News for hackers. Stuff that matters.

arghwhat

Re:MacBook Pro with PROLED XDR Display and Touch on Wednesday October 28, 2026 @05:13PM (#50280979)
ecosystem != UI

Buttons sized to be hit by your physical thumb and buttons sized to be hit by a tiny high-precision cursor are very different things.

I am sitting on a macbook pro with the vertical tab pane open in chrome, with 12 tabs. The outer joint of my thumb covers the entire list, in both width and height. A touch-friendly version of that would be humongous in comparison.

Re:Apple introduces the new 14‑inch MacBook Pro with M6 on Tuesday October 27, 2026 @02:48PM (#50263908)
Looks just as notchy as they've always been.
Re:Apple introduces the new 14-inch MacBook Pro with M6 on Tuesday October 27, 2026 @09:58AM (#50259441)
Heh, no, it's soldered.

If you throw enough money at a sufficiently skilled technician it can be done, but no M.2 slots in sight here.

Doesn't change that it isn't accurate.

In Scandinavia, lack of air condition in homes vs. presence in cars has nothing to do with carbon programs.

What options become standard in cars, and what options are cheap to implement in cars (adding a bit more piping during assembly), follow an entirely different market dynamic than the retrofitting homes (most houses are either pre-WW2 or from a boom in the 50's to 70's) with air conditioning to handle what used to be very short bursts of heat.

Not only did weather not demand it, old brick houses have significant thermal mass and during sudden heat waves you'll often find the inside to already be noticably cooler.

It's being considered now both because weather got weird and our construction went so far in energy efficiency that while new construction barely require any energy to heat in the depths of winter, they become literal ovens in peak of summer.

You are mixing unrelated requirements together here.

> The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.

These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.

I do not believe that any corporate lawyer would think that. It does not read like that in neither plain english nor legalese.

Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"?

A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.

nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".

Re:Shipping JPEG XL in Chrome on Wednesday October 07, 2026 @11:12AM (#49993956)
Eh. WebKit, Blink, Gecko being the big ones, supporting Windows, Linux (and alikes — maybe one would consider Android separate in this context) and Darwin (in this context iOS/macOS is the same). Mostly 1:1.

The thing is that it's still just a library, it just happened to be pre-installed. CGImage is just a helper in the Core Graphics library, not some magical "native"/"core" functionality in the OS that would be different than any other library with the same features.

An equivalent library for Linux (glycin for example), or per-format libraries like jxl-rs, are not "included in the OS", and tend to be the very same libraries one would use for Windows. If that does the trick on most platforms, then why have the maintenance burden of doing something different on macOS if all it does is save a few bytes on disk?

From Google's perspective, they would likely not want Chrome for macOS to gain support for jxl as the sole platform anyway, even if they are using CGImage and could decode it that way...

That is not what relative privation fallacy is. The topic at hand is repeated exposure to low radiation does, I gave examples or negligible to high dosages. Disagreement does not make something a fallacy.

Twofold response:

1. It was not directly part of my claim, but yes releasing "toxins" as a binary concept has to be okay because the world, nature and ourselves naturally releases toxins. Irresponsible, excessive or unnecessary release is what matters.

2. In the airline case, it is not the airline releasing anything. It is cosmic rays and solar flares, which you went closer to. The airline should give a heads up in case this information evaded you, but it's the sun you'd need to sue. You'll have to get in line behind all the skin cancer lawsuits it's dealing with though.

A beach body guard has a massively increased risk of skin cancer compared to an office worker. You can, at most, ask for a shade for your watch tower or complimentary sunscreen.

Even for coal and oil powerplants for example, the right thing to focus on is getting rid of it, not extracting ongoing damages. Wind, nuclear, sun.

For flying, in either come up with a viable way and of radiation shielding passenger planes so it can be pushed for policy, or don't fly. Also don't go to very high altitude locations also carry increased risk.

As for contamination zones, that's specifically something the one to blame will have to keep paying to manage and clean up. Their fault, their bill. But even with all that it still ends up being what takes the fewest lives, due to just how much work for society that one plant did vs. any alternative.

