twhb

Apply the same logical test to freedom of speech, and you’ll get the same result.

You’re not missing anything about what’s likely to happen to you personally. What you’re missing is the manner in which rights shape your life and your society even when you don’t exercise them, and sometimes even when nobody is currently exercising them, and that significant harm can be built out of a vast number of smaller harms that aren’t individually that bad.

This article is misinformed if not intentionally misleading about Apple Pay’s privacy status. It is technically true that Apple does not share your credit card number, but it does share its own unique, persistent identifier.

This is an iOS 26 regression. There are a bunch of soft hyphens in there, which is why it works on other browsers and in previous versions of iOS.

Sorry, fixed link: https://demo.fingerprint.com/playground.

I agree on randomization, but there are other places where it doesn’t stick out like that. I’ll look up specifics if I find the time, but I think reading canvas data without permission is one place it’s utilized, including by Tor.

This tool is deeply flawed. Fingerprinting protection is sometimes done by binning, which this tool rewards, and is sometimes done by randomizing, which this tool harshly punishes. The net result is it generally guides you away from the strongest protection.

The flip side of this, having the complementary flaw of testing only persistence, not uniqueness, is (warning, real tracking link) fingerprinting.com/demo. You can try resetting your ID and seeing if it changes here. Since tracking requires (a degree of) uniqueness AND (a degree of) persistence, the danger signal is only failing both the EFF test and this test.

Failing both is a requirement to derive meaning, not being lax: measuring only uniqueness would fail a random number generator, and measuring only persistence would fail the number 4.

Great post!

Also check out oklch.com, I found it useful for building an intuition. Some stumbling blocks are that hues aren’t the same as HSL hues, and max chroma is different depending on hue and lightness. This isn’t a bug, but a reflection of human eyes and computer screens; the alternative, as in HSL, is a consistent max but inconsistent meaning.

Another very cool thing about CSS’s OKLCH is it’s a formula, so you can write things like oklch(from var(--accent) calc(l + .1) c h). Do note, though, that you’ll need either some color theory or fiddling to figure out your formulas, my programmer’s intuition told me lies like “a shadow is just a lightness change, not a hue change”.

Also, OKLCH gradients aren’t objectively best, they’re consistently colorful. When used with similar hues, not like the article’s example, they can look very nice, but it’s not realistic; if your goal is how light mixes, then you actually want XYZ. More: https://developer.mozilla.org/en-US/docs/Web/CSS/color_value....

Also, fun fact: the “ok” is actually just the word “ok”. The implication being that LCH was not OK, it had some bugs.

spacer gifs

Hacker News actually still uses these for comment indentation, check this page’s source code.

restic’s rest-server append-only mode unfortunately doesn’t prevent data deletion under normal usage. More here: https://restic.readthedocs.io/en/stable/060_forget.html#secu.... Their workaround is pretty weak, in my opinion: a compromised client can still delete all your historic backups, and you’re on a tight timeline to notice and fix it before they can delete the rest of your backups, too.

This page seems designed to direct attention anywhere but the meat of the issue: are the moon details in Samsung photos derived from sensor data alone, or also external photos? To me, the answer is clear: Samsung can’t produce this result unless they also ingest external, high res moon photos. Yet Samsung frames it as “enhancing details”, not “adding details”, clearly implying the details in question were already there in some form.

Right, disappearing messages aren’t a safeguard against a malicious recipient, they’re a blast radius limiter on future device compromise on either end.

The abandoned plan was perceptual hashing, which should return the same hash for very similar photos, while the new one is a checksum, which should return the same hash only for identical photos. I don’t think that invalidates the point, but it does seem relevant. It certainly makes it much less useful for CSAM scanning or enforcing local dictator whims, since it’s now trivial to defeat if you actually try to.

I felt this way for a while, but I’d like to offer another angle: maybe it’s like saying “Every company eventually hires tall people. Some have no tall people, but it’s just a matter of time. Tall people are really an unstoppable force.” The missing piece is also observing short people (ad-free offerings), which you’d notice are not being eliminated, are also prevalent, and also “infect” everything. I think the unstoppable force being felt here is just statistics: ads are often an option, companies make a lot of decisions, it’s statistically inevitable that some of those will be ads, unless the company has some strong aversion to ads, which most don’t.

The never-ending chain has bothered me too. I realized that if there is a theory of everything, it needs to prove itself. As far as I know, that’s a logical contradiction. Maybe resolving that contradiction is the door to moving forward. Is the concept of a “theory of everything” invalid? Is modern logic insufficient to find it?

Don’t mistake this for victory. Google’s standard playbook when forcing things people don’t like is to spread the action out over a longer timeframe, exhausting the media and keeping the final blow mostly out of the news, and exhausting our individual outrage and will to keep fighting. It works every time, and it’ll work again if we become complacent again. Until and unless Google meaningfully commits to never neuter ad blockers, it’s still critical and urgent that we switch to Firefox.

