Confiks

You need `ss -Ml` if your server isn't actively serving MPTCP clients.

I was vulnerable myself by using Caddy (although MPTCP is not a prerequisite).

Interestingly when I asked about that string the first time on Opus 5.5 it actually repeatedly refused to do anything. It did say it was allowed to talk about the refusal itself, which of course is just post-hoc reasoning, but wouldn't do anything else after that and kept responding with (IIRC) "I can't help with that".

Now that I've tried it again it doesn't refuse at all. So perhaps just some part of the model still tuned towards that.

It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.

It's indeed Stockholm syndrome. It's (Ghidra decompiled) AArch32 firmware, but they define the datatype themselves with that name.

So the author charitably calls the 2025 vulnerability a "login bypass", but it's much worse than that. The firmware included a "datetime-based password" mechanism: a built-in backdoor password, like it's the 90s again.

The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food", which the attackers apparently took to be a good suggestion.

As the firmware is open for anyone to download [2], blurring the affected function seems more like an invitation to find out more. I know I was curious when the news about the fridges in France broke. The function's actually called "check_code_of_the_day", and this is the implementation:

  uchar check_code_of_the_day(LPCTSTR pass) {
    uchar uVar1;
    LPCTSTR pass_local;
    DATE_STRUCT date;
    INT32 tothex;
    INT32 hex;
    UTF8_STR buff;

    Get_syst_current_tds(&date);
    ftext_s(buff,0x1ff,"%02d%02d%02d%02d",date.month,date.day,date.year,date.month);
    sscanf(buff,"%lx",&tothex);
    ftext_s(buff,0x1ff,,date.day);
    sscanf(buff,"%lx",&hex);
    tothex = __aeabi_idiv(tothex,hex);
    ftext_s(buff,0x1ff,"%05ld",tothex % 100000);
    if ((((*pass == buff[0]) && (pass[1] == buff[1])) && (pass[2] == buff[2])) &&
       ((pass[3] == buff[3] && (pass[4] == buff[4])))) {
      uVar1 = '\x01';
    }
    else {
      uVar1 = '\0';
    }
    return uVar1;
  }

[1] https://www.claroty.com/team82/research/freeze-the-controlle...

[2] https://www.danfoss.com/en-us/service-and-support/downloads/...

What a great talk. My introduction to programming as a kid was also writing Runescape bots, using some Delphi tool called SCAR [1] (together with writing plugins for my Counter Strike 1.6 server using AMX Mod X). Start at Varrock bank, wizard hut, dialogue picker, teleport, find out where you are, mine, mine, mine, teleport back, back to bank, deposit, and again.

My great essence mining bot contraption horribly broke when Runescape started randomizing all colors slightly, after making a paltry amount in dollars selling the essences.

[1] https://scar-divi.com/

I'm customarily adding a "LLM disclosure: no LLM was used while drafting this issue text" to issues now (when that is true), to at least give some explicit signal that two humans are talking. Of course the text you write yourself is often distinct from slop grenades, but emphasizing that can't hurt.

And of course, you can write that and still paste completely slop, but nobody seems to be doing that yet, and if they would it's probably not convincing.

Certainly! You can watch a talk about the operations behind the Home Computer Museum here: https://media.ccc.de/v/mch2022-140-homecomputermuseum-the-ma...

There's also a page here that contains the budget for multiple years, although the totals from 2027 on don't sum correctly from the different sub-budgets: https://www.homecomputermuseum.nl/informatie/organisatie/bel...

It even goes both ways: you can geolocate the user, and you can sell the BSSID data for future lookups. Not sure how valuable that still is in 2026 now that every mobile phone is adding that to the Goople databases, but it was in the past.

> Is there anyone who has done a technical write up and investigation into the firmwares?

I extracted the firmware and filesystem of a webOS 3.5 and webOS 24 TV previously so I could remove the spying bits and get an internet connected TV back. I asked Claude Opus 5 to do some analysis on the ACR implementation yesterday. I haven't had time to check it myself, so it might give some insight but take it with a grain of salt. Also because I'm not entirely sure I extracted the complete filesystem for the webOS 24 TV.

See the documents temporarily hosted here [1][2][3]. You can find the Markdown originals in the HTML source. The Markdown has also been pasted here [4] (although the forum software has sometimes inserted a lot of tildes).