I see the good intent but I cannot agree on several points.

First point is that even though radiation can cause cancer, radiation is part of life. If my basement has higher levels of radon, who should compensate me? What about the radiation exposure from requested x-rays, or food?

Second is responsibility. If I decide to fly a lot, my increased radiation exposure is not the fault if the airline. It's not their fault that the atmosphere is less protective up there, and everyone flying is equally exposed. Now if they could prevent the radiation they preferably should, but until then their responsibility is disclosure of this information to allow informed decisions. Can't blame the ocean for being wet.

Third is that by that logic, it very much has bearing whether "wind turbines kill people", as it implies that every fractional possible cause of harm must all be measured and pay in proportion to their possibility of damage.

There would be no way to even start. However, I do agree that when accidents or negligence/malice is involved, it makes sense that the actor spends energy cleaning up. For example, the biological harm to people in Fukushima was practically non-existent, but the short-term the economic and social harm was there and was entirely avoidable. Damages should be paid.

(Of course, windmills don't kill people, point is that wind, nuclear and solar is so harmless that the only thing we're looking at is differences in construction-related workplace accidents, which are a bit higher with windmills and lower with solar.)

Whether the disasters are worse depends on your metric. The deaths from Fukushima was, to my knowledge, only a few elderly individuals who had stress-induced heart failures. And that's a worst-case scenario with corruption, old designs, complete negligence and dual natural disasters hitting the plant in parallel.

It seems absolutely silly, but even wind power kills more people per TWh produced than nuclear due to workplace accidents in installation/maintenance.

Also not sure why lung cancer from oil/coal air pollution would be less visible than hypothetical radiation-induced cancers.

EDIT: Source: https://ourworldindata.org/grapher/death-rates-from-energy-p..., accidents include indirect deaths. Solar is the only energy source that beats nuclear in safety.

Re:Show HN: ssh ssh.place on Tuesday August 04, 2026 @04:34AM (#49165816)
Yes, but terminal escape sequences are a very, very small surface. It's just a few opcodes like "wipe screen", "switch to buffer B", "move to X,Y". All process output regardless of whether it is a terminal escape sequence or regular text just navigate and update the screen "cells", and in, say, alacritty this will be in boring, non-unsafe Rust.

For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.

Re:Show HN: ssh ssh.place on Monday August 03, 2026 @05:52AM (#49153530)
People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?

The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.

From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.

(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)

Large objects (≥ 32 KiB) does not use these categorized arenas, they instead allocate an integer number of 8KiB pages from a heap.
Also note that drivers are made far harder than screws, so it will take many screws turned rivets before a driver becomes said artisinal hole punch.
Excuse me? That derogatory tongue-in-cheek way of referring to that company is not "mealy mouthed nerdery", as everyone and their mother understands who I am referring to. The lawsuit mitigation communication I suspect you're confusing it for requires it to be genuinely unclear who you mean.

However, batteries cannot cost $1 unless you want $1 worth of battery. Modern batteries are genuinely complex devices with extremely tight assembly tolerances, and something like a phone battery should be expected to be more like 10-40 USD.

Cheapo cells exist, but they genuinely have issues like poor assembly tolerances introducing risks of it deciding to spontaneously transform into a pocket-sized smoke machine.

They describe it as a feature in their later 1942 patent (US2474994A), in the description of which they mention it to protect against powertools with poor torque control, claiming that a better screw would only be possible if power tools and their torque control were perfect and that it is therefore a required feature.

The original designs did not reference this though, so it seems more like them adopting an observed behavior as a feature - so the statement that it was originally designed to be that way is indeed off, but the company did adopt the behavior in official paperwork.

Am European, yeah but pozidriv was never used for tiny screws. We have also pretty much migrated all screw sizes to torx nowadays, so I only ever really see pozidriv on older appliances and hardware, while Philips mostly happen on imports.
You got the wrong standard. JIS B 1012 type H is Philips equivalent, but what people refer to as the JIS screw is JIS B 1012 type S. JIS B 1012 Type S ("JIS") and ISO 8764 (Philips) are entirely different screw and scredriver profiles. See https://www.peterverdone.com/jis-cross-head-screws-and-drive....

