collinmanderson

> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.

To be clear, Ubuntu Pro doesn't have the fix yet either.

https://news.ycombinator.com/item?id=50337869

> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`

To be clear, Ubuntu Pro doesn't have the fix yet either, in case anyone's confused.

Scammers often create a sense of urgency/emergency, especially over the phone, and putting a 24hr limit on it gives the person more time to possibly realize they're getting scammed.

It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.

If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.

-

Edit: Google explains this more:

In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.

According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.

https://android-developers.googleblog.com/2026/03/android-de...

That's what they said it's going to be. A one time 24 hr cooldown to turn on the "Allow Unverified Packages" setting, not 24hr per app.

And then you have the option:

- unverified packages either temporarily (7 days)

- or indefinitely

Official docs here:

https://android-developers.googleblog.com/2026/03/android-de...

> This seems like smoke and mirrors

Technically it’s water vapor, not smoke.

The main thing ads allows is "zero-click" - so they don't need to click a link or anything to get exploited.

So there's some sort of Android/iOS vulnerability in Chrome/Safari that they're exploiting?

No info on if a recent version patches this?

It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?

Yes, I was going to say that too. Modern "serverless" is basically this - spawning a script to handle a request on-demand.

And because of serverless, there are frameworks optimized for low startup time, and those frameworks would probably work pretty well for CGI too.

> also i wonder if it works nicely if it is possible to convert Pi transcripts to Hax - i have a few "in progress" and i'd like to continue where i left from, though while both seem to use JSONL for the transcripts i'm not sure if they're compatible

I’ll sometimes ask the new agent to look at the previous transcript file.

I have the agent (Opus 5) spawn code reviews for their own work, and the code reviews generally catch n+1 queries.

For US federal government, "Office of Management and Budget" says to store 72 hours of packet capture, since 2021 (partially in response to SolarWinds attack). (M-21-31)

https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR...

They used to give preferential treatment to AMP search results, but November 2020 they announced switching to "Core Web Vitals" signal instead.

https://developers.google.com/search/blog/2020/11/timing-for...

I think it says "honestly" when breaking bad news.

"buddy" -> "mate" -> M8. Nice.

That seems to be what's happening. Like 2-4 bots talking to each other, then Jarred Sumner just does the final merge with little comment.

https://github.com/oven-sh/bun/pull/39743 https://github.com/oven-sh/bun/pull/39735

No, they would just ignore Firefox and not test against it, and might start to use chrome/safari-only features.

This makes sense. Originally Fable was going to be available via subscription June 9th through June 22nd (~14 days).

It ended up being available 2.5 days before pulled, then was made available July 1 through July 7. (~7.5 days), so only ~10 days total.

Now they're giving us 5 more days, so ~15 days total, more similar to what they originally announced.

Part of the problem is The US Government (and UK Government) use the "2% rule" on their websites and only officially support 98%.

I mentioned 3 years ago that Firefox at 2.2% is dangerously close the being unsupported on government websites, and at this point it's now at 1.9%.

https://news.ycombinator.com/item?id=36776603

https://analytics.usa.gov/ says "There were 1.66 billion sessions in the last 30 days." - so 2% is 33 million sessions if I did my math right.

> no cooldown (or a much smaller countdown) for security fixes.

A supply chain attack would likely able to publish a "security" release just as easily as a normal release, so I don't think that would help much.

Release notes here: https://docs.djangoproject.com/en/dev/releases/6.1/

Looks like there's some features to try to reduce the “N+1 queries problem”.

> I just caught myself about to copy and paste it into Claude to see what it thinks because I'm worried that it doesn't make sense or it reads funny or there's something missing. That's the self-doubt that it's feeding on and what I need to fight back.

This is where I'm at. I feel like I need AI to review everything.

> As the victim of the one from last year

Background here:

https://news.ycombinator.com/item?id=45169657

https://news.ycombinator.com/item?id=45187528

> Or are folks seriously proposing that the patch/mitigations should have been circulated to distro maintainers privately before going to mainline?

I always assumed that distro maintainers got early access to patches before going mainline but maybe that’s not true?

Github Copilot also lets you use other models when one has an outage.

> Disruption with Gemini 2.5 Pro model

> Disruption with Grok Code Fast 1 in Copilot

> Incident with Copilot Grok Code Fast 1

> Claude Opus 4 is experiencing degraded performance

It doesn't seem fair to blame Github for this? There's nothing they can do about it?