taway1237

For a single package. And npm hosts a few more than that.

They shrinked a package size by almost 40%. No way this isn't significant improvement. Hell, at their scale 4% improvement is big.

It's - technically - a problem with TLS, not HTTPS. TLS requires the server to pick a key way before user sends first encrypted bytes (like a HTTP host header). It's not a problem when every HTTPS server has another IP, but that internet is gone. So if there are two domains with different TLS certificated hosted on a single IP:port, the webserver has to guess which key to use (usually one is the default).

To fix this, SNI extension to TLS was introduced. Now TLS client will optionally send a plaintext domain name it tries to connect to, and the webserver picks a key for that domain. Which is nice but... now the client is leaking their domain name. Encrypted hello in TLS finally fixes this problem.

You typically print it and store it in a safe place (like your home cabinet). It's something like 256bit random number, no way to recall it, especially while being subjected to the $5 wrench method.

The last one. But I think I overreacted a bit. Your thoughtful response made me realise that - thanks.

It just surprised me how disconnected the crime 20 years ago was to the current situation. But maybe it really is the best solution.

I'm really happy the girl was rescued! This story could end in a horrible way.

But no, I'm not in favor of the technology that allowed that. I think there are a lot of tradeoffs to giving the state powerful tracking capabilities, and the same power can be used for evil instead.

As another example: I work in cybersecurity for a governmental institution. A LOT of crimes could be solved if my organisation could MITM any citizen and get access to their plaintext traffic, probably also crimes involving 9 year old girls (given the sheer scale of cybercrime on national level). But I really don't want to have that power.

I'm not scaremongering (that assumes intent), just concerned.

At this point why not just at least be upfront with it and collect everyone's fingerprint when they turn 18? It would make more sense IMO.

Is it weird that my first thought was about ransomware's ransom note and I wondered what kind of fingerprint was used (gpg key? ssh?). I had to open the article to realise how wrong I was.

>Police were able to identify him, as the print was on their database linked to a drink-driving incident from 1999.

Ok, this is scary. So fingerprints collected 24 years ago for completely unrelated (and dubious - why collect fingerprints for drunk driving) reasons basically live forever in the gov databases. I'm not sure I welcome this brave new world.

I... think I agree. Thanks for your calm and reasonable response.

>If you don't mind supporting an aggressor and an invader as long as they are not invading or attacking you (...)

I do mind, but sadly I (my country) has to support someone and the US is (IMO) the "least bad" option. More about that later.

I'm not ashamed to say that I care about the war in Russia more than other wars for mostly selfish reasons [1]:

* It's much easier for me to connect and empathise with people from another European country then with people from a distant culture (irrational reason)

* It impacts me and my country much more directly (rational reason)

* Countries need allies. Unfortunately it's necessary to side with at least one superpower. And it's politically wise to overlook friendly superpower crimes while loudly criticising enemy's. To clarify: in my opinion US is the "least evil" option, and the Russian state is the most harmful - but I'm obviously biased here as an European.

>It just goes to show that Europeans/westerners don't care about Iraqis, and they care about Ukrainians

100%. Funny you mention that, I wanted to bring it up as an example for my previous paragraph and then noticed the second part of your message. I understand the frustration of all the victims of recent wars and aggressions who suffered the same and the world largely stood back (at best, loudly condemned the attack and the news cycle moved on). No point in gaslighting them that their suffering was less important or less significant then Ukrainians.

[1] Of course I won't say this publicly. It's easy to misunderstand or intentionally misrepresent my message as a support for Russian invasion or worse. No point in harming my future career by saying one word too much.

The same reasons don't hold for me, because my country is friendly with USA and (currently) openly hostile to Russia. The same holds for most of the western world, so likely most of the HN readers. Nothing irrational in avoiding software controlled by your (country's) enemy.

There is also the emotional aspect that you dismiss. Using somebody's products, and especially paying for them, can be constructed as helping the company and thus indirectly helping the company's country. Not everyone wants to support the country they see as an aggressor. That's not contradictory too - many people in western countries are OK with helping the US, but very uneasy with helping Russia (reasons for this are a different topic).

>fair: impartial and just, without favouritism or discrimination.

We should be fair to everyone. But there's no contradiction - you can be fair to someone, and still judge them very harshly.

Disclaimer: I'm not a native speaker, feel free to correct me if I'm misinterpreting something.