LG uses the "Alphonso SDK" for ACR, a company which it seems to have a majority stake in [5].

WebOS itself is actually pretty neat once you get root on the device. It still has open source releases, uses a well documented service bus, the UI apps are unobfuscated Javascript. It's a genuine Linux TV if only LG allowed you to get root and would not install spyware by default. Secure boot unfortunately does prevent you from messing with the boot process.

If you want to know anything specific, let me know. There's also a pretty active Discord (ugh) community here [6].

Personally, I'm most interested whether LG and other device manufacturers are getting informed consent for ACR in European markets, and what the consent screen looks like. I doubt that many consumers actually know what they're consenting to, which might be a GDPR violation.

[1] https://scriptbase.org/lg-tv/webos-24.html

[2] https://scriptbase.org/lg-tv/webos-3.5.html

[3] https://scriptbase.org/lg-tv/comparison.html

[4] https://gathering.tweakers.net/forum/list_message/86090672#8...

[5] https://www.adexchanger.com/tv-2/lg-grabs-a-majority-stake-i...

[6] https://openlgtv.github.io/

> I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime.

That's cheap indeed. Enough headroom for some failing disks too. How is the noise and power usage? I didn't look at SAS drives at all, because my impression was that they're very noisy. I can place my NAS in a closed off room, but it's not too far away and I was afraid SAS drives would be audible through the wall.

Yes, indeed. ECC RAM is better than non-ECC RAM, also for ZFS.

The myth, popularized by a notorious thread on the TrueNAS forums [1], is specifically that ZFS requires ECC RAM, and will do worse than other filesystems without it, because scrubbing will multiply a single bitflip into a failed pool.

A ZFS core developer says that that isn't the case [2]. Here's some more reasoning [3], also about many other myths.

[1] https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram...

[2] https://news.ycombinator.com/item?id=18480016

[3] https://kldload.com/zfs-wiki/myths

> I’m running an 8-drive ZFS RAIDZ2 pool. I’m wondering if you know — are the free space recommendations around ZFS cargo or real?

I'm not entirely sure, but it seems to me that free space (and the 20% reservation) is mostly a proxy for fragmentation, and you can therefore better look at fragmentation directly. That would mean that if you mostly store large files, there shouldn't be a lot of fragmentation even at high utilization. The whole "ZFS changes allocation algorithm from 80% usage on" is something of 10+ years distant past, and lots of things around the allocator have been improved. It's also something that probably isn't too different from the performance of other filesystems at high utilization, so it shouldn't be exaggerated.

It was €329 per hard drive (through a reputable store), and I chose the ASRock B650M-HDV/M.2 mATX motherboard combined with a Ryzen 5 8500G. Stock CPU cooler, replaced the Jonsbo case fans with Arctic P12 Pro PST LN. I only slightly regret the PSU (MSI MAG A650GL), which could be quieter. Not that it's very noisy, and it's a great PSU otherwise, but I should've chosen one that just shuts the fan down at low power usage.

Not a great time price-wise to be building a NAS, but I have been doing so for the last two weeks. Inside a Jonsbo N6 case, which is pretty nice with an 8x SATA backplane and drive bays (unlike the earlier Jonsbo variants).

I ended up on shucking 4x the 14 TB WD Elements Desktop. They contain helium drives, the WD140EDGZ in my case, and are about a third cheaper than 4x the 12 TB WD Red Plus drives (which are air-filled). The shucking was easier than I expected too, and the performance seems very comparable. The warranty is a definite downside (European, so no Magnuson-Moss), but I think I can even get them back in their enclosure should they fail during the 2-year warranty period.

I've put some second hand 256 GB M.2 SSDs in there as boot drives. It was a bit of a struggle to get it to work in a way that failure of one of the drives doesn't hold up booting, combined with LUKS, TPM keys and ZFS on root. Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was. So now I have a large script which debootstraps a Debian based NAS into being.

I noticed that there are a lot of ZFS myths and cargo culting. For example TFA mentions ECC RAM, which in some circles is a must-have because ZFS would wreck your pool during a scrub otherwise, which is a myth. It's also very expensive, especially this year. You also don't need much RAM for ZFS, L2ARC doesn't use much RAM at all, to name a few others.

