Flimm

In practise, Flatpak packages have many more permissions than you might expect, and the sandbox feature gives a false sense of security. For example, the Obsidian Flatpak package [0] is given all of the following abilities without explicit permission from the user (the user has to know where to look to find out about them):

- Home folder read/write access

- System folder media

- System folder mnt

- Microphone access and audio playback

- And more...

The Obsidian snap [1] is installed with the --classic flag, which also grants access to the whole home directory, but at least you have to consciously specify the --classic flag to grant this permission.

[0] https://flathub.org/en/apps/md.obsidian.Obsidian

[1] https://snapcraft.io/obsidian

I disagree that this kind of scheme is inevitable. We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation. Certainly, Google can choose to avoid it. On the other hand, the AI bubble will inevitably burst, since compute is not free. I look forward to post-bubble AI.

On GNOME we already have a global shortcut for some emoji picker, I think it's Super + , or something

Actually, on most distros, the default keyboard shortcut for the emoji picker on GNOME/GTK is ctrl-. (same as the Firefox shortcut). This only works on apps that support it. Older Firefox versions did not support GNOME's emoji picker at all, but Firefox 150 supports GNOME's emoji picker using the expected keyboard shortcut.

The GPL would not have prevented the scenario that the top-level comment complained about. Nothing in the GPL requires rich downstream projects to send money to poor upstream projects. That's by design. The four freedoms that Stallman preaches intentionally permit distributing the software to free riders.

Secrets tend to be randomly-generated tokens, chosen by the server, whereas passwords tend to be chosen by humans, easier to guess, and reused across different services and vendors.

To clear up any confusion, Git runs pre-commit hooks, and they can be written in any programming language. There's a completely separate and independent project that gave itself the confusing "pre-commit" name, and it is written in Python. This project aims to make it easier to configure pre-commit hooks. An alternative to it is "prek", written in Rust.

Uppercase "B" stands for byte, and lowercase "b" stands for bit. But it's very common for people to miss the distinction, sadly, even professionals are sloppy.

"why did you close my question as a duplicate of how to do X with a list? I clearly asked how to do it with a tuple!" (for values of X where you do it the same way.)

This is a great example of a question that should not be closed as a duplicate. Lists are not tuples in Python, regardless of how similar potential answers may be.

It's less meaningful than you think. Widespread prejudice does give you signal on public sentiment, but it doesn't give you much signal on whether the prejudice happens to coincide with reality or not, compared to other methods. People should be open to having their prejudices corrected by more relevant information.

Google doesn't allow you to recover a Google account using only your recovery email address. Despite its name, the recovery email address is not used to recover Google accounts AFAICT, it's only used to receive notifications about security-related events.

The eBooks in Kobo's store are also locked down with DRM.

Can anyone find even one DRM-free ebook on Amazon Kindle?

Amazon made $56 billion just in advertising revenue in 2024.

I strongly disagree. Python 2 had no bytes type to get rid of. It had a string type that could not handle code points above U+00FF at all, and could not handle code points above U+007F very well. In addition, Python 2 had a Unicode type, and the types would get automatically converted to each other and/or encoded/decoded, often incorrectly, and sometimes throwing runtime exceptions.

Python 3 introduced the bytes type that you like so much. It sounds like you would enjoy a Python 4 with only a bytes type and no string type, and presumably with a strong convention to only use UTF-8 or with required encoding arguments everywhere.

In both Python 2 and Python 3, you still have to learn how to handle grapheme clusters carefully.

If you're talking about free-as-in-freedom software, promoted by Richard Stallman and the FSF, then they have always been clear that Free software must not forbid commercial usage or require payment. Vendors are perfectly free to sell copies of Free software if they wish, but the license cannot forbid making copies and derivatives, even for commercial usage. See:

https://www.gnu.org/philosophy/free-sw.en.html#selling

Does the library handle arguments that begin with a dash?

Does this code print out the contents of the file named `--help`, or does it print the documentation for the `cat` command?

  filename = "--help"
  await sh(t"cat {filename}")

If you have uv installed, trying out Python 3.14 is as simple as running this command:

  $ uvx python@3.14
  Python 3.14.0 (main, Oct  7 2025, 15:35:21) [Clang 20.1.4 ] on linux
  Type "help", "copyright", "credits" or "license" for more information.
  >>> 

Even personalised advertising can be done without sharing personal data with 100+ third parties. For example, ask the user to fill out a survey about their interests, and then serve them more personalised ads based on their survey answers, all without sharing personal data with third parties.

There are many ways to monetize free online websites. The most obvious way is advertising. Advertising can be privacy-respecting.

The Guardian in particular is funded by a trust fund, by donations, by advertising, and maybe by other sources of revenue as well.

This article is on theguardian.com , and it has started to require a paid subscription for all readers who don't want to share their data with 131 third parties. There is no privacy-respecting free option. The paid subscription is £5 per month, and it doesn't eliminate all ads. (This requirement may depend on which country you're in.)

The Winnie the Pooh books by A. A. Milne are no longer under copyright, that copyright expired. However, the Disney animations of Winnie the Pooh are still under copyright, and they have a distinctive style compared to the illustrations in the books. It's mainly about copyright, not trademarks.

Thank you for the explanation. And thank you for your important work making the ecosystem more secure, for the benefit of 5.5 billion Internet users.

How is the age of a package calculated? If the publishing date of a package is obtained from the package's metadata defined by the package author, (just like Git commit dates are defined by the Git committer), then that would defeat the purpose of this new feature. The whole purpose of this feature is to protect from malicious or compromised package authors. Instead, it is necessary to query the package registry, trusting the package registry for the age of the package, rather than the package author. I presume this is how it works.

I can understand it. Ordinary users were getting locked out of their accounts when losing their phones. Some of those stories hit HN.

Don't disable cloud sync unless you have a backup of all your TPTP secret keys. It's dangerous to advise people to disable cloud sync without mentioning backups. Being locked out of thousands of dollars in your crypto account is as damaging as losing that crypto to hackers.

I agree. I wonder if there is a good compromise between convenience and security, though. For example, before allowing Google Authenticator to sync for the first time on a new device, maybe notify the user on all devices and enforce a 72-hour delay, or wait until the user approves the new device using an old device (in a way that is hard for a scammer to pass off as legitimate).

I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.

Gaza Sky Geeks [0] is/was a startup accelerator or tech hub in Gaza, with backing from people from Mercy Corps, Google and Microsoft. Needless to say, their activities have been severely interrupted by the violence since October 7th, 2023. I'm subscribed to their email newsletter, and the updates are heart-breaking.

If anyone from Gaza Sky Geeks is reading this, please consider sharing those updates on your blog as well as on your email newsletter, so that they can be shared more widely.

[0] https://gazaskygeeks.com/

I use https://song.link (or Odesli). It finds the link to the song on Spotify, Apple Music, YouTube, YouTube Music, Pandora, Deezer, SoundCloud, Tidal, Amazon Music, AudioMack, Anghami, Napster, Yandex and BoomPlay, maybe more.

If I buy something, not only should I be allowed to keep it until I die, but I should also be allowed to pass it on to someone else after I die. I should also be allowed to give it or to sell it even before I die. That's currently impossible with many of these so-called digital purchases.

What about server-generated passwords, like API keys? That would solve the main problem with passwords, namely, that people reuse the same weak password everywhere. I doubt it would be as popular as user-selected passwords, but I still wonder why no website has tried it.