The Philips screwdriver has lobes with a large multi-stage taper that ejects the screwdriver from the screw upon torque. The JIS screwdriver lobes are in contrast almost perfect 90 degree angle with a tiny filet in the center - not dissimilar to the Frearson screw.

A Philips screwdriver will be unable to insert all the way into a JIS screw due to this taper, exactly similar to how the extra lobes on a Pozidriv screwdriver collides a Philips screw. Attempting to apply torque with this partial engagement puts you at very high risk of stripping the screw.

A JIS screwdriver however does work perfectly fine in Philips screws due, often even better than the Philips screwdriver as you did away with one half of the screwdriver ejection feature.

There's a reason that iFixit goes out of their way to make both JIS and Philips bits, and warn you in their guides. They aren't really in the business of trying to cram more bits down your throat for fun.

As mentioned elsewhere, it's also important to remember that the batteries were fully serviceable - available for purchase, nicely compartmentized and with easy connectors. The products were definitely not designed to die with their batteries. They just weren't compliant with the new rules - this is quite different than a certain fruit company that have historically made battery replacements difficult for even service technicians to complete without consequences like constant user prompts.

I imagine the various products had their specific own conflicts with the rules, like requiring too much disassembly (the Pro controller in particular has to be disassembled from the front first), or the Switch 2 holding the battery with double-sided tape. Not to mention that you might not realize that the screw are JIS spec, stripping them with the Philips screwdriver you found in your drawer. Also triwing.

To be clear, all the mentioned Nintendo products are already designed for battery replacement, with well-contained battery units and easy connectors, and the batteries are available and problem-free to replace unlike for a certain fruit company.

The redesign is because the ease of accessing the batteries did not comply with the new rules. The pro controller in particular requires almost complete disassembly to get to the module, and the Switch 2's battery uses double-sided adhesive which is finicky. Joycons can also be a bit finicky to navigate for the uninitiated.

Also, as the device is Japanese, it uses JIS screws rather than Philips (in addition to triwing), which could surprise some. These are superior for service - Philips screws are specifically designed to strip during assembly to prevent over-torquing - but they do require you to have the right, "exotic" screwdriver. As JIS screwdrivers are compatible with and superior in bite even for Philips screws, it's a good habit to just always use those instead for electronics. iFixit kits and such include them.

To my understanding (which can be wrong) these gas turbines are not backup generators, but used as primary or supplementary power sources during normal operation where the grid cannot supply (or when grid cost is unfavorable). In one clip (which is a bit sensationalist so I'll refrain from posting it as it may derail) shows a park of some ~24 large gas turbines - each of which sized like a small building - with about half in operation at that time.

Indeed, there is some noise from backup generators when tested (or in use), but with a bit of preparation, good palcement and sequential testing you can make that not too disturbing.

Three ways:

1. Build your datacenter near supply. If there were consequences to ignoring the rules or being a bad neighbor with municipality, state or federal government baring their teeth, more optimal locations with regards to supply and noise would also end up being the cheapest and safest location for them.

2. Build supply near your datacenter. Solar and wind are both very cheap right now, but requires buying more land, same for a proper gas power plant in its own building with appropriate noise and pollution treatment.

3. Make investment into infrastructure a prerequisite for the project instead of just complaining about it and making into an excuse for cutting corners.

Even if you need to have local supply, "mobile gas turbines left on trailers to pretend they're not permanently installed to avoid having to get permits" is never a necessity.

We should also keep in mind that the problem isn't datacenters, but how they are built.

Datacenters do not have to be noisy. Datacenters do not have to cheap out on cooling solutions. Datacenters do not need to be powered by mobile gas turbines left on trailers to pretend they're not permanently installed to avoid having to get permits.

Those corners being cut is not what make AI datacenters possible or competitive. That race is purely chip supply.

For reference, I work in an industrial neighborhood where there are quite a few new datacenters from big providers. The buildings are ugly for sure, but unless you're staring at it you'd have no idea it was there. I could try to pay more attention to see if I can hear it if I focus on it, but I suspect the sound of nearby rustling leaves will be too deafening to make out anything.