Still doubting about setting `dnodesize=auto` (which is the default), because there are some horror stories about that [1]. And it seems impossible to find a cloud storage provider with reasonable prices that supports `zfs send`. Rsync.net upped their minimum order to 10 TiB recently, which is far too much for my use case.

[1] https://github.com/openzfs/zfs/issues/11353

[2] https://www.rsync.net/products/zfsintro.html

For writing and languange learning it's very decent, especially Mistral Large. The pricing is very good too. I really like the consistently low time to first token and good token per second. Claude, especially in the past, would be very inconsistent, often with outages. Mistral mostly just always works and is very fast.

Technical questions are unfortunately hit or miss. I'm lately pretty much always using a system prompt that emphasizes short answers [1], and Opus regularly one-shots it while Mistral needs a follow up. I use big-AGI as a model router [2] (dumb name, great software), which makes switching midway very easy though. For coding I'm still using Claude Code mostly out of inertia (although I really want to move to an OSS harness) and the one time I tried their `vibe` tool months ago it was a bit rough.

Mistral TTS with diarization is also great and cheap. That's the only thing for which I use their web UI.

[1] Give a short but helpful answer to the question the user asks. When helping with a computer-related task, unless the user asks, don't give any installation or setup instructions, but just get straight to the point. When the user asks a follow up question, give a more complete and longer answer while still not overexplaining. When the user prefaces the question with "short mode off" in any question, give a full and well considered reply.

[2] https://github.com/enricoros/big-AGI

The "Lists" page, lists most of such 'hidden' functionality: https://news.ycombinator.com/lists (which itself is linked in the footer).

Indeed, this seems to be exactly the area where the Data Act could be used to regain access. Unfortunately it seems that it's not possible to directly sue (e.g.) Volkswagen to get access, unlike the GDPR where you have direct standing under article 79 [1].

There doesn't seem to be much written about enforcing the Data Act, so I looked at the regulation directly. Article 39 [2] seems to require to first lodge a complaint with the competent authority as designated by the member state of your residence. Then when that authority invariably fails to act – I have no idea which timeframe we're talking about here – you can "in accordance with national law, either have the right to an effective judicial remedy or access to review by an impartial body with the appropriate expertise". But then you are suing that authority, and not the company directly (edit: I was originally unsure about who to sue under article 39, but 39(3) does clarify that it is the authority).

I would very much like to be wrong about this. I can imagine Muñoz vs. Superior Fruiticola applies [3] ("it must be possible to enforce that obligation by means of civil proceedings"), but I'm not at all sure, and it's a much weaker route than the one which the GDPR explicitly describes.

Would anyone know or have better references on how to enforce the Data Act, preferably individually?

[1] https://gdpr-info.eu/art-79-gdpr/

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:...

[3] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

I'm not quite sure why all that swapping is necessary. I really does age your SSD quite fast considering the enormous memory bandwidth required. Gemma 4 31B at 4-bit quantization should only be around 19 GiB [1], not 28.4 GiB. I'm not feeding it images regularly, so I'm not sure how much memory it needs to get those into context, but I can't imagine it is more than 10 GiB.

The activity monitor does show all kinds of Electron apps active, on top of a presumably model-loaded Handy and a virtual machine for Claude Code, so I guess that's the real root cause for all the swapping. If your laptop starts trashing I can't imagine you have any use for those apps, which will grind to a halt.

[1] https://huggingface.co/mlx-community/gemma-4-31b-it-4bit

So you made this change completely invisible to the user, without the user being able to choose between the two behaviors, and without even documenting it in the (extremely verbose) changelog [1]? I can't find it, the Docs Assistant can't find it (well, it "I found it!" three times being fed your reply with a non-matching item).

I frequently debug issues while keeping my carefully curated but long context active for days. Losing potentially very important context while in the middle of a debugging session resulting in less optimal answers, is costing me a lot more money than the cache misses would.

In my eyes, Claude Code is mainly a context management tool. I build a foundation of apparent understanding of the problem domain, and then try to work towards a solution in a dialogue. Now you tell me Anthrophic has been silently breaking down that foundation without telling me, wasting potentially hours of my time.

