HNHacker News
TopNewBestAskShowJobs

szmarczak

182 karma · joined January 15, 2026

submissionscomments
szmarczak··on Where things stand with the Department of War
Politics has nothing to do with this. Simply put, spying on citizens or letting machines autonomously kill people is immoral, bad, and a crime against humanity.
szmarczak··on Apple Studio Display and Studio Display XDR
> Quoting one of your videos: "After 21 months, seeing these artifacts is certainly annoying". If I spend $3k on a monitor, it should _not_ be annoying after 2 years.

Why are you insisting to spend 3k? I've already said that 1k is enough. Also he said "but generally speaking it hasn't been a noticeable problem in most tasks". In the same productivity scenario, with a gray background, IPS backlight bleeding would've been even worse (unless you win the lottery and there's little to no bleeding). RTings showed this on many monitors (unfortunately they paywalled everything due to AI [1]).

[1] https://www.youtube.com/watch?v=6DshOOs39vA

> It is an unavoidable part of how OLED works.

True.

> OLED is not the way to get there.

I'm not a screen scientist so I'll refrain from making a statement like this. I don't have anything to add. I guess we'll see how it pans out in the future.

Edit: I bought my FO32U2P mostly to reduce eye strain. 4k 240hz with nice colors is also a very neat upgrade.

szmarczak··on Apple Studio Display and Studio Display XDR
Also my gf used to use Samsung A40 which is also from 2019 and there's no burn in. The only issue I see is slow response times, however she upgraded in 2022 and again a few months ago.
szmarczak··on Apple Studio Display and Studio Display XDR
> I _have_ watched those videos and they show burn-in after an alarmingly short amount of use.

Debatable, it's not what those content creators say, and I definitely wouldn't call it alarming if it requires you to stare at gray background in a dark room. It isn't even half as bad as IPS backlight bleeding or VA angles. Different people have different standards. You don't have to buy it if you don't like it.

> Adding one more reference, here is a recent post to /r/monitors showing burn-in after 2 years of constant use

Pixel clean cannot run if the monitor is constantly receiving signal.

Also show me an IPS after 2 years of constant use. The backlight can degrade as well.

[edit] Furthermore, 3 year warranty covers your burn in, so I guess they would happily replace your monitor once the burn in normally visible. [/edit]

> Get back to us about your burn-in after 8.6 more years.

Feel free to ping my email (@gmail.com) at that time.

> I've experienced burn-in on my pixel 3a after 2 years

2019. My Nothing Phone 2 is from 2023. I've been having it for 1y 8mo+ and experienced zero burn in on the same gray test. For reference, I don't use automatic brightness and it's almost full-brightness all-day (except evenings).

szmarczak··on RFC 9849. TLS Encrypted Client Hello
It depends on the origin and the destination. Their Magic Transit service explicitly allow this, and I assume they have agreements with other AS in case something goes wrong on either side (it often does). You'd have to directly ask them to know specifically but I don't think they would answer since that's proprietary information.
szmarczak··on RFC 9849. TLS Encrypted Client Hello
How does this relate to my comment?
szmarczak··on RFC 9849. TLS Encrypted Client Hello
They do routing. Even if you're connecting to a non Cloudflare server, the traffic may still be routed through their servers.

Why would they want to peek traffic? Most likely for statistics (most frequently visited websites etc).

szmarczak··on RFC 9849. TLS Encrypted Client Hello
> the part that changes is passive fingerprinting from third parties

That's exactly what I said:

> It only prevents your ISP from knowing what website you're connecting to.

szmarczak··on TikTok will not introduce end-to-end encryption, saying it makes users less safe
I know the difference. It doesn't make E2E useless.
szmarczak··on RFC 9849. TLS Encrypted Client Hello
What you're describing is a SNI, not ECH. Those two serve very different purposes.

> Also reverse lookup has nothing to do with hosting own DNS resolver.

It has everything to do with that. Had you used two brain cells, you would've known that they can memorize the IP address and the domain name, and if you connect to that IP in a short period of time, most likely you visited that domain name.

szmarczak··on RFC 9849. TLS Encrypted Client Hello
True. ECH is useless if you're using plain DNS. DNS over TLS or HTTPS is the way to go.
szmarczak··on RFC 9849. TLS Encrypted Client Hello
By decrypting it? I don't think you know how TLS, or E2E works in general. ISP doesn't perform the fingerprinting, the server does.
szmarczak··on RFC 9849. TLS Encrypted Client Hello
I am talking about TLS fingerprinting, not JS fingerprinting.

> Please elaborate how else TLS fingerprinting can be done.

By doing everything as it is right now?

szmarczak··on RFC 9849. TLS Encrypted Client Hello
I don't think your interpretation is right. If it were,

> Clients that incorporate DNS names and IP addresses into the same syntax

They wouldn't mention the IP addresses at all. Also, notice the word "and".

szmarczak··on RFC 9849. TLS Encrypted Client Hello
It doesn't prevent fingerprinting, stop spreading misinformation. It only prevents your ISP from knowing what website you're connecting to.
szmarczak··on Apple Studio Display and Studio Display XDR
I've been having it for 1y 4mo.

> You’re babying it with low brightness

That's the same brightness I was using on my IPS. And if you watched the videos then you'd know that those people use OLEDs at "almost max brightness" and see no burn in.

> dynamic dimming

Such features are unnoticeable during normal use and most of them are defaults.

> the fact that there’s anything, even if you have to “look for it”

Again, this is only noticeable if your room is completely black and you're staring at gray content.

To counter your argument, you have a much worse backlight bleeding on IPS, which is very but very visible during normal use. To quote you: "the fact that there's anything, is not a good sign".

It's weird how you call OLEDs bad but completely forget about IPS downsides, and I'm not gonna even start on VA.

