HNHacker News
TopNewBestAskShowJobs

jfindper

471 karma · joined November 25, 2025

don't cite stupid/obvious shit in your comments, it's pretentious and condescending.

i know what the url for wikipedia is, thanks.

if you wouldn't link/cite it in an email to a work peer, boss, vendor, etc. then dont cite it on an informal message board.

submissionscomments
jfindper··on Break up bad companies; replace bad union bosses
>You see those complaints as reasonable?

My point is that these aren't "We are against teaching phonics" complaints, like the parent poster asserted.

I don't agree with the rest of your comment really, either, but it doesn't have much to do with the conversation.

jfindper··on “Super secure” messaging app leaks everyone's phone number
>I would rather pay $1 than with my phone number which is much much much more valuable.

Most people would not, though, and that's the issue.

jfindper··on “Super secure” messaging app leaks everyone's phone number
>So we can make registration or adding contacts paid (in cryptocurrency) and the problem is gone.

The majority of the user base would be gone, too.

I had a hard enough time convincing my friend group to use Signal as is. If they had to pay (especially if it had to be via cryptocurrency) none of them would have ever even considered it.

jfindper··on Upcoming Changes to Let's Encrypt Certificates
I think it's only a requirement if passwords are the sole factor, correct? Any other factor or zero-trust or risk-based authentication exempts you from the rotation. It's been awhile since I've looked at anything PCI.

In any case, all my homies hate PCI.

jfindper··on Upcoming Changes to Let's Encrypt Certificates
While I believe you're posting questions out of frustration rather than genuine curiosity, I think it's worth pointing out two things.

One: most of the reasoning is available for reading. Lots of discussion was had. If you're actually curious, I would suggest starting with the CA/B mailing group. Some conversation is in the MDSP (Mozilla's dev-security-policy) archives as well.

Two: it's good to remember that the competing interests in almost every security-related conversation is the balance between security and usability. Obviously, a 60-second lifetime is unusable. The goal is to get the overlap between secure and usable to be as big as possible.

jfindper··on Upcoming Changes to Let's Encrypt Certificates
>I'm still rotating password

A bit off-topic, but I find this crazy. In basically every ecosystem now, you have to specifically go out of your way to turn on mandatory rotation.

It's been almost a decade since it's been explicitly advised against in every cybersec standard. Almost two since we've done the research to show how ill-advised mandatory rotations are.

jfindper··on “Super secure” messaging app leaks everyone's phone number
>If you don't think I'm in the security industry, LOL

Please let us know who you are affiliated with!

jfindper··on “Super secure” messaging app leaks everyone's phone number
>[...] it was patched within a month. I'm in the security industry, and this is amazingly fast.

Lying is bad.

jfindper··on Break up bad companies; replace bad union bosses
>and can leave for another job at any time.

This may be true for you. If it is, congratulations.

It is not true for many.

jfindper··on Break up bad companies; replace bad union bosses
>If you want evidence, look to the Teachers' Unions own efforts to oppose phonics education:

This does not read like an "effort to oppose phonics education". In fact, I did not see one mention of one single teacher who is opposed to phonics.

The complaints are about implementation timelines, continuing education requirements, potential over-stepping of policy-makers re: teacher autonomy in the classroom, etc.

>“To the extent that these laws remove teacher choice from certain decisions about curriculum and pedagogy and instructional style, it’s not at all a surprise that you’d see unions be in opposition to those, even if they support the arguments behind the science of reading,” said Melissa Arnold Lyon, an assistant professor of public policy at the University at Albany.

>"“That’s establishing a precedent that is really dangerous and really could open up schools and teachers to all kinds of litigation, and all kinds of conflict and problems,” said Scott DiMauro, the president of the Ohio Education Association. “You’ve got to always be cautious about micromanaging decisions that ought to be made at the local level.”"

>“That raises a lot of academic freedom questions for us, that raises a lot of questions about being able to differentiate based on student need,” said Justin Killian, an education issues specialist at Education Minnesota."

>District leaders need time to create new instructional plans, money for new curriculum materials, and systems in place for coaching and supporting teachers—provisions these laws don’t always include, Woulfin said.

You are confusing "against the legislation as it is written" with "against teaching phonics".

jfindper··on Break up bad companies; replace bad union bosses
Missing the "when there's a choice" part of your sentence. Often there isn't.
jfindper··on US Tech Force
How are they different?

Well, they're different. That's how.

jfindper··on It seems that OpenAI is scraping [certificate transparency] logs
It is an _incredible_ stretch to frame certificate transparency logs as "content" in the creative sense.

The whole purpose of this data is to be consumed by 3rd-parties.

jfindper··on It seems that OpenAI is scraping [certificate transparency] logs
Which part is news?

