jeroenhd

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS.

You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems.

Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.

> depending on what "state of the art and effective" means

This isn't codified into law for good reasons. Technology shifts and you don't want to have to update laws every time someone invents a new cipher or protocol.

The website is defending itself from having to pay a fine because they're blocking VPN users. They require blocking VPN users to skirt around the extreme terms in Dutch copyright law. If they didn't block VPNs, they would've lost already.

This boils down to "did they try hard enough not to violate copyright in the place(s) where copyright was still applicable".

They didn't like that the Dutch copyright law didn't apply outside of the Netherlands and tried to take back the documents with the "anyone visiting this page can be Dutch and therefore Dutch law still applies" argument.

It's not about a free internet, it's plain old copyright and control.

> However, in the Netherlands, parts of the text remain protected by copyright until 2037.

I'm not for complete copyright abolishment but this is absolutely insane. In this case, the copyright term is so long because the original copyright lasted 50 years after publication (rather than the author's death), but a change in copyright law changed that to 70 years and moved the counting date.

Regardless of legalities, taking action against distribution of Anne Frank's diary seems like the exact logical opposite of what this fund should be doing.

> could've (and did, partially) just bought

But they didn't. The fact they partially did proves that they knew they should've, so they can't even claim ignorance.

I don't think American laws such as s230 apply here, as Codeberg is German.

If you want to be the arbiter of what you make, throw an instance of https://forgejo.org/ online. It's practically the same as Codeberg except you get full control.

The support they will receive for banning slop will probably outweigh the negative press for a false positive.

One has to wonder how many of these vibe coding accounts are being defensive themselves, rather than having their LLMs be defensive for them.

I'm surprised it took them this long. Good on them.

I don't think this should have much impact either. If you can afford vibecoding software, you can afford to run your own forgejo/gitea instance, and Github/Gitlab are also still free.

Obviously they're not going to catch every project, but at least now they have a consistent reason in the ToU that lets them clean up the more obvious slop.

The device came out about a year ago: https://www.notebookcheck.net/The-HMD-Touch-4G-is-an-all-scr...

It looks like it's still India-exclusive. I haven't heard much about it online, and with a dedicated chat app I would've expected to if it was a success. Did it bomb?

NSA can be rolled out with almost nothing more than a firmware update. For any existing carrier network, it was the obvious place to start 5G rollout.

If you're building new towers, things change, obviously. That said, a lot of industrial/IoT hardware still requires 4G so it's not entirely unreasonable to deploy 4G in new coverage areas.

My personal feelings about the matter is that having an LLM rewrite the entire thing as an experiment and then just going with it a few weeks later kills any incentive for a community to build up around it. It's a clear signal that every basic aspect of the runtime can change on a whim.

I don't care about meh Zig being rewritten to bad Rust if it does the same thing, but taking what is presented as" look at this funny experiment I did" and then taking that into production with barely any announcement is what kills off the interest to me.

Bun has been a great ad for whatever LLM they were using but the cool factor is gone now, and that's really what set it apart from basic NodeJS in my mind.

With the right simulated events, a headless browser becomes indistinguishable from a real browser without platform detection. It's not hard to figure out that these headless browsers are running a software renderer on Linux. In time, they're just going to have to detect Linux users and force them to fill out one or multiple challenges if workarounds like these keep getting used.

The checkbox is just a small part of what the checks are doing. It's monitoring everything the browser is doing and how the browser is responding to certain events up until you tick the checkbox, at which point it determines if you need one of those "are you human" challenges or if you can pass without interruption, based on how bot-like you are.

slotMusic/slotRadio has tried to sell music through SD cards. They never took off, but a full SD card would probably be the best balance in terms of reliability, size, and capacity in my opinion. Plus, a surprising amount of media devices still carry SD card readers.

Flash storage developments came too late, but the spinning disks and risk of physical damage to the plastic are an annoying risk to have to deal with. Even Minidisc still required some form of physical motion.

If you have enough USB ports, you should be able to get away with using DisplayLink dongles for the video part. DisplayLink doesn't require any additional video processing hardware (unlike DisplayPort) or even USB-C ports, you can run the old DisplayLink standard over plain old USB 2! Not great for playing video, but a terminal app should run just fine.

I think the current driver restricts you to 4 displays but I'm not entirely sure why (you can do 6 on Windows so I think it must be a driver issue).

Of course, with your RPi idea, you could connect one computer to dozens or maybe hundreds of serial ports, but if all you want is five more screens, USB should do fine for your needs.

Installing Graphene can be done through the browser: https://grapheneos.org/install/web

It's not as easy as it can be (the text is aimed at people familiar with Android flashing) but in practice you need to toggle one setting, reboot holding the volume button, and then click four buttons in your browser in order, with the exact names for settings spelled out in the guide itself.

I don't think wiping an abuser's malware is such a great solution unless you've already managed to get out of the DV situation. Perhaps GrapheneOS is a good idea on a secret second phone?

So far market demand hasn't pushed Brave, Opera, Vivaldi, or anyone else in this direction. It's not just Mozilla, who is often late to these kinds of developments.