Anecdotal example - I was talking with a (usually very reasonable) friend, and she was convinced Google (via Android) listens to her all the time (with a microphone) and suggests products based on her real life conversations with her friends[1]. What creeped me out was that it was not presented as a conspiracy theory but something completely mundane, almost a remark ("you know how they spy on everyone - like yesterday I was talking about Greece with some friends and today I get plane ticket ads - you know, the usual"). Not even a bit outraged. Crazy for me, but clearly people don't feel about this issue as strongly as we do.

Later her friends agreed that it happens for them too and didn't believe me when I suggested other possibilities.

[1] In reality, most likely ad targeting based on her online habits works as intended.

I have read and helped implement GDPR in my country. It's the greatest thing that happened to online privacy, finally a law that has teeth and can influence big tech. It empowers me as a citizen and makes me feel my data has value again.

I have high hopes digital markets act will be as good.

Because it's so obvious. I didnt't think about dialing 112 when buying my phone, but if I knew my phone can't call it I'd carry a small, second "emergency" phone that can at all times. Or buy another phone.

I own Pixel 4a for a few years now (I bought it when it was quite new, now it's EOL). I never had any software or hardware problems, and it's my favourite phone I ever had.

(we can keep the anectodal evidence going, but not sure what's the value in that. People clearly have different experiences, and the selection of people reading comments about a Pixel issue is likely far from random).

I only ever listen to audio on my phone through my headphones (no exaggregation, 100% of time during last 5 years). I guess in case of an emergency I won't have time to connect them before the call. I also don't use facetime. So for me the GP remark is certainly true.

This discussion is moot btw. Google already has faraday cage and bts equipment, at least in the London office (6ps) where a large part of the Android team is located. And obviously so - the costs involved are a rounding error for Google. The problem must be somewhere else.

>If you'd spend any time at all looking at midjourney creations, there's no way you can conclude that there's any significant amount of "ripping off" people's work. Certainly not in all or most cases.

They were trained on work of people who didn't consent to it, the authors were not compensated, and currently are losing money (demand for their work) because of it. How is that not ripping off.

Please don't compare software to people. They're not similar legally, morally or in any other meaningful way.

Not sure where you live, but I'm pretty sure it's legal. And for a good reason - nobody is harmed by creating and consuming them (this is not true for pictures, for example). In fact, I believe "Lolita" can be found in libraries and is quite suggestive (don't know, I've never read it).

I find it awkward to defend the thing I do in this post, but I'm allergic to the "think of the children" argument. Way to shut off logical reasoning.

Edit: I see that later you give better examples of regulation (not information regulation though). Just editing to let you know that they were much more convincing to me.

The FSF is ideologically opposed to youtube and other proprietary services. They don't want to use it and will not use it. It's their work and they have no obligation to you - it's like going to a vegan party, complaining they have no food you like and demanding they order some hamburgers for you. There's nothing to think more, the FSF shouldn't use YouTube or similar services.

In my job I have both the option to work 60h/week and 20h/week and nobody cares too much as long as I deliver something once in a while. Having to limit myself when I'm full of ideas or force myself when I'm out of energy sounds terrible.

I was sceptical WASM is ever going to be mainstream, but after reading your post I'm convinced it's the future. This sound like advertiser dream, and adds already rule the internet, so the conclusion is obvious

Sounds exactly like zswap. Are there differences that make it better?

>much more advanced models and even agi coming in the next year or 2

Are you certain this is going go happen? Especially in such a short timeframe.

That feels a bit negative and hostile. They can do both. Price of hosting this event is, hopefully, negligible compared to money that goes into Firefox development.

We all here would prefer technical goals, but raising awareness and social projects are, for better or worse, other major Mozilla goals.

>It is moral and ethical to block all ads and scripts from adtech companies.

Depends on your moral code, I think? Who made you a moral authority? You don't get a say in what I consider moral.

I'm sorry for the aggressive tone of my post, but people telling me what I should think are a pet peeve of mine.

Vs code functions as a remote access trojan (RAT) in this scenario. But while your AV will hopefully detect and flag most common RATs, it won't flag vs code. This method is often used in real world attacks (especially targetted ones).

I'm not saying that's a huge concern, but something one has to consider when protecting their organisation.

The point of the blog post is that this method is useful for attackers (as a so-called lolbin - trusted binary used in a malicious way).

Nothing prevents you from doing that, but your martian packets have zero chance of reaching my router.

I know IPv6, just don't feel the need to use it. I prefer to have one firewall and public network interface to worry about. I can't disable IPv4 yet, so the logical solution is to disable IPv6.

In my current company (related to academic institution that introduced internet to my country) every office workstation has FOUR public (but firewalled of course) IPv4 addresses. And every user has an unique VPN IPv4 address on top of that.