jeroenhd

Swapfiles on BTRFS seem to work great if you allocate them early (with the command linked in your article) and put them in a different subvolume than the rest of your system.

BTRFS in general seems more I/O constrained than ext4 or xfs so it's probably still worse to put a swapfile on a BTRFS partition, but so far my systems are doing fine.

Windows also does a neat trick Linux lacks: automatically adding more swap, up to a limit. Systems with loads of RAM barely lose any storage to swap, but once they do get hit, they can get many gigabytes of swap space without user interaction. I believe macOS does it too, of course.

I'm sure there are many reasons why Linux can't do that by default, but it's a real shame.

What reason would your professor have to have you take it down, at least past your due date? One could claim copyright on the project itself if you shared the files, or if you kept the original framework a course might provide, but the work you did is yours.

It's not like heap allocators are hard to come by, there's one right there in the Linux source code.

I've had plenty of courses where professors were afraid of answer sheets leaking out because they intended to use the exact same tests and practicals the year after. Those were always the courses where someone had a copy of last year's answers that was passed around between groups of students. You can't rely on secrecy to save yourself from having to come up with different tests if you hand out a piece of paper to 50 or even 300 people.

There's quite a difference between stealing a loaf of bread and making a career out of fraud to pay your way through college.

Of course, this type of fraud is legal for the one doing the work, so even on that front the comparison doesn't really work.

Beats scamming old people out of their retirement money, I guess, but not exactly a job that people will feel bad about disappearing.

Your link is explaining an addendum on the link OP posted.

My guess is that OP got their account flagged as being a minor and posted the link in either surprise or (understandable) outrage after finding out that Claude has been asking people for ID.

The usual read on cybersecurity determines how bad an issue is using (something akin to) impact on confidentiality, integrity, and availability.

Being able to freeze a computer from the browser is a plain availability risk. It's not exactly a high-priority risk, but still something that should be considered a risk in my opinion.

With operating systems like macOS+Safari reopening a page after reboot, a malware domain can claim to take your computer hostage by te-freezing the PC every time the user moves away from the page until money is paid. People already fall for "we have hacked your computer pay X bitcoin to get it back", this just adds to that.

According to the comments here, this has been a thing for ages, so I kind of doubt that they'll fix it this time. But fingers crossed!

Pixel 9 Pro with Brave, it just sort of freezes for a second or two before I can close the tab using the normal brave button.

Wonder what made the difference. I must've disabled some shady JS attack surface at some point.

You could probably make a pretty believable virus page with this. First you freeze the screen, forcing the user to force reboot. Then, when the system boots again and reopens the website (at least Safari does), you go full-screen and show a "your computer froze because of a virus" screen.

Making the user force-reboot the computer would make the usual fake AV shtick a lot more believable.

"May 18, 2026" is right there next to the title. Nothing changed.

println!() already works, who needs more than that?

Kidding aside, VS Code has excellent debugging support already. Unless you need to share your Rust code base with a legacy C/C++ code base, I don't think VS is the best environment for Rust programming.

There are good use cases for staying within full-fat VS's capability set (drivers, among other things), but I don't think Microsoft needs to add Rust to VS in this much of a hurry.

I don't think "European children will look at the map and feel less significant" is a carefully neutral observation. It's an assumption that European children feel superiority because their country is slightly bigger.

If anything, I expect the accurate sizes set the stage for feeling superiority over their ancestors colonizing huge lands while coming from tiny countries.

If we're talking about kids, they should just get taught this type of geography using a globe. You can get an accurate (enough) inflatable globe for like 3 euros, including shipping.

And you can still sell your work, even without copyright.

> With no copyright whatsoever, there would be a well-organized company with a better marketing department selling their version of your work, taking all the profit, and making it impossible to actually sell it yourself.

That's exactly what the AI companies are doing right now. Except they're not even selling your work in any kind of recognisable form.

> don't bother to make it even possible to counter claim in that way and trigger that side of the law

It's not their responsibility. For that part of the law, you need to get your lawyer involved. And your lawyer will probably tell you not to waste your money, because the way the DMCA was written makes it practically impossible to find enough proof to actually win.

I don't think the "internet is a series of pipes" politicians could've foreseen Youtube or TikTok, but had I believed that the authors of early internet legislation had that foresight, I would've accused the law of being intentionally written to lead to these implementations.

> What's to stop other people making and selling digital copies the moment it's published?

What's stopping people from doing that now? The moment you sell something of any interest, you can be sure to find a copy of it free on the internet somewhere.

Strict mode has always been broken for me. Firefox replaces some of Google's tracking scripts with no-ops but that usually breaks Google's reCAPTCHA on my end. I have to disable tracking protection to make reCAPTCHA sites work.

I think it's fair for Google not to fix Firefox's shims, so I don't know who to blame for this. I doubt it's part of some big conspiracy against Firefox, though. I don't think Google cares enough about Firefox to bother annoying Firefox users.

Archive.is has had downtime this weekend when I tried to use it. They also regularly pull shady stuff, so I wouldn't be surprised if they did something stupid again and got themselves banned from reCAPTCHA.

The G'zOne made headlines being the first water resistant phone and it had a replaceable battery from the very start. The Fujitsu F-02D was another good example, with a fully-featured touch UI while still boasting something other than the slab-of-glass designs of today.

These phones weren't very popular in the west (Japan in particular had a large waterproof phone market, allegedly because people were taking them with them into the shower), but they have existed for a years, before the first Androids or iPhones became water resistant.

Phones like the Samsung XCover (the Android 2.3 one from 2011) were sold worldwide and featured a hotswappable battery. Over time these became bulkier and frankly uglier as they doubled down on how "rugged" they were, but the technology was clearly there.

