Shank

Why did you take the name of the app you want to compete with? Isn’t that just a little disingenuous?

I'm genuinely curious as to how fast this was handled by Apple devices, Linux, etc. With enough advance notice, I don't see this being that terrible to patch. Was it lack of advance notice?

> I equate it to partnering with AT&T on the first iPhone.

In terms of strategy, they picked the underdog carrier (Cingular) specifically to avoid having to bundle bloatware and carrier customization at the cost of exclusivity. Likewise, when Apple brought the iPhone to Japan, they did the same thing with the underdog carrier here, SoftBank.

The strategic importance of this was as a bargaining chip with other carriers and fundamentally gave them a lot of control they would not have had if they had gone with Verizon or similar.

> Beyond the clumsiness, it shows a leadership that now treats the constraints that made Proton worth paying for as the thing slowing it down.

Exactly. The product is security and privacy. The thing being sold is that. If anyone could justify being slower to pentest, it is Proton.

I do wonder who would be demanding that Proton move faster. Would any user of their service ask them to sacrifice these attributes?

To what degree is this just another symptom of the US healthcare system being flawed and in need of rework? To what degree would anyone use such a service if the costs remained high?

I used Zocdoc in the past to find a doctor and ended up with a doctor who just charged out-of-pocket instead of insurance, and it worked great. Would an app that shows up-front pricing be better for the consumer?

Anthropic published a blog post claiming RCE with it [0].

[0]: https://www.anthropic.com/research/discovering-vulnerabiliti...

I’m pretty confused because apparently Anthropic is the group that followed “responsible disclosure” but apparently even though upstream was patched a couple weeks ago, still nothing on either.

At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.

> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway

> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.

[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...

I mean this is the basic premise behind QubesOS, but if you add isolation like Qubes wants, it does become very difficult to cross between apps.

> Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.

It seems to me like the app itself should be able to perform this operation and restore data? Why is this not just fixed in the app?

> Firefly is a multi-client that combines together X, BlueSky as well as Farcaster and Lens (both partially-Ethereum-based decentralized social media platforms). You can see tweets from all four platforms, and you can make a tweet that gets auto-posted to all four platforms.

It is really interesting to see a third-party client for Twitter still operational. How is this still possible? This seems like an unauthorized third-party hack that would likely get shut down with too much attention?

The theft occurred on-chain with smart contract execution, not with their platform. The money was stolen directly from the hot wallet.

Wire payments are definitely reversible, but you might need to involve the courts, and international wires are more complex [0]. Most notably, 900 million in accidental payments made by Citi were eventually fully reversed by appeals courts.

> A full recounting of it is outside the scope of this anecdote, but it rhymes with “If you and the United States federal government disagree whether a transaction is final, you are wrong.”

[0]: https://www.bitsaboutmoney.com/archive/no-payments-are-final...

> In one exchange, an employee in the company’s security Slack channel urged Proton to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August.

There was a moment a while back when 1Password made some decision (I think abandoning delphi?) that made me take a step back and ask if they were a security company or not. In moments like this, I wonder if Proton's pitch is security or not. Even if this is a true take, I think someone saying that they need to be cautious and pentest something before launch is a valid concern, for a security company. Not all companies are security companies, but Proton specifically advertises itself as being security and privacy conscious. It is a bad look for a security company to do something that indicates a lack of security prowess.

I think the writing on the wall for manually writing every line of code is obvious, but that does not obviate the need to secure things. However, pushing for speed at the expense of security, AI or not, is a bad look for a security company.

I feel like there are a lot of reviews like this, where people talk about why the phone wasn’t for them, but not the opposite. Why are Duo owners keeping theirs? It’s kind of maddening to only see one dimension of the device.

I guess you found me! I like it. No change is better than changing any arbitrary time.

> For the foldable market to triple in size, Apple would need to sell 40m this year

For the record, it seems like the production will not get close to 40m phones this year. According to most outlets, it is backordered to January and Apple had to ramp production higher than anticipated. I highly doubt that it will literally 3x the market this year. But the pattern has been, excepting the Vision Pro, that when Apple enters a market, it suddenly proves the viability to other market entrants, and to the general public who view it as a mature market.

