traceroute66
Honestly this old chestnut comes up time and time again.
As much as many people would love the King/Queen to put the politicians in their place sadly there are two problems.
First, the monarch's role is effectively only ceremonial these days. Even "The King's speech" during opening of parliament is actually a piece of paper written by the ruling-party of the day, the King just sits there in his fancy regalia and reads it verbatim.
Second, if you are referring to veto during the royal ascent process. As per Wikipedia, the King does not have pure veto power, his options are:
- grant royal assent, thereby making the bill an act of Parliament.
- delay the bill's assent through the use of reserve powers, thereby invoking a veto.
- refuse royal assent on the advice of his or her ministers.
Or why have a smartphone in the first place if you're not going to put any sort of meaningful apps on it. ;)
I don't know where you live, but where I am most banks insist on proprietary 2FA via their own app. Only (some of) the fintechs allow TOTP.
Yes you can get your codes via SMS, but I thnk we all know what a security mess SMS is. I would rather have the bank's proprietary app since at least everything will be going over HTTPS and also eliminates most of the vulnerabilities associated with SMS just by virtue of being an app.
Two things:
a) Why the would you never want to update an OS in this day and age ?
b) I understand the perspective of people insisting on wanting to be able to root their phone. But how about we take a step back and look at the reality of the 2026 security environment ? An environment where you have:
- Increasing volumes of increasingly sneaky security exploits on one side
- A phone with your 2FA apps, your banking apps, your email apps, your kids photos on the other
If I want to be root, I can do so on my desktop or a cloud VM or whatever.
But making root on a phone easy just seems like a recipe for disaster... if its easy for you, its easy for the bad guys too.
The wording on the Taler website is a bit wishy-washy, but I THINK the TL;DR is:
1. They tried to do be a payments processor with assistance from a German bank.
2. That didn't work out for what Taler claims are "unrelated reasons" but I suspect we all can agree it was due to KYC/AML hurdles.
3. The Taler plan now appears to not be a payments processor but rather merely an issuer.
And in that respect, there is plenty of precedent for that passing in the EU, i.e. there are are already many online places you can go swap your Euro for Bitcoin legally.
So, yes, there will still be KYC/AML. You will still need to provide your ID to swap your Euro for your Taler. But after that, Taler has nothing to do with transaction processing, you go spend your Taler balance elsewhere and somebody else's server processes the transaction. Taler will know and be obligated to retain records of who bought how much, when and how but not when and where (of if) they spent it.
At least that's my interpretation of the word-soup on their website.
Just dumping a million results on the user to doom-scroll through is a bit problematic in terms of UI/UX.
But in all honesty there are serious questions to be asked about:
a) The initial approval process for ANY CA
b) The ongoing monitoring process for ANY CA
The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.
Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.
Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.
I think the problem that "coordinated disclosure" has too many people and companies with conflicts of interest.
For example, this PHP "coordinated disclosure", you have:
- OpenAI, Wiz etc. no doubt looking for ways to sell you a subscription to the highest tier
- Chainguard with a vested interest in selling their wares and being "first" with a patch.
- etc. etc.
Meanwhile the rest of the world with good-old LAMP (Linux Apache Mysql PHP) installations ? Meh ... a mere afterthought to the money-making opportunities. Some posts on HN suggest there was a 2 month delay between discovery and "coordinated disclosure" ?
Historically you might have written this off as an un-necessarily cynical view. But sadly I think it is a valid reflection of the world we live in today.
Yeah ... I, erm... can't take that blog post remotely seriously.
Engineering a situation and calling it a vulnerability ?
What a joke. I'm sure you could find a way of engineering a fake vulnerability with Anthropic or OpenAI too and then write a fancy blog post about it.
AND ANYWAY ... whether you are using US or Chinese models, what stupid idiot does not review the slop written by LLMs anyway ? Especially if you are writing for a security-sensitive environment ?
Not sure your definition of sandbox but mine doesn't include unfiltered internet access ?
People here bringing up the straw clutching argument of "but Tianament Square" is becoming really tiresome.
The fact is a Chinese LLM's lack of knowledge about Chinese politics will not affect 99.99999999999% of users and their workflows.
And for the 0.000000001% who are affected, they don't need an LLM. A quick search of Wikipedia or 5 seconds on Google will suffice.
What the hell has Tiannamen Square got to do with Joe Blogg's vibecoding session ? Absolutely nothing.
Meanwhile Anthrophic, OpenAI & Co can't even manage to stop their LLMs from hacking into third-party servers until they discover it after the event.
What happened to people's ability to implement basic security architectures like sandboxing etc ?
If we're wearing tinfoil hats then do we know the NSA have not planted stuff in Anthropic and OpenAI anyway ? ;)
I think the Chinese would be happy enough to see OpenAI and Anthropic suffer because people discover open-weights can get you most of the way there for a fraction of the cost.
You don't have to target the end users. Economic impact on the US providers would be sufficient.
The Chinese are also no doubt seeking to play the long game of hoping to (eventually) rebalance the US-centric world order in an Easterly direction.
For the record this is also possible in Europe on Privatemode[1] which also gives you enclave-based processing. And access to GLM-5.3 Flash as well as GLM-5.3
I'm not rising to that bait. I'm sure you know perfectly well what I mean.
So let's just be polite, cordial and leave that topic there there. I'm sure you know its a topic that attracts 'strong views', particularly from the Rust side, which is no doubt why you're trying to engage on it.
Rust is also a language with no real stdlib, and so you have to import crates for everything including the kitchen sink.