With how few iOS users I see the existing content blockers already, shockingly few people as far as I can tell.

I want to see Brave and Firefox fight it off in an ad-blocking-mobile-browser competition to get some more market share, but it seems like iOS users are content with just Safari and ads.

Let me put it another way: why has no other browser company released a browser yet? Mozilla is only a small player, after all.

Need to? Probably not. Reynard isn't on the app store, though, so Mozilla's efforts wouldn't be very comparable if it wasn't.

Plus, iOS can really use a solid F-Droid alternative.

> You tell someone who's dying for a non-webkit browser on iOS

Firefox has struggled to get the sliver of market share they have today. I highly doubt that there are that many people like you and me who crave a real Firefox engine on iOS.

> which is what they should be testing anyway

Having a large part of your team be unable to reproduce bugs is a significant development issue. Some of these operating system features are simply not available outside of the EU.

If it were as easy as you're suggesting, Mozilla would have already done it. Google would have already ported Blink over, or Brave, or whatever browser you prefer. So far I think only Ladybird is really trying to go for a custom browser engine, though app store distribution will be an issue until they can pass enough tests (as Apple has decided your browser is not a real browser if it doesn't pass a certain threshold of existing tests).

> and you dare to use an alternative browser on iOS

The website works just fine for me on Firefox+iOS, it seems like whatever matching the author is doing just doesn't include detection for Orion.

If you use a custom select, update your <datalist>, you should be good, shouldn't you?

There are UI components that are not available in native browser controls (infuriatingly: some are only available in some browsers on some platforms), but even then you're better off writing a shim to replicate normal browser behaviour than ruining the experience for everyone because Firefox on Android doesn't have a colour picker.

One reason is that Apple does not permit regional binaries, so you cannot use the same listing in the EU/Japan/Brazil/whatever other place may force Apple to act sociable and the rest of the world.

Creating a separate app would work, but all existing Firefox users would have to download a second Firefox browser app, probably sync their accounts if they want to keep their data, and then remove the old one manually. You'd end with a Google Meet/Microsoft Teams situation (where one app is labeled "new" and it confuses the hell out of everyone).

Furthermore, developers cannot actually use the released app they've made if they're in the US, where a lot of Firefox devs are.

Then there's the (what I can only presume to be illegal) Apple Tax you need to pay to distribute an app outside of the app store (which is what the Github repo linked is doing), which is an amount paid per user that downloads an app outside of the app store. Epic has promised to cover that cost (out of spite, probably) for one of the major alternative stores, but if they go back on their promises you're suddenly paying Apple so people can use your free app on the phones they bought.

There are also other issues (Apple's arbitrary testing requirements, for one); Apple has once again succeeded in implementing the law in such a way that it's impossible to exercise your rights. Until the next big Apple lawsuit about this, I don't expect browser companies to bother with a non-Safari overlay.

I tried enabling their "advanced security" programme on my account and it's currently refusing to continue without at least 2 keys configured.

The first "hardware key" is actually my Bitwarden faking a hardware key (I'm sure they'll start blocking BW because of this in the future) but it doesn't let me add a second one unfortunately.

The concept itself has been done a few times before. This Reddit thread has an explanation on how you can generate these yourself: https://www.reddit.com/r/StableDiffusion/comments/18aoqs0/co...

The good old https://huggingface.co/monster-labs/control_v1p_sd15_qrcode_... model and its predecessors also help.

The technique works for other black-and-white masks too: https://reticulated.net/dailyai/ai-generated-qr-codes-with-s...

A frightening amount of people have no idea how AI tools work, even those that should know better. I have seen senior software developers fall for the mistake of believing an LLM output when it spews bullshit about how its own memory or restrictions work.

LLMs will listen to you and follow your instructions and restrictions most of the time, which seems to be enough for people to believe that they will every time. I've come to terms with the impact slop coding will have on most software jobs in the future, but seeing seemingly intelligent people fall for lies and fantasies concocted by an LLM is making me more and more uncomfortable with the direction we're all heading in.

selinux doesn't help when the kernel itself has been compromized like this. Sandboxes from Android and containerisation tools like Docker do not protect you against this exploit. The only feasible method of restriction is full virtualisation (assuming that if you use KVM, last week's CVE-2026-53359 patches are rolled out everywhere).

Any app that can run native code execution on any version of Linux in the past fifteen years can get root until kernel updates arrive on your devices.

That's what's being done, isn't it? Fingerprinting technologies and proof of work are trying to authorize people and block bots. Unfortunately, companies like these are trying to bypass the authorization controls.

If these scraping companies would respect some kind of X-Scraping-Permitted header, this whole process would be a lot better, but that's not going to happen in an industry that has already normalized using botnets.

> Most users aren't spoofing their user agent headers to be a different operating system.

The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

Kind of a smart move by this company: write up an AI analysis of all fingerprinting techniques in hopes they get fixed after outrage so their scraping company can make more money. If it weren't for companies like this, fingerprinting wouldn't be so ubiquitous and the internet would be a better place in general.

I prefer articles like this coming from the other side of the battle (fingerprint.js and friends) because at least their motives are clear.