flotzam

A dirty intended use case...

https://en.wikipedia.org/wiki/Crop_desiccation#Systemic_desi...

It's inherently a loss of privacy that anyone (given that the dataset is now public) can correlate

> Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers

"No tags were pushed to AOSP for the July 2025 monthly release of Android. We asked about this on the android-building group but each of our posts was rejected. We emailed people at Google we've previously contacted about mistakes pushing tags but received no response this time."

https://xcancel.com/GrapheneOS/status/1952413110947430786

"July monthly release was not pushed to AOSP and then neither was the August monthly release. September quarterly release hasn't been pushed yet."

https://xcancel.com/GrapheneOS/status/1963812920673861981

The section Benefits (after Introduction) lists 9 reasons why it makes sense. Some of them are about working around a mismatch with existing standards, but not all.

It really is a social anxiety off switch for me (once it fully kicks in after 5+ hours, lasting for about 24 hours before things slowly return to baseline). Alcohol in troubling quantities has that effect to a lesser extent, but of course it's sloppy as hell too and I hate the hangover. Not so with phenibut.

That makes it tempting to use before 7 days have passed just for this one social occasion. Although committing to not do that has flipped the dynamic: Even after enough time has passed I'm reconsidering, is today actually worth using it and being "blocked" for another week during which something more interesting might come up? Trying to make my occasional visit to normie vibe space count, it's kind of nice there.

It's not a benzo, but it is a GABAergic drug. The ironclad law to avoid brutal dependency and addiction is to never take it more than once every 7 days, preferably less frequently than that. No redosing on the same day either. This means it will take a couple weeks to slowly find an effective dose.

https://psychonautwiki.org/wiki/Phenibut

They're explicitly not saying that in a reply: https://bsky.app/profile/grapheneos.org/post/3lsyep3s4ac2x

> Malware [c]an persist across reboots regardless of verified boot.

Some can, some can't. Even when it can persist, escalating to root after every reboot may be unreliable or noisy (e.g. 70% chance of success, 30% crash) compared to straight persistence as root without verified boot.

> Also, there are devices out there that let you enroll your own keys, like the Google Pixel series.

This still applies to those devices. It's the main reason GrapheneOS (which exclusively runs on Pixels, with the bootloader relocked to a GrapheneOS key) is opposed to building in root access: Verified boot would be "enabled", but effectively bypassed. https://xcancel.com/GrapheneOS/status/1730435135714050560

It's not (only) propaganda. Rooting disables or bypasses verified boot, allowing exploits to persist across a reboot.

Most of AOSP is Apache 2.0 licensed (permissive, not copyleft)

> Reading docs ("research") is essential part of engineering.

Sure, but so is safety engineering. Making mechanisms more obvious to use correctly or fail safe if used incorrectly improves outcomes when flawed human beings use them. It also makes them more pleasant to use in general.

Besides, look at the man page in question. It's talking about this in terms of encoding niceties and doesn't even spell out the possibility of deliberate, let alone malicious multiline values:

"curl makes sure that each header you add/replace is sent with the proper end-of-line marker, you should thus not add that as a part of the header content: do not add newlines or carriage returns, they only mess things up for you."

That's inducing a wrong/incomplete mental model of how this parameter works.

Apportioning blame doesn't get rid of bugs; misuse resistant APIs do.

People still expect an API to reject illegal values. Calling the parameter --proxy-header (singular) could lead someone to assume that multiline strings are illegal values, even if there's a note in the docs somewhere saying otherwise.

Imagine running

  curl --proxy-header "X-Test: $UNTRUSTED_USER_INPUT"

For unencumbered assets I don't see why not, but extending this logic to the brand seems fraudulent: It's unlike other assets because the (original) company crafted it to represent the whole service in the mind of the customer.

They're saying they didn't buy the company - just some assets they liked, among them an intangible one: the brand...

Adafruit's Cloudflare settings must be dialed up to an extreme level, they're blocking web.archive.org, archive.today, Tor, Startpage's Anonymous View, ...

Like cmon you're running a shop and a blog, not a missile launch facility

Emergency calls bypass the network restriction. I don't see it documented for GrapheneOS, but https://source.android.com/docs/security/features/cellular-s... states

'Android allows users to disable 2G at the radio hardware level on any device that implements the capability constant, "CAPABILITY_USES_ALLOWED_NETWORK_TYPES_BITMASK". This stops a device from scanning or connecting to 2G networks.

Note: Emergency calling is never impacted. A device still scans and connects to 2G networks for emergency services.'

> The only simple thing you can do, that can have an effect, is to set your network priority to 5G-SA – but most phones don’t support this feature.

'add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode' - https://grapheneos.org/releases#2025022700

AFAIK for items shipped by Amazon the only way to rule out commingling is after delivery: If the barcode starts with an X that's an FNSKU (specific to a seller), meaning the item did not come from commingled stock. Items sold by Amazon itself never start with an X, so...

They could at least inform customers about the censorship and not sweep it under the rug:

> among all of the restricted products identified by this study, none presented a message to the user explaining that the items were unavailable due to regulatory reasons. Instead, each item was communicated as either being “currently unavailable”, “temporarily out of stock”, or that “this item cannot be shipped to your selected delivery location”.

"The tactic has been criticised by privacy advocates and non-governmental organisations such as NOYB and Wikimedia Europe, which claim that it is illegal under the GDPR. On 17 April 2024, the European Data Protection Board released a non-binding opinion stating that in most cases, consent-or-pay models do not constitute valid consent within the meaning of the GDPR."

https://en.wikipedia.org/wiki/Consent_or_pay

The thing that's new is making all of these puzzle pieces come together, at scale

There's a link in the report to an instruction manual for couriers, the "Kladman's Bible": https://www.pdf-archive.com/2017/11/19/kladmen2-1/kladmen2-1...

I don't speak Russian, but the photos look interesting. Does anyone have an English translation?

Wikipedia has a neat table of "notable synoptic theories" with diagrams like the one in the article:

https://en.wikipedia.org/wiki/Synoptic_Gospels#Theories

Exactly, the comment was carried over from V0.1 which set a 125 ms timer.

Very cool! Five minutes of this felt strangely soothing in my head, after a few nights of not enough sleep.

Being able to set a max duration would be neat, in case it's unsafe to lose track of time and let the pattern run for too long?

Classic outdated comment BTW ;)

  setInterval(flickerImage, 250); // 8hz

That seems like the right direction, but even for 20 kg bags I don't know how to evaluate Chinese suppliers of bulk foodstuffs

Are there companies who take care of the sourcing + importing + QA for retail veggie protein brands? Some actor in the supply chain just before flavoring is mixed in