Re:Should every baby's DNA be sequenced? on Thursday July 02, 2026 @04:16AM (#48758171)
> Then maybe install the strobe lights in all important rooms

What are important rooms?

> Most people have there phone on silent/vibration anyway and recently everybody uses noise-canceling headphones outside to not be bothered by other people...

> Everybody is handicapped part of the time

A phone on silent still blasts public safety warnings at full volume. A phone on vibrate can still be heard. Noise-cancelling headphones still let the outside through at a lower volume.

Very different scenario.

Re:Should every baby's DNA be sequenced? on Tuesday June 30, 2026 @09:08AM (#48732228)
I have previously had to install simple things like doorbells for deaf people, which is done through a very strobe light that can be seen from almost the entire apartment... if you're not behind a closed door at least.

The idea of it being genuinely difficult for a person to be warned or notified is terrifying. Put your phone in your bag and you might as well have left it at home. Honking, people yelling or screaming for you to move out of harms way, even air sirens... You'll have no idea.

Re:Should every baby's DNA be sequenced? on Tuesday June 30, 2026 @08:58AM (#48732114)
A shrinking deaf community has nothing at all to do with ethnic cleansing, and social support does not shrink for less common diseases - it's usually the opposite, with support proportional to how rare and inconvenient the disability is.

Let's try a small thought experiment: Some birth defects stem from dietary issues in the mother during pregnancy, like folic acid deficiency or alcohol consumption.

Let's imagine that we discover that deaf children are primarily caused by a particular vitamin deficiency during pregnancy. We can then either spread the information so parents can supplement, or even fortify foods and cause the community to massively decline or even disappear - or we could withold the information on the vitamins to artificially maintain the population of the deaf community.

You could even extend it to a scenario where we end up relying more and more on artificial insemination or other early processing - the impact of many dietary deficiencies happen extremely early, so to maintain the community we would then have to artificially cause said deficiency to maintain the population of the deaf community.

Heck, we can always just make people deaf later if you wanted to maintain their community. We could also make more people get into "accidents" so that the quadriplegic community is maintained. Sounds absolutely insane when you start to discuss maintaining the population of disabled communities, doesn't it?

Back to the topic, cleansing of the deaf in this context implies a hatred for deaf people in general and wanting to remove all deaf people, which is an emotion entirely unrelated to sympethesizing with the disability of being deaf and wanting to avoid causing more such disability.

Re:Should every baby's DNA be sequenced? on Tuesday June 30, 2026 @07:57AM (#48731427)
There is no path that turns "I would like to terminate my pregnancy if the outcome is unfavorable" into "I would like to commit genocide on everyone whose genetics I do not like".

Granted, someone who already wishes for or aligns with the idea of ethnic cleansing might start by only publicly sharing their wish for the former to begin with, but I don't see a sensible argument for it being a natural extension of the former.

Re:Should every baby's DNA be sequenced? on Tuesday June 30, 2026 @07:49AM (#48731336)
A problem is that some see 2 as a subset of 1, upset at the idea that parents would wish to terminate pregnancies early that have strong indications of defects. I do imagine a good chunk of those people are of the horribly broken belief that abortions should be outlawed altogether, so not sure how many specifically go against such "filtering".

Granted, if everyone were sequenced and had access to that information it probably wouldn't take too long before certain categorizations became a requirement on the dating profiles, and that's a slippery slope...

(Regardless, nature filters us all by genetics in several stages, and our entire concept of sexual attraction and social groupings are based on the most direct form of priliminary selection for genetics that evolution could achieve with our limited available senses.)

Hmm, yes I was conflating a few things there.

However, I'd hold that this is an extension of the USB 3 mess that predates USB-C, even if the x2 mode specifically was a USB-C addition.

The important thing for people to know is that support for USB 3.2 Gen 2x2 is practically non-existent: TB3 came before as a well-established (but premium) solution, and USB4 just two years after to commoditize it. A complicated solution with mid-tier bandwidth and none of the flexibility didn't attract attention, so support is poor.

Older »