> but the original caveats are pretty much all still there

I don't think this is true at all. A significant portion of people complain about the crease, light reflections, and poor software. It seems like initial reviews don't find problems due to the "nano-texture" display (probably achievable in third-parties with a matte screen protector). As for software, once apps have been optimized for Duo, I expect that designs will carry over to similar form-factor folding devices on Android.

I feel like the average tech enthusiast just assumes that most people have computers, but they do not. Most people have a phone as a primary computing device. Tablets have gone up in popularity, but for a significant portion of people, their only device is a phone. Those people are buying phones on carrier financing or other deals, so they don't even see the full cost of their device at all. So for people doing this type of upgrade cycle, a folding phone is quite compelling: an expanded screen size for watching video, consuming content, or heck, even maybe productivity, while being effectively a marginal upgrade in cost on a monthly payment.

Also, just for the record, some carriers in Japan are offering financing that gives you the option of paying over 48 months and Apple offers 36 months. Is that quite absurd to most people? Absolutely, but for the average person who wants a bigger screen sometimes, the cost is not even going up much on a monthly basis.

For the record, especially in Japan, folio cases where you open your phone like a book are already the default. Effectively most people on the train have their phone open in some "Duo-ish" form-factor already. So the jump from a folio case to a folding phone is already substantially lower.

Obviously the gimmick nature of folding is not the compelling reason why people want folding phones. The question is more about tradeoffs, and I think that especially in asia, the demand for folding phones is quite obvious: upgrade your primary PC to have a huge display when you want it that way, otherwise it stays compact enough to be with you all the time.

> I think the main thing is that for this kind of money you have a lot of options. You could even buy a GPD device that is an actual full blown pouch sized laptop and buy a regular iPhone for the same price.

I have done this! I currently carry a GPD Win Max 2 around, but let me be clear about some elements of this: the keyboard on a sub-device is just as important as any other, and the keyboard on GPD devices is not great. A sub-device has to be maintained and charged and given love and care just the same as any other device. The amount of times I have found my cute linux laptop dead when I wanted it, outdated, or randomly signed out of services is quite high (and this is with an onboard LTE modem). Carrying around a folding (or even non-folding, like a Magic Keyboard) is lighter than a sub-device, will last significantly longer in terms of charge/battery, and does not require any of the secondary device maintenance that is needed with one normally.

To me a folding phone is an absolute no-brainer in terms of why it is useful. You can get a very, very good keyboard for cheap, or try many, and completely eliminate the need to carry a second device.

Another huge use case I have is transit/travel video playback. I do not normally want to bring an iPad or even a secondary laptop during travel, so this effectively deletes one more device that I have to charge, update, bring adapters for, etc. It is effectively all of the benefit of having a tablet at all times, a sub-laptop at all times, and requires absolutely no additional charging or maintenance.

> That should be enough. If users don't read that's on them.

The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.

This one is just a virtual address that forwards directly to you: https://lp.da.pf.japanpost.jp/

You should follow the NSA's advice or the Prime Minister of Japan's advice and take the service offline: https://x.com/NSACyber/status/2112903220209098897

I really do not think anyone should trust a vibe coded repo that launched 1 minute ago as a viable defense for any service.

This is notable enough that the prime minister of Japan has tweeted about it: https://x.com/takaichi_sanae/status/2112890642590564386

Major Japanese services like pixiv and e-commerce platforms have elected to turn off services until patches are available. If you're smaller than pixiv, you can afford to go down for a few hours.

I would hazard a guess that Wordpress VIP and Wikipedia were given advance access to patches? These are the biggest users of PHP after all.

Honestly, kindarails2shell resulted in a responsible disclosure coordination followed by the decision to release early since it was reversed too quickly. Even just a hint of a 0-day is enough to cause people to look for it and exploit it with LLMs.

This is an area of planning known as "business continuity planning" and as part of this process, you should have a document and written procedures that are executed by humans, not computers, and tested as part of this. For example, your BCP should include people who are already trusted and know how your infrastructure works, and you should do a dress rehearsal on a yearly basis at least. A notification tool is one thing, but realistically this should be just one of your tools.

I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.