treszkai

Except a mouse doesn't give you absolute coordinates, it can only tell your current speed.

This would be an optical mouse that moves the cursor even if you lift it up and put down somewhere else.

Summary: QR code contained link to malicious Android app, which had access to all the data on the phone after the given privileges were granted.

Steps required for this to go through:

- open link in QR code that points to an APK download

- install the linked app

- open the just-installed app

- grant all privileges to the app

That said, it's easy for an attacker to put their own QR code in most restaurants (because the walls/menus/tables are not clearly controlled by staff), just like it's easy to swap the restaurant's card payment terminal for a custom one and cash the payments. (Both are illegal, don't do it.)

That works, but you need to keep the "Developer tools" frame open. Once it's closed, the blocking is gone. (Try it with an infinity feed.)

> And even more surprisingly it seems most apps support this, instead of putting all notifications under one channel.

Maybe because developers want to do the Right Thing, and they can implement these notification groups with no effort and without the marketing department noticing it?

> and all third-party scripts are always clunky

> I use [...] pass as overflow for more involved secrets

Why don't you consider pass a third-party script here in this context? Don't you use the Firefox plugin passFF?

> QUIC was developed through a collaborative and iterative standardization process at the IETF after almost five years, 26 face-to-face meetings, 1,749 issues, and many thousands of emails.

26 face-to-face meeting in 5 years is an extremely low number; I'm glad to see that the developers of the Internet embrace remote work :)

> We assumed that making it opt-in would allay privacy concerns but since this isn't the case, we are dropping it.

Especially after dropping Google & Yandex, I guess they could've stood up for their telemetry needs, and flat-out say that "if you have privacy concerns about our anonymous opt-in telemetry, you can just use the default settings."

You can drop the "3" from !python3, it has the same result.

Because killing people feels bad, but destroying objects feels like a prank (especially to those who don't understand the consequences). I don't think laws hold back punks from murder; customs do.

> immigrants fleeing authoritarianism are generally vocal against it

There's a huge selection bias here (the immigrants most visible are those who speak up), so I wouldn't be so certain about this. My prior is that people don't give a shit about what's happening elsewhere, and their life is certainly easier if they don't _publish_ their controversial views. (Even if that controversial view is shared knowledge among immigrants, it's usually not common knowledge.)

> Our team is very experienced in making gadgets. They are experts from Xiaomi/OPPO/Google/Ubuntu and other Consumer Electronic Companies.

Interestingly, JingOS's About page [1] uses similar words but different companies:

> Our team is very experienced. They are experts from Lenovo, Alibaba, Sumsung, Canonical/Ubuntu, Trolltech and other famous IT Companies.

[1]: https://www.jingos.com/about/

Absolutely. Until now I had no idea what a JPEG optimizer is, and even the About page of jpeg.rocks said exactly nothing about what it does.

Information without DRM can easily become a public good: it can be copied without limits and a loss in quality. Once it's out in the open, people will access it easier, but that also makes it near-impossible for the information-owner to make a living. At the beginning, Google was beneficial to both the information-seekers and the information-owners because it connected them (while showing ads in the search results). With the "featured snippet" it increased the user experience by a little (and multiply this with the user count), while depriving the original owner of information from its entire revenue. (Much like how Spotify made music cheaper for everyone, at the expense of artists.) The nice way to solve this would be if Google gave a cut to CelebrityNetWorth, as Spotify gives to artists. (While Google would bring CNW more requests this way, their price would also be depressed; Spotify doesn't pave the way to the riches. [1])

[1]: https://www.digitalmusicnews.com/2018/04/12/streaming-music-...

> Then try thinking about potential ways of how all these things could interact to break a system.

This is where your advice goes south, IMHO. The sysadmin can't think of every possible way his system can get compromised -- they are not paid for that, black-hat hackers are.

Instead of collecting settings from a hundred places that must be set correctly for production, and inventing ways the system can get compromised, the safe settings could be provided in one place: ideally in the default settings so they are impossible to miss, or in a list, such as Django's deployment checklist [1].

Not saying that Postgres doesn't provide such a list, although googling for "checklist site:postgresql.org" only resulted in a mailing list reply [2], with some points not trivial to follow. Please comment below if you know an official one.

[1]: https://docs.djangoproject.com/en/3.0/howto/deployment/check... [2]: https://www.postgresql.org/message-id/D960CB61B694CF459DCFB4...

How do you deal with the eventuality of Pinboard going down? (Which will almost certainly happen sooner or later.)

While the civilization doesn't depend on my data, I always like to have a backup, so paying for a service to store my web archive is barely more future-proof than saving links.

It’s like the Pale Blue Dot: one could mistake the one pixel of the Earth for some noise in the optics.