At the current state, OLED wins.

szmarczak··on TikTok will not introduce end-to-end encryption, saying it makes users less safe
> if the server operator was malicious, they could just push different client-side JavaScript

Same as with OS updates, browser updates, dependencies used by the OS, dependencies used by the browser. Also you can run malicious software such as keyloggers and you're compromised.

That argument doesn't mean E2E (even web based) is snake oil. Browsers just give you more points of failure.

szmarczak··on Apple Studio Display and Studio Display XDR
True, but those numbers are from 2016, 10 years ago. For a more apples to apples comparison see [1] [2] [3].

[1] https://youtu.be/H43wnV-v7V0

[2] https://youtu.be/RbEgQrigiLc

[3] https://youtu.be/AZfwHcMLorY

In my case, 3205 hours of use:

- 428 pixel cleans

- 1/3 brightness (my room is pretty dim and I often code during the night)

- static control on

- pixel shift on

- apl low

- sub-logo dim on

- corner dim on.

During the day I am not able to see any burn in. During the night it's unnoticeable unless you're looking for it. And it's only visible on gray backgrounds, unnoticeable during normal use. My phone (Nothing Phone 2) fails to capture it no matter how hard I try (even during the night).

The only issue I had was at 2417 hours and it was vertical white stripes like this: [4] but they were completely gone after a manual pixel clean. No issues since. I am never going back, worth every penny I spent.

[4] https://www.reddit.com/r/gigabyte/comments/1gyv1db/fo32u2_ve...

szmarczak··on The unfortunate need for an "age verification" API for legal compliance
I just realized. Does this mean that developing an OS without age checks is illegal in those states?
szmarczak··on Apple Studio Display and Studio Display XDR
> In 2016, LG Electronics reported an expected lifetime of 100,000 hours

23 years for an older generation OLED seems fine to me, I don't understand the problem here?

szmarczak··on Apple Studio Display and Studio Display XDR
Current gen OLEDs almost don't wear out (saying this as an OLED owner). To see the wear you need to have a completely black room and the wear is unnoticeable unless you're specifically looking for it. You don't need to spend 3k, 1k is enough.
szmarczak··on The unfortunate need for an "age verification" API for legal compliance
This is the way. California wants stupid (even immoral) laws? Companies cannot use those OS? Oh noes, what a shame.

Also, why the age brackets? It should be a simple boolean whether the user is an adult or not. Age brackets enable targeting.

Also the idea itself is just useless because kids will just learn to patch binaries.

szmarczak··on We Built a Video Rendering Engine by Lying to the Browser About What Time It Is
This is the correct solution. However you'd need someone that knows C++ well, knows Chrome internals, is familiar with video stuff, audio stuff, knows Chromium rendering pipeline, possibly some GPU APIs as well. That person would cost huge amounts of money due to the required knowledge and complexity.

And then you'd need to maintain the code so it works with future Chrome versions.

szmarczak··on Donut Labs Drops High Temperature Performance Report [pdf]
From the previous test, the data seems to match NMC which does contain Lithium: https://youtu.be/3PwEA-tBufI?si=5r2AmBmFctMuYfSC&t=233
szmarczak··on How to talk to anyone and why you should
The irony of this being behind a paywall. People want to milk money on everything.
szmarczak··on /e/OS is a complete, fully “deGoogled” mobile ecosystem
I have no idea where you got this information - the HN post is about partnership. It does not work on Motorola devices, at least not yet [1].

[1] https://grapheneos.org/releases

szmarczak··on FCaptcha – A modern CAPTCHA system designed to detect everything
Note: I have been professionally working on web scraping.

> SHA-256 > 500ms CPU time

I wonder if the author has calculated the total wasted CPU power for 1M users and the added latency.

> Mouse trajectory

Can be recorded, and there are users that prefer the keyboard and use remote connections. Also, the trajectory can be calculated (did that myself) and is not easily verifiable due to each mouse having different starting accuracy and then catching up.

> Micro-tremor detection

Not detectable on low DPI mouse. Also there are people who are using 125Hz Bluetooth mouse.

> Click precision

What if there is no click? There are keyboard users and you'd be making them angry if blocking them solely on the no-click basis.

> Pre-click

Can be recorded and can be calculated.

> Overshoot

Overshoot only applies to small sized elements. What I noticed, I don't care about overshoot when clicking the Claudflare captcha because the checkbox is big enough for me to hit every single time (from a distance of half-page).

> Web driver

Can be spoofed or using a build of Chromium that does not set webdriver to true.

> Canvas / WebGL / Audio fingerprint > Plugin and browser feature checks

It's testing if it's a real browser, not an automated one.

> Proof of Work timing

What does this solve?

> Interaction timing patterns > Event sequence analysis

Theoretically it's smart, practically it's bad due to the randomness.

> Programmatic form.submit() detection

Events can be made trusted by setting userGesture to true in CDP or running a browser that sets it to true regardless.

> Page load to interaction timing

What does this solve? It's very random.

> Time from page load to submission

Very unreliable due to the randomness.

> Textarea keyboard analysis

Can be recorded.

> Headless browser indicators

I wonder what that is. I hope it's not checking console/storage size.

szmarczak··on Addressing Antigravity Bans and Reinstating Access
Headless is fine as long as there's a human in the loop. Remove the human, their bills skyrocket.
szmarczak··on Addressing Antigravity Bans and Reinstating Access
They just want people to pay more via API. Technically, your example would violate ToS, because the purpose matters. Like a license file may allow personal use and prohibit commercial use (unless you obtain a commercial license).
szmarczak··on Statement on the comments from Secretary of War Pete Hegseth
ASML is European too! Then they could make a deal with them. wink wink
← PreviousPage 4 of 5Next →