Is a human one? Where would the boundaries be; would they even be defined? The human body or the brain only or the nervous system? Or whatever neurons activate when a certain thing happens, like seeing blue or feeling pain? What about animals - pigs, dogs, rats, snails, ants, bacteria? What about AI, current and theoretical?

2. Could there be a set of minimal self-modelling systems in some abstract space that are the boundary of what has qualia and what doesn't? Like, these 1000000 neurons arranged like that qualify, but if you take 1 out, they don't? Or is it a fuzzy boundary somehow?

3. What kind of statements could be made about the qualia of yourself and of others? Not sure what kind of answer I'm looking for, but how objective or truthful would those statements be? Maybe "qualia is nothing really, we only have the set of equations that govern physics and everything else is an abstraction"? Like an apple isn't anything really, it's just a badly defined set of atoms and energy. There is no "apple" or "chair". Or is it something else?

4. What are your views on meta-ethics and ethics in general? Should we care about it at all?

diacritical··on Are the Mysteries of Quantum Mechanics Beginning to Dissolve?
Randomness doesn't imply free will. What if you/I are NPCs that just roll the dice before doing something? It's not you that chose the outcome, it's the dice, i.e. the laws of physics.

I don't know how free will could actually work with any kind of universe governed by a set of laws, whether they include randomness or not. So I don't believe in it, but of course in my day to day life I act as if it exists.

Yet I don't know how qualia or subjective experiences could actually work with any kind of universe governed by a set of laws, whether they include randomness or not. But I believe I have this subjective view of the world that doesn't seem to be explainable with a set of equations.

So it's weird. At least philosophy and science agree that.

diacritical··on WebMCP is available for early preview
People who block ads are a minority. Sites that serve heavy content like video would care if someone wastes their resources but blocks ads, but why would a site that serves a few KBs of text spend the resources on blocking such users or making the ads beat the ad blocker in a tiresome cat and mouse game?

Those users could even share or recommend the site to someone else who doesn't use ad blockers, so it actually makes sense to not try to battle ad blockers if you want to make your site more popular.

This makes sense for sites that rely on network effects, like forums or classified ad sites and so on. Unless they have a near monopoly or some really valuable content, they would benefit financially if they let people block their ads.

I can't back that up with data or anything, but it makes sense to me.

diacritical··on Let's discuss sandbox isolation
Sorry for the late reply.

I can't recommend specific HW as I'm not using anything new or beefy and I'm not running any CPU or GPU intensive things on Qubes.

There's the Qubes Hardware Compatibility List (HCL) where people have added their hardware:

https://www.qubes-os.org/hcl/

If and when I decide to upgrade, I'll also ask in the forums. Not all hardware supports all the features required for the security. Some hardware just doesn't play nice for one reason or another.

On my desktop I have an 8th gen Intel CPU with a motherboard that had good reviews for working well with Qubes. Nothing fancy. I rarely use CPU-heavy software, though. If I'm crunching some numbers like password cracking, I just assign a few more cores to a VM (VM is a "qube" with lowercase "q" in Qubes's terminology) than usual and let it run for a few days. But I rarely do that and when I did, I wasn't pressed for time, so I haven't had the need to optimize or bench anything so far. I can't speak as to how it would perform vs a baremetal OS. Probably worse, but not by much.

RAM is far more important, as least to me. 32 GB is what I consider the minimum for me, but I prefer 64 or more, as it lets me be more relaxed with how many VMs I have running. I'm usually at 30-40 GB used with ~20 VMs. But when I'm experimenting with something, I can run a bunch of other stuff and not run out.

Through trial and error I figured out what amount of RAM works for what types of VMs based on the usage. A VM with 1.5 GB RAM can open 50 or more tabs if you have JS off, or 2-3 shitty JS-ridden SPA vomit-inducing sites before it starts to lag. The good thing is that if a VM lags, only that VM lags; Qubes itself and other VMs don't.

With 16 GB you'd be fine, but you'll have to care more about how much RAM each VM has. For system VMs like network or USB VMs, or VMs you use for a specific purpose only it's easy to figure out the required RAM. Some may need as little as 300-400 MB.

Videos play fine on VLC with the integrated GPU. I have the same issues with VLC as I've had on baremetal Linux OSes on other computers, like stuttering for a few seconds after seeking backwards or not playing 1080p H.265 videos smoothly.

I don't have a dedicated GPU. I don't game or mine crypto or use CAD or run or train AI models. So I can't comment on anything GPU-related, such as drivers or passthrough or performance.