It's a clear reminder that these closed-source harnesses cannot be trusted (now or in the future), and I should find proper alternatives for Claude Code as soon as possible.

[1] https://code.claude.com/docs/en/changelog

I recently bought a second hand eight year old 4K LG TV. Pretty cheap too. All models running webOS 3.x and 4.x are trivially rootable as LG never provided an update against DejaVul [1]. There's a handy website to check which models are rootable [2]. You can write directly to the (old!) Wayland socket; haven't tried a libwayland yet that is compatible.

IIRC the last public exploit for all LG TVs for webOS > 5 was in the beginning of 2025 (so pretty recent), but as most sellers on the second hand market have auto-updates turned on, there's no way to know which TVs are vulnerable.

It should be doable to strip down much of webOS with root access. It's nice that webOS in general is very well documented and much is implemented around the Luna service bus. LG offers a developer mode for non-rooted TVs, and there's an active homebrew community because of it. It's a pity that you can't modify the boot partitions, as the firmware verifies their integrity. It would be nice to have an exploit for that.

[1] https://github.com/throwaway96/dejavuln-autoroot

[2] https://cani.rootmy.tv

Not restricted to Apple, but TIL: Double-clicking on a word an keeping the second click pressed, then dragging, allows you to select per word instead of per character.

Get into a venv, and run:

> pip3 install git+https://github.com/ml-explore/mlx-lm.git

> ./venv/bin/mlx_lm.generate --model "$MODEL" --temp 1.0 --top-p 0.95 --top-k 64 --max-tokens 128000 --prompt "Hello world"

Where $MODEL is an unsloth model like:

- unsloth/gemma-4-E4B-it-UD-MLX-4bit

- unsloth/gemma-4-26b-a4b-it-UD-MLX-4bit

It is, as I'm running it; it has been added this week. As I said I'm running the main version from Github and doing nothing special, see: https://news.ycombinator.com/item?id=47761308

> The same Gemma 4 MoE model (Q4)

As you have so much RAM I would suggest running Q8_0 directly. It's not slower (perhaps except for the initial model load), and might even be faster, while being almost identical in quality to the original model.

And just to be sure: you're are running the MLX version, right? The mlx-community quantization seemed to be broken when I tried it last week (it spit out garbage), so I downloaded the unsloth version instead. That too was broken in mlx-lm (it crashed), but has since been fixed on the main branch of https://github.com/ml-explore/mlx-lm.

I unfortunately only have 16 GiB of RAM on a Macbook M1, but I just tried to run the Q8_0 GGUF version on a 2023 AMD Framework 13 with 64 GiB RAM just using the CPU, and that works surprisingly well with tokens/s much faster than I can read the output. The prompt cache is also very useful to quickly insert a large system prompt or file to datamine although there are probably better ways to do that instead of manually through a script.

Not necessarily, but most inverters (in Europe, at least) aren't designed to function without a grid anyway.

Some models of inverter brands like Victron (which isn't very common outside its niche of self-sufficiency because they are rather expensive and sometimes complex) can form a micro-grid. They have the option of a special circuit breaker [1] that decouples the inverter from the grid if the grid is detected to be down, which allows their use during a power outage.

[1] https://www.victronenergy.com/accessories/anti-islanding-box...

You say "tax money", but this project isn't a government project or using public money at all. As for contributing back to Nextcloud: there is a long list of Nextcloud partners [1] that contractually obligated themselves to contribute back to Nextcloud for every user they onboard. The company in this article has not.

[1] https://nextcloud.com/partners/

This is just a Nextcloud rebrand with a confusing domain name. It claims "Core is [100%] Open Source" but no source code is provided beyond what's already available in the upstream projects, and it's not likely there will be (as this happens a lot). It's a one-man project without a track record or certifications based out of a shared office space [1].

And don't get me wrong: there's nothing wrong with starting a business rebranding Nextcloud and keeping your development closed source, as long as your honest about that, which this initiative is not.

If you're looking for a Nextcloud hoster, there's a long list of partners here [2] that contractually obligated themselves to contribute back to Nextcloud for every user they onboard.

[1] https://blog.tomaszdunia.pl/officeeu-eng/

[2] https://nextcloud.com/partners/