Which opens you up to the very real risk of supply chain vulnerabilities unless you make an active effort to code review your imports and keep the length of your import list under control.[1][2][3]
Rust supporters also need to urgently realise that memory safe != secure. It is very much possible to have vulnerabilities in memory safe code.
This has been demonstrated by Cloudflare[4] and countless others.
Age-old vulnerability classes such as input validation, error handling and many others are still very much possible in a Rust codebase.
So please. Yes, I'm sure Rust is a fantastic memory-safe language. But do not portray it as being magically immune from CVEs.
[1] https://kerkour.com/rust-supply-chain-nightmare
[2] https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-...
[3] https://tweedegolf.nl/en/blog/104/dealing-with-dependencies-...
[4] https://hackaday.com/2025/11/20/how-one-uncaught-rust-except...
IIRC there have been attempts to introduce human-like behavior like with Shredder which was designed to introduce human-like mistakes.
Let me tell you a story about an idiot politician who woke up one day and thought Brexit would be a fantastic idea, and then the stupid dim-witted "ultra-hard brexit" manner in which it was implemented by a certain Mr Johnson.
The same reason UK people can't open EU bank accounts is the same reason EU banks have separate operating companies and infrastructure in the UK.
Given they operate in a heavily-regulated environment it almost certainly made life easier for them to keep UK stuff in the UK because they had no idea how (or if) the regulatory environment would ever progress beyond ultra-hard brexit.
Sadly there is an increasing preponderance on the part of retailers to do one of two things:
1. Go card only (sadly happening in far too many places)
2. Make it incredibly difficult to pay by cash (e.g. 10 card tills, 1 cash till with long queues because it is also the cigarette/lottery ticket/package collection till)
And actually paying people not to ! (Paying RWE $1.2bn to abandon wind contracts[1])
Its absolutely nuts. Pure generational can-kicking.
I think there is also a perhaps the need to assign air-quotes to "investors" when talking about the US markets.
There's too much fluff and noise there. Too much (over)leveraged trading. Too much speculation.
What the real investors think is hidden behind the actions of the speculative traders.
> I think they do not believe that big corporations in the US or Europe would actually use chinese models
The Chinese models are open-weight. You can download them and run them on your own servers. Or you can outsource to Mistral, Privatemode or any of the many other US/EU inference hosters.
So the "security, regulatory and/or business continuity concerns" arguments are effectively non-existent. And whatever argument does possibly remain, also applies equally to Anthropic, OpenAI & co.
You missed the bit where they used the word "revenue".
I suspect if you factor in all the various overheads of running datacentres the actual value is lower. Revenue is vanity, profit is sanity as the old saying goes.
However the Chinese do have the benefit that China are pushing hard on renewable energies. So at least that major part of the equation is probably far lower than your average US/EU site.
I do broadly agree that of all the things tinfoil could/should be working on in relation to service features, this is perhaps an odd use of their time. And I do wonder if this ultimately came about due to some sort of external pressures or maybe a big-spending customer asked for it. Who knows. Their blog post is a little vague on the background context other than selling it as Good Thing (TM).
Clearly I'm not defending tinfoil regarding scanning but I think its only fair that you do not make the statement out of context[1].
People should read the context[1] and come to their own decisions.
Also recall that given how attestation works, Tinfoil are forced to publish what they run in the enclave in their GitHub account[2] so you can verify the statement on their blog against their repo. You do not have that luxury with the closed-source "ZDR" brigade.
[1] https://tinfoil.sh/blog/2026-09-14-safety-without-compromisi... [2] https://github.com/tinfoilsh
ZDR is:
1. A pinky-promise you have no way of verifying
2. A contract term, which means its still subject to the good-old "lawful request or court order" clauses
3. Subject to arbitrary provider exceptions ... see Anthropic and Fable
See Tinfoil (US)[1] or Privatemode (Germany)[2].
Anyone who has done first responder training should have had it drilled into their skulls to remember the number one rule .... "do not add yourself to the injury list".
If you're operating in a war-zone its kind of the same thing. Send in a helicopter to drop off one or more guys and you are also sending in bare minimum of one extra person but realistically almost certainly three extra people (two at the front and one at the back to watch the people jumping out).
Also drones are probably somewhat cheaper than helicopters. Both to buy and to operate.
And ASPA validation[1]
[1] https://blog.apnic.net/2026/07/09/aspa-at-apnic-strengthenin...
"We have published a GitHub repository so you can run Timestral on your own data."
For example, before February 2026 you could use any sort of photo ID (e.g. driving license) between UK and Ireland. Now you need a passport. [1]
Regarding the EU. Yes, an EU citizen may travel through most of EU without a passport. But:
1. Most (all ?) of the EU also has ID cards, and people will fly between EU countries on their ID cards. Many young Europeans fly intra-Europe with nothing more than their iPhone (Apple Pay) and their ID card in a slot of the iPhone holder – and maybe a backup physical credit card if you're lucky.
2. Many EU countries have requirements to show your ID on demand. So you still need a passport or an ID card on you, even if you are taking advantage of Schengen land crossings. Because you will have a bad day in the office if a Police officer stops you and requests your ID and you are unable to produce because you left it at home 400 kilometers away in a different country.
I mean, why the hell would you want to leave a country without a passport anyway unless you were forced to do so as a refugee etc. ?
Also name me an airline or whatever that will even allow you to board without a passport these days ?
I understand the overall story they are telling in the blog post, but some of the digs they are having at Japan are a bit excessive and unreasonable.
It might well be a law in Japan, but in the rest of the world its damn common sense. The Japanese just chose to write it down.