If certificate transparency is new to you, I feel like there are significantly more interesting articles and conversations that could/should have been submitted instead of "A public log intended for consumption exists, and a company is consuming that log". This post would do literally nothing to enlighten you about CT logs.

If the fact that OpenAI is scraping certificate transparency logs is new and interesting to you, I'd love to know why it is interesting. Perhaps I'm missing something.

Way more interesting reads for people unfamiliar with what certificate transparency is, in my opinion, than this "OpenAI read my CT log" post:

https://googlechrome.github.io/CertificateTransparency/log_s...

https://certificate.transparency.dev/

jfindper··on It seems that OpenAI is scraping [certificate transparency] logs
It implies that this is boring and not article/post-worthy (which I agree with).

Certificate transparency logs are intended to be consumed by others. That is indeed what is happening. Not interesting.

jfindper··on It seems that OpenAI is scraping [certificate transparency] logs
The intended purpose of certificate transparency logs is to be viewed by others!

Perhaps you should save your "gross" judgement for when you better understand what's happening?

jfindper··on Europeans' health data sold to US firm run by ex-Israeli spies
This is a silly take unless you believe that Apple facilitated its devices being hacked.

Privacy and security are two different things.

"It’s interesting to observe who it’s fashionable to hate and the double standards this community applies to tech companies" Indeed....

jfindper··on Why more American seniors are getting high
>Most users of harder drugs indicate past use of marijuana.

Most people who are in hospice indicate they drank water in the past. Is water consumption a gateway to dying?

jfindper··on Why more American seniors are getting high
Extreme exaggerations make for poor arguments.
jfindper··on The Tor Project is switching to Rust
You're correct, incognito mode never has been for privacy protection from websites, ISPs, etc.
jfindper··on The Tor Project is switching to Rust
You're reading way to much into the title. "[...] is switching to [...]" does not have any implication of being a "spur-of-the-moment" thing
jfindper··on The Tor Project is switching to Rust
>better portability across operating systems

Does Rust have better portability than C?

jfindper··on The Tor Project is switching to Rust
>Hey, if you want a fast anonymity netowrk, there are commercial providers.

For most people seeking anonymity via Tor network (whistleblowers, journalists, activists, etc.), paying a company who can then subsequently be compelled to hand over your information is a bad choice.

And in most other scenarios, Authentic8 is probably still a bad choice. If you require a FedRAMP-authorized service, then sure, look at Authentic8.

jfindper··on The Tor Project is switching to Rust
>It’s not supposed to be a primary browsing outlet nor a replacement for a VPN.

Tor wants people to use the network for primary browsing because it helps mask the people that need the protection. The more people using the network, the better for everyone's anonymity.

They even have a whole "Outreach" section at https://community.torproject.org/outreach/

jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
I'm certainly no expert, but if my memory serves me correctly from cases that have hit the media, the carve outs are more broadly applicable than just to sex (e.g. intimate images between partners). But I could certainly be wrong!

(I didn't really want to start looking up the exact details of this topic while at work, so just went from memory. At the very least, the terminology "Romeo & Juliet Law" should give the original commenter enough to base a search on)

jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
Obviously this depends on the country, but many countries have so-called "Romeo and Juliet" laws which carve out specific exclusions for situations along these lines.
jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
>Why hold a random forum post buried in the middle of a large thread to a higher standard then the professionals writing headlines shown in 30-point font on the frontpage of their publication?

How many times do I need to repeat that I agree the headline is misleading? Yes, the article here has a shit title. You already made that point, I have already agreed to that point.

If I had an easy and direct line to the editor who came up with the title, I would point that out to them. Unfortunately they aren't on HN, that I'm aware, or I could also write a comment to them similar to yours.

jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
>Even if it's an Ai image?

This varies by country, but in many countries it doesn't matter if it is a drawing, AI, or a real image -- they are treated equally for the purposes of CSAM.

jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
"There is important additional context around it, of course,"

Indeed, which is why a comment that has infinitely more room to expand on the context should include that context when they are criticizing the title for being misleading.

Both the title and the comment I replied to are misleading. One because of the framing, the other because of the deliberate exclusion of extremely important context.

Imagine if someone accused you of "Uploading CSAM to Google Drive" without any other context. It's one of the most serious accusations possible! Adding like five extra words of context to make it clear that you are not a pedophile trafficking CSAM is not that much of an ask.

jfindper··on A Developer Accidentally Found CSAM in AI Data. Google Banned Him for It
>They got banned for uploading child porn to Google Drive

They uploaded the full "widely-used" training dataset, which happened to include CSAM (child sexual abuse material).

While the title of the article is not great, your wording here implies that they purposefully uploaded some independent CSAM pictures, which is not accurate.

← PreviousPage 2 of 6Next →