jeroenhd

There is no technical reason why migrating between homeserver software doesn't work, there just is no tooling for it. Someone could build a Dendrite-to-Matrix exporter+importer. The protocol itself doesn't really care about what server software you're using.

I don't know any good messenger that doesn't tie their accounts to something portable. Plus, I think the ability to reset your password/passkey/whatever if you forgot it is way more important than having users manage their own identity roots for any serious messenger. The alternative is very cool, technology wise, but not really something I would care to use and maintain.

For users migrating accounts, there was a tool (not sure why it died) on the Matrix website that would log in to both accounts, go through each room and where possible invite the new account, and leave with the old account. As long as you have invite/join permissions, that's all you need to do for most chat rooms. 1-on-1 chats need some extra commands to set the metadata right so clients recognise them for what they are, but even they can be ported over, mostly. It's not a perfect solution, but it's lots better than nuking your entire account and starting over from scratch.

We've had MMX for a while now, I don't think we need to wait much longer.

I don't really see why you would need specific hardware to express a type in a programming language, though.

It would make for a good alternative, but so would any app that doesn't implement scanning. If they can force Signal to implement client-side scanning or ban it entirely, they can do the same to PGP software. In theory you could do RSA by hand, but it would require a lot of hard work.

Honestly, I wouldn't be opposed to that either. If we're protecting kids, we should also protect the old and feeble. Old people, people with developmental handicaps, you name it: they're being exposed to a world that can and will abuse you if you have any faith in humanity left and don't have the technical skills to identify things like fake domains and scam sites.

For some reason we're making sure no 12 year old can drive or run for any government positions, but a 90 year old can keep the driver's license that they've had since before the start of colour television, or make critical decisions affecting millions. We can't have it both ways.

Parental controls have been part of mobile devices for years, but so have bypasses. For instance, you can bypass Google's parental control settings by opening the help page in the Google settings and clicking links until you get to the Google homepage.

I doubt it matters because nobody seems to configure the parental controls that are there, anyway. Only schools seem to try, and only because they're legally held responsible for what kids do on their computers.

The authorities open letters all the time. Try sending a letter to prison without it getting scanned.

The problem with this comparison is that the authorities can open a letter if they need to for various well-intended reasons, but they cannot open an encrypted message. Either the authorities can scan all messages, or they can scan no messages, there's no inbetween.

The mandate to verify age before selling alcohol has been around forever. This is not a new idea. The biggest restriction until now has been that there was no good way to do these kinds of age verification, but that problem has been solved. You can still debate whether or not age verification is a good idea for specific subjects, but selling 10 year olds alcohol or porn has been illegal for much longer than the internet has existed.

Laws have been written that mandate that applications and services treat various age ranges differently. You can't serve porn to kids, kids under 15/16 have very strict privacy regulations in some areas, and certain content age ratings are an industry standard only because that was the industry way of getting out of being regulated.

For kids this is a privacy risk because there are so many thresholds. Once you're above 18, all you need to care about is "are you a pensioner".

Kids have been lying about their age since the dawn of the internet and people have started catching on, so now we're getting actual restrictions rather than the assertion that nobody in their right mind would click "I am 18 or older" to access a website.

Californian law mandates that operating systems keep track of their users' age, so of course Android must follow. In all of the cases listed on Google's blog, though, the option to not share information and download an app that doesn't ask for your age range is still an option.

They're Americans trying to appeal to other Americans. Of course everything they do is justified and everything everyone else does is an evil scheme to plot the ruin of American freedoms. How else are you going to convince the dementia patients in charge of the country?

If China, India, the EU, and everyone else has any sense, they should take this letter to heart as much as Anthropic wants the American government to.

Dutch iDeal|Wero uses incompatible QR codes and a bank selection flow compared to international Wero. The real Wero implementation comes next year.

They're trying to ease in Dutch customers to the Wero brand, but in the mean time they're confusing every tourist or immigrant with their wero-but-not-wero system.

I like the Taiwanese approach. Every receipt is a lottery ticket, so people have good reason to demand registered receipts.

The Wero system isn't just a rebrand of iDeal. It also includes a wallet app and the ability to transfer money between regular people, not just online checkout.

From the article:

> Decathlon switched on Wero on decathlon.de on July 20, making Germany the first market in the French group’s international footprint to carry the European payment scheme.

That's probably the cause for confusion, because the Dutch system has been rebranding itself to Wero for ages and switched over permanently very recently.

Decathlon.nl has had Wero for months, though they did it through a different implementation method. Of course, the marketeers prefer to put the focus onto the next-gen system their German counterparts have just implemented.

You can use it. Just use any other browser. Chrome is free, Brave is free, Vivaldi is free.

We can't even agree on wasting less fuel or moving to less damaging fuel sources.

One of my issues had to do with pure bandwidth, dozens of bots were requesting the same image over and over again adding random crap to the query. My server was being slow for me during crawling peaks.

> An actual proper static site would likely 10x that.

A lot of the stuff I host isn't static. Any non-static content also gets overloaded pretty quickly. Hosting something like a Git server can turn pretty resource intensive if shitty bots start diffing every commit with every other commit.

I'm generally lazy when it comes to blocking IPs, but when I do run into an issue, I just blanket block IP ranges. When that doesn't work, ASNs get blocked. So far I haven't had to take most measures mentioned here but I probably will once the broken bots start coming from botnets using residential IP addresses.

