pona-a

Someone needs to make a program that captures/replays your vim movements and another one that uses this to find the shortest path within every chunk.

Agree but it can definitely be redistributed. The overwhelming majority of users should better think about #936 than #538.

For me, eSIM was the only solution to a very real problem: being able to use virtual carriers without mailing a physical SIM. I can pay anonymously for a regional SIM from my MVNO at an affordable price, without giving a local carrier a copy of my passport to retain indefinitely. Unfortunately, they still only resell incumbent bandwidth--but that's the reality of spectrum licensing.

Oracle guided program synthesis. The user creates counterfactuals to the program output and the system tries to change its process to correctly process them.

If true ASI ever materializes, JVM bytecode.

To be fair, zoos don't usually feature the boring species, like insects, worms, and other tiny invertebrates.

Maybe Qualcomm hoped Mozilla had enough money to pay up in a bogus settlement? BeaconsDB is, as far as I know, just one guy.

At least in the case of United, we did see shareholders write angry letters when they temporarily became slightly less aggressive denying customers coverage. If that's the level of care for matters of life and death, why wouldn't it generalize to surveillance?

Why not even a PGP signature from the team? At least the public keys can be pinned so the possible compromise can be detected. I think Arch does something like that.

Fastmail's previous stance on implementing PGP in their clients was that it would be impossible for them to guarantee they couldn't send the user malicious JavaScript over the wire. Now that you have a local app, would you consider implementing PGP? I expect this would be very straightforward using something like OpenPGP.js, or perhaps by integrating with a GPG agent to handle the heavy lifting.

You could also reimplement some QoL features like E2E search by building a local index of seen cleartext messages, or perform spam filtering via local NLP models—though in my experience, I never saw any encrypted spam. Threading UI might use a cleartext copy, or instead of Thunderbird's "Subject: ...", it could use a random UUID while preserving cleartext "RE: " patterns.

PGP is a very simple standard and could have become the default if not for some unfortunate client UX. If a major mail client automatically imported or generated a key on first install, required the user to write down a BIP-style mnemonic for private key recovery (PGP private key containers are quite large, so this might rely on symmetrically encrypting a provider-side backup), and attached the public key to every outgoing email—enabling end-to-end encryption automatically, with trust established on first use—I’d expect that a quarter of all human email traffic could have instantly become secure, eliminating decades of complexity built to sustain the illusion of trusted parties. A provider offerring this UX within an interoperable standard could be the only push it needs.

You might object to TOFU as suboptimal, but it has been the standard in many encrypted messaging systems: Signal, for instance, uses key servers to distribute keys and relies on users to verify shared secrets out-of-channel, as does WhatsApp. If this simple manual verification UX could be integrated with Web of Trust, it could automatically vouch for the user, showing a reference path for each of your contacts. Even without that, it is better to accept a one-time risk of key exchange compromise than to face the continuous possibility of eavesdropping.

If I said the Web Integrity API is incompatible with Free Software, would you read that as: a) Chromium would cease to be Free Software if it implemented it; or b) Web Integrity itself makes effective Free Software structurally impossible and exists to punish its users?

The latter is what I mean. Web Integrity or SafetyNet are a closer counterpart to this situation than your curl example. A user agent is just a hint; attestation is an effective enforcement mechanism.

No Free Software license on my client can obligate your server to cooperate. But if attestation becomes the norm across many different services, the entire framework of user choice Free Software stands on collapses.

How would Ungoogled Chromium survive if every second website rejected non-Google Chrome? We've already seen this play out with Android: more people daily-drive GrapheneOS than Lineage because it passes Google's lower-level integrity checks.

And when a "strongly advised" government app requires the strictest attestation level, will you have to move countries just to exercise that freedom of choice you supposedly have?

Freedom 1: The freedom to study how the program works, and change it to make it do what you wish.

The later half -- the freedom to change the program -- is meaningless in a world of attestation. Tivoization was explicitly forbidden on these grounds: if you can modify the software, but cannot use it in its modified state, the distributor is in violation of the spirit of free software and in particular, GPLv3.

It is a basic argument from positive liberty: the freedom for services to discriminate based on user's software and the freedom of the user to be discriminated against is no freedom at all.

