treesknees

You’re not actually making the point you think you are. This comes back to the original comment stating you need to compromise a lot to MITM here.

So you need to somehow trick macOS into remotely connecting to the wrong bssid, and then arp poison a user who happens to be using a macOS cli tool that’s using https.

Sounds pretty targeted and unlikely to happen.

Client isolation is very common on wireless and wired LANs these days in enterprise and guest network environments. You also have tools like dynamic arp inspection to block poisoning attempts via the network switch.

If you get past all of that, you still need a victim who is actively using a cli tool on macOS using https.

It’s not impossible, but the conditions are much more specific than those needed to inject porn into a webpage on a poorly configured school network in 2006.

The one that doesn’t fly is only a $45,000 loan

The website still loads and renders text without js enabled. The JavaScript only appears to cycle the text through multiple translations. I suppose you could do most of this with pure CSS, but what’s the point?

I think if you want to depend on a “safe inert noscript” website for your purposes, you should put up a webpage for it yourself and use that.

It has ramped up over time, it used to be just a few seconds was enough. You’re right that it’s unsustainable and annoying.

Doubtful. You’re not going to mine a bitcoin in 30 seconds.

It’s been pretty popular lately to utilize a proof of work problem to deter AI scrapers. This is likely what you’re seeing.

Anubis is the one I’ve seen most often, but not the only one. https://github.com/techaroHQ/anubis

Without more context it’s hard to say whether 332 is reasonable, but I interpreted “reasonable” as in there will always be some amount of harmful content uncaught by automated systems.

I’ve been running a VPS with the same IP (v4 and v6) for ~15 years, so I’d say its stable enough. What should I use as an upstream source of time in this case that would actually be useful?

I downloaded it along with everyone else. It’s decent but the voice over through CarPlay is choppy and cuts off words. You also can’t report or see hazards, speed checks, etc. and its time estimate is less accurate.

I want them to do well. But they need to add a few key features to actually compete beyond just the geographical names.

Seems to be missing some data. There was a safety recall for 2016-2017 Jeep Wranglers that doesn’t appear to be listed. https://static.nhtsa.gov/odi/rcl/2016/RCRIT-16V734-3469.pdf

In my experience, it’s their chat harnesses/website that filters historical events. The model itself doesn’t.

For example you can point opencode at DeepSeek v4 and ask, it will accurately tell you about Tiananmen square.

This is similar to my use case as well. I’ll use a cloud model to identify security issues in a codebase and then use a report/spec output as input to the local model to build tests or verify the issue is real.

I stopped drinking alcohol for the new year. I wasn’t an alcoholic, but I’m sure I’ve driven home after consuming enough alcohol to blow above the legal limit. It’s not something I’m proud of. But one day I decided I was done taking risks like that, done feeling crappy the next day, done having to wreck myself just to socialize.

I don’t really miss it. Honestly the worst part is constantly having to defend my drink choice (mocktail or N/A beer) to the people I’m with who are ordering alcohol.

One where customers have their own scanners, and their unfounded panic overrides logical analysis by the engineers and admins.

We’ve had to patch plenty of stupid “security” bugs just to satisfy a paying customer.

Why not link to the English version? It seems intentionally misleading.

https://www.kimi.com/user/agreement/userPrivacy?version=v2

There are many people who believe everything must be a grind to get rich. I wish more people stepped back and did things online because they were fun or educational, not because it was monetized.

Something I didn’t see mentioned was that this unequal memory access time also affects pcie I/O. If your thread on CPU A needs to get data in or out of a nic on CPU B, your throughput/latency will be impacted.

We have to explain this to customers of our software all the time, it’s something that’s easy to miss.

ZeroSSL – free 90-day certs via ACME, also has a web UI for cert management

Google Trust Services – free ACME certs, requires a Google account for registration

SSL.com Free DV SSL – offers free 90-day certs through ACME

You can sort of do this today with iCloud. Add a custom domain and enable the catch-all forwarding, and you can receive [email protected] and it’s forwarded to you.

What you’d lose is the reply-to forwarding feature.

I have over 300 so far. In addition to knowing where spam is coming from, and being able to block it, it also helps prevent correlation across accounts and websites as data leaks occur.

This exactly reflects my feelings lately. I have a specific coworker who has gone somewhat overboard - every single code review, answer to any question on email or Teams, every new story, even their personal opinions during a design or ideas meeting, are all direct AI output with no massaging or human touch or review. They're working on planning out an upcoming project, and I just get verbose and long documents to review, and based on the issues I find I doubt they are even looked over first beforehand.

I understand that the information may be accurate, even helpful at times, but feeling like I'm constantly talking to an AI chat bot all the time gets tiring. And I don't appreciate having to double-check everyone else's AI generated responses for them.

GitHub Copilot refuses to do any security testing or proof-of-concepts for exploits. While I understand why, we pay for Enterprise and I’m working on our proprietary code base. It’s incredibly annoying.

I’ve actually had luck taking the analysis from GHCP and pasting it into our M365 Copilot and getting a useful poc to stick into my bug reports.

Location is used for tracking distance/speed for certain activities and measuring VO2 max levels, and for finding a lost ring.

I was stuck between the two, Oura won for its better sleep tracking and battery life.

I suppose one option would be to enable data syncing to Apple Health, and periodically delete/create new Oura accounts to purge historical health data. Not a great workflow, but would let you benefit from E2EE with Apple Health while using Oura (assuming Oura’s “delete account and all data” does what it claims)

>Microsoft was effectively paying Anthropic for thousands of seats. Switching to internally-developed tools eliminates that cost while strengthening Microsoft's own AI product portfolio

This is just shifting the cost around. At the end of the day, whether developers are using Claude models through Claude Code or Copilot, Microsoft is still paying Anthropic.

For the price, they could buy an exact replica bare metal server and still save money.

Don't post generated comments or AI-edited comments. HN is for conversation between humans.

https://news.ycombinator.com/newsguidelines.html

I don’t think it’s API costs. Their Sonnet 4.6 is just 1x premium request which matches the 1x cost of the various GPT Codex models.

You’re not locked into vscode. There are plugins for other IDEs, and a ‘copilot’ cli tool very similar to Claude Code’s cli tool.

I also wouldn’t say you’re locked into Microsoft’s ecosystem. At work we just have skills that allow for interaction with Bitbucket and other internal tooling. You’re not forced to use GitHub at all.