I have a few laptops with Qubes that I use from time to time. The oldest is an x230 Thinkpad from ~2012 with 16 GB RAM. I don't use it as a daily driver, though, just for a few specific things. As a daily driver 16 GB RAM would annoy me a bit, but I'd still make it work if that was my only chance.

diacritical··on Let's discuss sandbox isolation
Just posted about Qubes a minute after you did, but I don't find it painful or even time consuming. Initially there was a learning curve, but even if the security of Qubes became the same as the security of a baremetal OS, I would still use it.

When I'm trying to get some software up and running, I've had issues with Debian many times, as well as with Fedora. Rarely with both. With Qubes after a few minutes of trying on Debian and running into some obscure errors, I can just say "fuck it" and try with Fedora, or vice versa. Over the years it has saved me more time than the time I've invested it learning how Qubes works or dealing with Qubes-specific issues.

I also don't have to care about polluting my OS with various software and running into a dependency hell.

If a VM crashes or hangs, it's usually OK, as it's just a VM.

It's much easier to run Whonix or VPNs without worrying for IP leaks.

diacritical··on Let's discuss sandbox isolation
Is there anything more secure than Qubes, assuming enough hardware resources? I'm asking about existing solutions, not theoretical ones. Given its track record so far, I'm betting not, but I'd love to be proven wrong. Adding sandboxing within a VM or hardening it should add more security, but overall I think this is the right approach for anyone who can afford a decent computer.

The attack surface of Xen, the current hypervisor of Qubes, is smaller compared to browsers and OSes that have 0days pathed several times a year. Even most Xen vulns don't affect Qubes.

I just can't imagine putting my whole digital life in one "normal" OS and hoping that the OS or browser security will keep me safe. I'm mentioning the browser because a lot what used to be in the OS is now in the browser, so it's functionally like another OS.

From a usability point of view it's also useful as I can have different environments. Not only different tools in each VM which means I can pretty much forget about dependency issues, but also different data in each VM. If I wanted, I could run any agent or malware on a VM and the exposure would only be whatever data I chose to put in that VM.

Of course, if you're not passing data between certain VMs, you could use different computers for an even better security.

diacritical··on Bus stop balancing is fast, cheap, and effective
I'm in Europe and haven't experienced the US public transportation system, so I can't offer an opinion, but in my country the number of stops seem to have a negligible effect on the average speed.

Most of the slowness comes from traffic. Where there are bus lanes, the bus can even be as fast or faster than a car. Some of our trams stop every 300 meters or so, but since they have dedicated lanes, they are pretty quick. Some of the stops are at intersections where a car would also wait. When the timing is right, and most often it is, the trams don't waste more time than would've been wasted just waiting for you turn at the intersection.

Where there is a bike lane parallel to the cars, busses and trams, an electric bike with 35-40 km/h will usually be the the fastest method of transportation, especially if you cross on reds when there's 0% chance of a car hitting you. I'm talking about a busy main street with lots of lights and traffic, not a highway, of course.

Busses with no dedicated bus lanes are slower than cars, because cars are quicker to maneuver and accelerate when needed. I think if out city made the busses (and trams, and trolleys) 2-3 times more frequent, most people would use them. It would be a difference of driving in traffic for 1 hour vs sitting in a bus reading something (or doom scrolling) for 1 hour and 10 minutes. Shorter stops means less walking, so it would incentivize people to use the public transportation more. The benefits are obvious - less traffic overall, less pollution, less energy used, less road rage, more time to chill, and so on.

diacritical··on US orders diplomats to fight data sovereignty initiatives
If the comment is not sarcasm (I can't tell reliably anymore), there's a movie called Idiocracy. I think the word comes from the movie, or at least its wide adoption was heavily influenced by it (because someone somewhere probably coined the word before the movie was made).
diacritical··on Confusables.txt and NFKC disagree on 31 characters
I think restricting the allowed characters should apply to usernames and other unique identifiers that can lead to confusion (admin vs аdmin with a Cyrillic "а"). So if I write my name as "José", I should be able to make an account called "Jose" and still enter "José" in the name field, if such a field exists in the first place. Although I'm not even sure about this.

If you're saying that "José" should be accepted as an username, shouldn't "Борис" or "김" or "金" also be valid?

It makes sense to restrict the alphabet for things like usernames that should be unique, should be easy to read for security reasons and should be correctly handled by various types of backend software.

I'm not from the US and my name isn't ASCII, but I wouldn't mind spelling it with the English alphabet, even in a name field.

I also don't understand how English has 26 letters, but letters like "é" in "José" or "ï" in "naïve" appear as normal letters. And if I write "Jose" instead, it would read as offensive. In my language that uses Cyrillic, the letters of the alphabet are all the letters we use, period. It would just be wrong to borrow a letter from another alphabet, even if it's the same script, just because someone's name includes it in their language. I have a friend from a neighboring country that changed one of his Cyrillic letters when he came to my country. I would do the same if I went to his country and they didn't have a letter we have.

← PreviousPage 3 of 3