I listened to a lot of mic testing a few months ago, frustrated by the AirPods Pro Gen 1 too. My conclusion was that all wireless earphone mics are pretty bad, and you’re not going to sound good unless you hold the phone up to your cheek or use a headset. But if you just want the best you can get in wireless earphones, I think the Jabra Elite 7 Pro and Sennhesier Momentum 3 are both a step up from the AirPods Pro Gen 1. They sound cheaper and let in more background noise, but they don’t have that underwater sound, parts of your voice disappearing, or sporadic background noise amplification, making them more intelligible and less stressful on a call.

HN is overly dismissive of tech in Android devices. People should look up testing of Samsung’s current gen 108 MP sensor. It’s true that it doesn’t look sharper when displaying the whole image on a smartphone’s 3.5 MP screen or a 4K (8.3 MP) monitor, and that it’s not really 9 times sharper than a quality 12 MP, but those points miss the meaningful one: it actually is way sharper than the current gen iPhone, and it is very visible as soon as you blow up the image, zoom in, or significantly crop it.

After thinking about this for a minute, I think the point wasn’t that people shouldn’t have fallen for this in particular, but to give everything a tint of uncertainty. It’s a pretty clear cut example of “no matter how believable it was, it can still be not even a little bit true”. In many contexts I’d call that a rather unproductive observation, but in the context of fake news, we have many people perceiving different realities built on a whole network of strong beliefs about what exists and what happened. Uncertainty about everything is probably actually exactly what’s needed to break free of a grip like that.

My problem with this is that it conflicts with identity ownership. If I give every company someunqiueaddress@someservice.com, I no longer have the ability to switch email providers, especially if I only decide to switch after losing my someservice.com account. If I give every company someuniqueaddress@mydomain.org, then I’m still ID’d by mydomain.org. Maybe in a way that automatic linkers miss, for now, but maybe not: how hard is it, really, to automatically determine with decent confidence that mydomain.org is a personal domain, and strip the entire username and subdomain part in the existing normalization step?

It can be some secret mydomain.org, but that still links all my profiles together.

I could buy a different domain for every company, but that’s cost prohibitive, and also piercing WHOIS privacy is just another data sharing agreement away.

Posting this because I’m hoping somebody has a better answer.

I got a memorable phone number a while ago. Websites like numberbarn.com make it relatively easy. A key realization I had is that repeating numbers aren’t the thing to look for, because they’re what everybody is depleting and marking up, and actually aren’t a very good proxy for what you really care about, which is memorability and maybe aesthetics. For example, 34567 is better than 37771, and also more likely to be available and cheap. Repeating digits and their associated markup are also about typability, but that probably barely matters to you if people are almost always calling from their address book.

The article does say it’s “experimentally extremely well confirmed”.

Who achieves more power, the guy who dedicates his life and soul to it, or the guy who wants it, but only if it’s ok with everybody, and only when his family doesn’t need him?

Did you suggest they change their device settings? Yours was probably the right approach, I’m just curious whether we have actual data to support that people prefer this split configuration, and aren’t just suffering under bad defaults.

I like this change. If a website misconfigures encoding and users have an encoding override menu, the result is 99% of users see a broken website, 1% know how to fix it. The menu doesn’t meaningfully improve the situation, but it does keep the people who could improve it from caring. Take that away and I predict 10%+ of currently misconfigured websites will get fixed for 100% of visitors, and that’s a big improvement over 100% of websites being fixed for 1% of visitors.

Interesting how somebody can be tripped up by 1.2 vs 1.18 yet not tripped up by 1/2 vs 1/18. It could just take time, but I think there’s also a factor of feeling that dates are worth learning while version numbers don’t deserve direct attention and instead should be a subset of a nearby concept that does.

Your comments and the email both are written like nobody really wants tracking off, at least not if they know what’s good for them. Is that what you believe?

How did the erosion affect the entire planet so thoroughly? Is it plausible we’ll someday find a place where the geological record of the missing years is still intact?

An important gotcha is buried at the end:

The CAMELS collaboration cooks up its universes using two different recipes. A neural network trained on one of the recipes makes bad density guesses when given galaxies that were baked according to the other. The cross-prediction failure indicates that the neural network is finding solutions unique to the rules of each recipe. It certainly wouldn’t know what to do with the Milky Way, a galaxy shaped by the real laws of physics.

Self host, use services for syndication only. Make that Medium and Facebook post, but just make it a link to your website, maybe with a preview. You get self hosting without needing to bring your own audience, you get Medium etc’s promotion without needing to surrender your content.

I should disclaim that I haven’t personally proven this out, but it’s advice I’ve often seen and what I plan on doing myself.

This was inevitable. If you’re leaking the info that you’re using a proxy, it’ll eventually be used by people who want to.

One solution is a traditional webmail provider being willing to reuse that primary user domain for forwarding addresses. There are two that I know of doing this, Fastmail with @fastmail.com and Apple with @icloud.com. These domains probably won’t ever be blacklisted, because you’d also blacklist a ton of primary email addresses. (Aliases, which most providers have, tend to be too inconvenient and quantity limited.)

Another solution is to use different addresses at your own domain, which trades anonymity against the company you sign up with for freedom to change providers.

I think all three of these, including announced proxies like MPR, can be the best solution depending on whether you just want to be able to cut contact or you want privacy, and from whom.

Article says she only lost it for nine months, and has to retake the test if she wants it back.