Sure, there are loads of easy solutions to this problem. Putting everything behind Cloudflare is the most common one, Anubis and its competitors are another. I could also block all data centers, countries with loads of CGNAT + botnets like Brazil, China, and probably India, and refuse any user agent not in the top 5 modern user agents with a little TLS fingerprinting to make sure.

I could probably also analyze all the paths across my servers and write some bespoke Nginx config files to filter out all requests with illegal queries, but that's harder, more fragile, and just leaves the servers open for the next time a scraper finds a new way to screw me over.

The bots I'm fighting have gone for the nuclear option, relying on botnets and spoofing to bypass basic filtering, so I don't see why I shouldn't do the same.

Waterproof phones with replaceable batteries existed, but they used more rubber and other tricks to pull it off. This had the advantage of making it a lot easier to close the phone again and still keep the water resistant properties.

Having replaced the battery in my old phone, I sure understand why people don't "choose" to do so. The battery itself is worth maybe 20 bucks but the labour and tools required to replace it cost much, much more.

Compared to spending 30 bucks on a secondary battery back in the day, things sure have gone downhill since the days of user-replaceable batteries.

All carriers I've tried in my country have even disabled MMS entirely. They're not running RCS servers either, though, everyone is on WhatsApp anyway.

In theory carriers could increase the max resolution for MMS now that 3G is essentially dead, but I doubt they will now the slow move to RCS has started.

RCS is an extension of SMS and has quite literally been "SMS but more capable" from the start. The protocol on the wire looks a lot like MMS over LTE. Registration and communication mostly happens over SIP and RTP like in the latest MMS specs.

The early versions of RCS were barely implemented. Android and iOS didn't bother including clients, carriers didn't bother hosting servers because the spec was optional, and third party applications made by carriers were launched and then died because carriers couldn't explain to customers why their app was better than WhatsApp e.a. for those in the market for alternative messengers.

I think it's safe to say that RCS would've died a quiet death had Google not used it as a basis for their own Hangouts alternative built into their SMS client.

When RCS was first (soft) launched back in 2008, E2EE messaging practically didn't exist. Google slapped E2EE on top when they hosted their own iMessage alternative to bring it into the modern era but the base spec was still "what if MMS wasn't so outdated and restricted".

Regular users store the cookie and do the challenge once. Bots do it over and over again throwing out the cookies so they're not rate-limited.

Extreme configurations with high difficulty do make for a frustrating experience on very old devices, but in practice it rarely gets in the way.

Only the tail end of what one could consider normal users (those running custom browsers or having JS disabled or nonfunctional) run into issues here, but they'll have these issues with any other bot-blocking mechanism that still offers some protection these days.

Apple's "ask your vendor for tokens to exchange for access" web standard gets around this, assuming those bespoke and Javascript-less browsers implement PATs, but that standard seems to be completely dead in the water outside of Safari.

Shitty scrapers hitting images over and over again is also a problem. Not just /pic/1.webp - /pic/2.webp, but in practice I've seen three AI scrapers that would request things like /pic/1.webp?version=webp&foo=bar and other random query parameters that none of my domains even use. It's just stuck brute-forcing files or something, sucking up loads of bandwidth downloading the same image for no reason.

It also depends on if you want your content to be scraped. Any bot ignoring robots.txt should be considered potentially malicious and worth considering such mechanisms for.

The Dutch transfer out of Canada is minimal and pretty much a token amount. Most gold has been transfered out of the USA.

As for why, the American people elected Donald Trump for a second time and the recent trade wars have helped spread the notion that maybe the USA cannot be trusted by its supposed allies as much as it once could be.

Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).

Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

Those are all controlled by companies in and subject to the demands of the USA, which has been proving for many years that they cannot be trusted.

Also, all common names with any of those prefixes have been registered a long time ago.

There are other Android stores. Amazon ran one for the longest time. Many brands have their own app stores as well.

It's the app publishers defaulting to Google that's the biggest issue.

At least WhatsApp has an official APK download, most apps don't.

That said, Google will still let you update apps without being signed in. Hold the Play Store icon to open the quick action menu. From there you can go to "my apps" and update all of the apps on your phone, bypassing the login prompt. Not great, but a workaround that should do the trick while Aurora finds another way to hack their way into the Play Store APIs.

It highly depends. Everything from "monarchy" to "indirect democracy".

Even the Americans don't elect their president directly, they have a special council inbetween to distribute more power to the sparsely populated states.

Russia is a direct democracy (the people do directly elect their leader) but also the example of why technicalities like that make no difference in how fair politics are.

Currently, the EU is in a de facto war with Russia, in a trade war with the USA and China, and previous colonies don't seem to care too much for the West either.

The USA would like to see nothing more than an explosive end to the EU and the Russians have been trying to kill any united front against their invasion plans for longer than the EU has been around.

Every major world power has the money and motive to spread misinformation about the EU. They're influencing extremist European parties to repeat their talking points so they can point at a source on the "inside" as well.

The more people think the EU is some kind of awful oppressive regime, the more power the other world powers will gain over Europeans.

The proof-of-work approach is much better privacy-wise than what the usual CAPTCHA services are doing.

My ungrounded speakers have a tendency to pop and make noise when they come out of sleep (sleep? on a speaker? fuck you logitec) and every time these "simple" CAPTCHAs come up, even if I pass without solving their logic puzzles, I hear the speakers activate as the Javascript on the page is figuring out what kind of audio setup I have by playing a silent sound file.

The default Anubis config isn't really a problem for any devices I've tried, but the FFMPEG Anubis setup is quite extreme. I seem to be served the extra-difficult Javascript challenge, as well as a high-difficulty challenge, that takes even powerful computers quite a long time to complete.

Could just be countermeasures to the hug of death every website gets when they get linked on HN, though, but someone would need to set up auto-scaling for that.