They don't want love, they want money. Tracking people is an effective way to make money. You can make some money with non-tracking ads, but these websites want more money than that.

Good websites sharing stuff for the fun of it rarely ever add these obnoxious banners. They probably should if they embed other trackers (like Youtube or Google Fonts) but often just don't. It's only the ones that want to make money off you that bother putting in the obnoxious banners.

The "legitimate interest" bullshit is already illegal. I don't see why websites would stop doing illegal things because of this change.

It depends on how "native" you look perhaps, but you can be detained for more than a week and a half if the border authorities don't like you: https://www.theguardian.com/us-news/2025/apr/20/us-citizen-j...

Of course they shouldn't do that to US citizens, but they also shouldn't be targetting protestors they have a personal gripe with.

Android has had multiple users for many years, though it's a feature most smart phone brands turn off for some reason.

You can switch users just fine, you just cannot hide the primary user from the secondary user. Opening up the device also makes it a lot more vulnerable to attacks to dump the keys and storage.

Having multiple users is quite handy but it's not going to do anything at a border checkpoint that'll save you.

This person was under "investigation" for protesting against cop city. The authorities were waiting for him to turn up at a place where the law would give them more power.

They were never going to let him just walk in. Eventually, they'd have to, possibly after lawyers and news would get involved, but it's not like saying "no" was going to end the ordeal right away.

The United States has famously shot and killed protesters in the Vietnam war era. They have dedicated torture facilities for people suspected, not even convicted, of terrorism. Police officers use lethal violence for no reason every month and rarely get more than a talking to.

In a perfect society, your point makes sense, but I don't see why the authorities in the real world would need to care about committing a worse crime.

Modern Pixel phones have a TPM-like device that protects against brute-force attacks. Assuming the pattern is non-obvious, an attacker has 20 attempts before the supplementary key material is wiped and the encryption key is lost.

It's theorerically possible to use side channel attacks against the security chip to bypass this, of course, but that requires opening the device and some very precise, damaging operations, assuming the attacker has a known-working side channel attack in the first place.

There's a neat project out there that can read your water meter into home assistant using an ESP32+camera+computer vision. I imagine a small TPU like this could be very useful for similar projects. More compute means higher resolutions and more reliability.

The moment an article like this hits HN or Reddit or any other such forum, any hope of changing anyone's mind is lost. The same happens to Github issues too. I haven't checked the isue myself, but seeing it here means it's probably already too late at this point, it'll probably get flooded.

Google does take feedback from app developers every now and then, but obviously their own teams' feelings on the subject are more important to them than some open source developers relying on a hack like in this article.

I think it should be quite obvious that the ADB daemon wasn't designed to enable call recording from an app initiating an adb session over a loopback address. https://xkcd.com/1172/ strikes again.

That doesn't mean the developer who wrote this is wrong to dislike the change: Google themselves have added call recording to their dialer a while ago so it's clearly a feature they stand behind. That doesn't mean the adb team shouldn't do a little security hardening, though.

A "passkey" is a bunch of metadata and a public/private keypair. It doesn't do anything by itself, of course. A physical device, like a Yubikey or a Titan, doesn't have Bluetooth. For phones and tablets these keys do support NFC but that's a whole different story.

The Bluetooth connection is how your phone exchanges the key and authenticates you through the computer. In its most secure phone, the key never leaves the dedicated security hardware/trusted execution environment that protects your key from snooping, the same way you cannot get a physical U2F key to give you the private key bits.

You scan a QR code to set up the pairing/connection process (if you haven't already), then a Bluetooth Low Energy exchange happens. You confirm you want to sign in on your phone (so you don't get tricked into scanning a QR code), then the cryptography happens that authenticates you.

You can find the protocol here: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl...

It should be noted that, at least on Android, any credential manager app will support this exchange. The passkeys in the Bitwarden app on my phone work just like the native Android key store when scanning a QR code, for instance, and other apps will also work. You can switch authenticator apps in the pop-up, or set a dialog in the Android settings if you want to switch the default.

Furthermore, there are also CTAP2 implementations for smartwatches (at least for Android smartwatches) that let you authenticate with a tap on the watch. That flow doesn't use a QR code for obvious reasons, you would need to manually connect your computer to the watch before it works. I believe https://github.com/fmeum/WearAuthn is the prime open source example of this feature.

It works perfectly for passkeys stored in Bitwarden on Android. Don't know what iOS is doing.

Click the "lost password" button. Passkeys aren't magic, they're just a funky password.

If the website didn't implement a "lost password" button then that says a lot more about the website than it says about passkeys.

Passkeys work just fine with Bitwarden, LastPass, KeepassXC, physical keys, several software tokens, and TPM storage.

So far only Nintendo has been absolute assholes about requiring specific passkeys, but that's maybe the least assholish thing Nintendo has done.

This is the one Bluetooth feature that has always worked for me out of the box on both Windows and macOS. I haven't tried Linux yet to be honest, no idea if anyone has bothered implementing it yet. Usually open source is a couple years late to this sort of thing (except for maybe distros like Android or ChromeOS).

Now, if only Windows, macOS, and Linux can get together and fix whatever needs fixing to get headsets to connect properly automatically, that'd be grand.

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS.

You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems.

Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.