I’ll go a step further: if EU sovereigns claim the right to “lawfully intercept” their citizens' private communications, why shouldn’t every state enjoy the same privilege? Russia, Saudi Arabia, Egypt, and Uganda will be exemplary custodians of such technology. You have nothing to fear, citizen: their democratic constitutions and impeccable legal codes will protect you.

I haven't heard of it and I couldn't find the story by these keywords. Can you tell me more? I'm genuinely interested.

Have you heard of Depression Quest? It's a very similar idea: a text adventure about managing depression.

It faced some controversy in its day. Do you think now is a better time for games like this?

The number of people in these threads defending involuntary bugging of every phone because you can devil-advocate it maybe might actually save the children is insane for a forum called Hacker News. Either the contrarian population has been getting out of hand, or we have truly lost our minds and stand to lose what remains of our civil liberties.

Google Messages shows "This chat is now end-to-end encrypted" between compatible devices today.

And how are you supposed to exist as any sexual, gender, religious, or political minority when Gestapo's listening in on every phone? And also, we were talking about private conversations, not Reddit, not any less private than what is spoken in your own home.

I am sympathetic to whatever made you believe that, but if you advocate for such evil, inhumane, reckless systems, you are not a good ally to anyone, including yourself or your community.

This is a satire site. That doesn't make what it's based on any less weird.

Pegasus [0] and the like — commercial spyware updated with the latest exploit chains, developed in-house or purchased from markets like Zerodium, sold as terrorism-prevention tools to such trustworthy states as Russia, UAE, and Hungary.

[0] https://en.wikipedia.org/wiki/Pegasus_(spyware)

The 50s~70s are idealized by many as an American golden age, despite higher reported crime. Law enforcement back then did not have AI-powered surveillance camera networks, widely deployed IMEI stingrays, private data-brokers, or the ability to remotely activate any phone's microphone with 0-click RCE.

Maybe they wanted to say “with [JUPITER, Europe],” as in “CERN, Switzerland.” This would still be unnecessary and confusing, but that’s the most sense I can make of it.

In Russian прах means ashes.

This can't help but remind me of the Whispering Earring [0]. "Better for you if you take me off."

[0] https://news.ycombinator.com/item?id=42756942

Forgive me for being reductive, but aren't these leaked accounts a lost cause? The vulnerability in question is attackers being able to log into user accounts with leaked credentials. The only mitigation for this is to lock out users identified in other password breeches and reconfirm identity out-of-band, like through a local bank branch, add a second factor like a hardware token, or use restrictive heuristics like IP geolocation consistency between visits.

If 3 attempts per hour is enough to gain access, then it doesn't seem attestation can save you. I imagine a physical phone farm will still be economically viable in such case.

Maybe a good compromise is to change the boot screen to have a label that the phone is running an unofficial ROM, just like it shows one for unlocked bootloaders? If the system can update that dynamically based on unlock state, why can't it do it based on public keys? Might also discourage vendors/ROM devs from using test keys like Fairphone once did.

How does device attestation reduce bruteforce? Does the backend not enforce the attempt limits per account? If so, that's would be considered a critical vulnerability. If not, then attestation doesn't serve that purpose.

As for compromised devices, assuming you mean an evil maid, Android already implements secure boot, forcing a complete data wipe when breaking the chain of trust. I think the number of scary warnings is already more than enough to deter a clueless "average user" and there are easier ways to fish the user.

I thought I was being clear. Access to education, which is a function of wealth, race segregation, and/or cultural expectations, or in other words, economic + social factors.

For example, if a family encourages their child to work from the earliest allowed age at the expense of schooling, that's a manifestation of both economic and social pressures.

Education? Or more directly, socio-economics.

The many of the subjects tested never had any experience with this kind of formal testing, had little to no education, and of course predictably failed on several abstract tasks. It might be that the very pattern of sitting down and intensely focusing on apparently meaningless problems isn't as innate as expected.

See previous discussion.

Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs [pdf] (martins1612.github.io)

179 points, 5 months ago, 100 comments

https://news.ycombinator.com/item?id=43176553